A cybercriminal group known as Ransom Busters has been reaching out directly to organizations that have fallen victim to ransomware attacks, offering to delete stolen data from the attackers’ servers in exchange for payments ranging from $20,000 to $60,000.
According to the GuidePoint Research and Intelligence Team (GRIT), Ransom Busters claims to have identified vulnerabilities in the administrative panels of various ransomware-as-a-service (RaaS) operations. They assert that they have exploited these weaknesses over the past three years to access and compromise the servers of these ransomware groups.
In their communications, Ransom Busters requests contact with the victim organization’s CEO or IT leadership. They claim to have discovered the company’s stolen data on a recently accessed server and offer their services to help the organization regain access to its files and ensure the deletion of any backups held by the ransomware group, contingent upon the payment of the specified fee.
GRIT has observed this pattern in incidents involving threat groups such as DragonForce, Settra, and Anubis. The cybersecurity firm emphasizes that the likelihood of Ransom Busters being a legitimate organization is extremely low, as their actions would constitute a violation of the U.S. Computer Fraud and Abuse Act.
Justin Timothy, a Principal Consultant at GRIT, noted that when questioned about their fee structure, Ransom Busters provided a perplexing rationale: they claimed that acting without compensation would jeopardize their access to the threat actors’ infrastructure.
Further analysis of two separate incidents where Ransom Busters contacted victims revealed notable similarities. In both cases, the following tools and tactics were employed:
- SoftPerfect Network Scanner for internal reconnaissance
- s5cmd for exfiltrating data to cloud storage via AWS
- Remotely remote monitoring and management (RMM) tool, installed through a PowerShell script
Additionally, a local backdoor account was created using the password “Numlock!123,” and the same attacker-controlled hostname, DESKTOP-BBETH6K, was detected in both intrusions. These consistencies suggest that a single operator, likely an affiliate rather than an independent third party, is behind these activities.
Timothy emphasized the risks for ransomware victims, stating that criminal actors cannot be trusted and may employ deceptive tactics to extract additional payments. He warned that paying any criminal party offers no guarantee that stolen data will be deleted and advised treating Ransom Busters’ offers with skepticism.
This development underscores the evolving tactics within the cybercriminal ecosystem, where affiliates may betray their own partners for financial gain. Organizations are urged to exercise caution and seek legitimate cybersecurity assistance when dealing with ransomware incidents.
