“Ransom Busters”: A Ransomware Affiliate Posing as Rescuers

The GuidePoint Security Research and Intelligence Team (GRIT) has described an unusual scheme: unknown actors operating under the banner of a recovery service called “Ransom Busters” email the victims of ransomware attacks with an offer to help. For a fee ranging from $20,000 to $60,000, they promise to hand over decryption keys and to wipe the stolen data from the gangs' servers — among the groups named are DragonForce, Settra and Anubis.

The very timing of the outreach raised suspicions. The emails reached victims before the attacks had become public — which means the senders somehow knew about the breach in advance. “Ransom Busters” explained this by claiming they exploit vulnerabilities in the admin panels of RaaS operations and thereby gain access to the keys and the stolen data.

The rescuer is the arsonist

After dissecting two incidents, GRIT analysts concluded that what they were dealing with was most likely not an outside rescuer but the very affiliate behind the attacks. In both cases the attackers used identical tooling — the SoftPerfect Network Scanner, the s5cmd utility and the Remotely remote-access tool — as well as the same techniques: a local “rogue” account with the password Numlock!123 and the same attacker-controlled hostname DESKTOP-BBETH6K.

The overlaps turned up across several RaaS operations at once. With moderate confidence, the researchers believe that “Ransom Busters” is the work of a single affiliate who uses their access to divert the ransom away from the very ransomware groups they work for.

Paying is not advised

GRIT has not recorded any cases of payment being made specifically to “Ransom Busters,” and strongly advises against doing so. In one of the episodes the victim ultimately paid the RaaS group itself — its data never appeared on the leak site, and no signs were found that the stolen material had been published outside the extortionists' infrastructure.

The negotiation firm Coveware confirmed that it, too, had encountered at least one such approach. According to senior director of incident response Elizabeth Cookson, a “third party” contacted the victim by email, claiming to possess both the decryption key and the stolen data. Coveware had come across similar “middlemen” under other names as far back as 2024, but the current case stands out: ordinary “ambulance chasers” write to victims only after an attack has been publicly disclosed, whereas here the intervention occurs during a non-public incident — and that is more alarming.

The chief danger is that the appearance of an outsider with access to the stolen data undermines the very logic of the ransom: even after paying the group, the victim can no longer be sure that everyone holding the data will keep their promise not to publish it. Coveware fears that growing mutual distrust within RaaS schemes will breed more of this behavior — affiliates will increasingly look to profit by bypassing the standard split of proceeds with the operators.

Source: Bleeping Computer