Ransomware · 51 days ago
GuidePoint Research and Intelligence Team (GRIT) found a cybercriminal affiliate calling itself Ransom Busters emailing victims of DragonForce, Settra, and Anubis, claiming access to gang servers, keys, and stolen data. The pitch asked for $20,000 to $60,000 to recover files or delete data, while the attacks were still not public.
The trick is a second payment scheme wrapped in rescue language. The message borrows the look of incident-recovery help, but the claimed access is the leverage: pay us, and we will supposedly hand back files or erase copies held by the ransomware group. That turns recovery outreach into part of the extortion chain, not a break from it.
For incident-response teams, that means the identity and timing of anyone offering recovery help now matters as much as the ransom note itself. If a third party appears before an incident is public, the open question is not whether they are helpful, but which criminal side they are trying to monetize.
4 sources covering this story
Ransomware crook poses as recovery firm to steal payments from fellow extortionists
Because apparently even ransomware gangs can't trust the people they do business with
Rogue ransomware affiliate poses as recovery firm to steal payments
A suspected ransomware affiliate is posing as a ransomware recovery service called
Rogue ransomware affiliate poses as data recovery firm to steal payments
A suspected ransomware affiliate is posing as a ransomware recovery service called
Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000
Ransom Busters claims ransomware server access and asks victims for $20,000 to $60,000 to recover files and delete stolen data.
'Ransom Busters': Ransomware Actor Poses as Recovery Service
A ransomware affiliate appears to be sidling up to victims with offers of aid, masking its true intention of diverting ransom payments.
Part of the PlainSec briefing for 2026-08-19