Ransom Busters: A Deceptive "Recovery" Scheme Targeting Ransomware Victims
A threat actor operating under the name Ransom Busters has been contacting ransomware victims with a fraudulent offer to restore encrypted files and delete stolen data from criminal infrastructure. According to GuidePoint Security’s Research and Intelligence Team (GRIT), the group is likely a ransomware affiliate attempting to divert extortion payments from established ransomware-as-a-service (RaaS) operations.
The actor, posing as Ransom Busters LTD, sends unsolicited emails to CEOs and IT leaders, claiming to have accessed compromised ransomware servers and obtained victims’ exfiltrated data. The messages assert that the group can decrypt files and destroy backups held by the original attackers offers that GRIT assesses as an alternate form of extortion rather than a legitimate recovery solution. Payments demanded range from $20,000 to $60,000, with no guarantee of data deletion or decryption key authenticity.
GRIT’s investigation revealed that Ransom Busters possessed the same stolen datasets as the ransomware affiliates responsible for the initial intrusions, suggesting direct involvement in the attacks. The group’s claims of accessing multiple RaaS administrative panels remain unverified. Notably, the actor contacts victims before their breaches become public a tactic that distinguishes it from legitimate incident response firms, which typically engage only after disclosures.
Forensic analysis of two affected environments uncovered identical intrusion artifacts, including the use of SoftPerfect Network Scanner for reconnaissance, s5cmd for AWS-based exfiltration, and Remotely RMM tools deployed via PowerShell. Both cases also featured a backdoor account with the password Numlock!123 and an attacker-controlled hostname (DESKTOP-BBETH6K), reinforcing GRIT’s assessment that Ransom Busters is a single affiliate operating across multiple RaaS ecosystems.
The scheme highlights the evolving monetization tactics in ransomware, where affiliates may independently exploit victims while undermining the original operators’ extortion efforts. Organizations targeted by such offers are advised to preserve communications, avoid independent negotiations, and report incidents to law enforcement and incident-response providers. The case underscores the risks of unverified recovery claims and the need for disciplined evidence preservation in ransomware incidents.
Source: https://gbhackers.com/ransom-busters-ransomware/
Ransom Busters LTD TPRM report: https://www.rankiteo.com/company/the-fraudbusters
GuidePoint Security TPRM report: https://www.rankiteo.com/company/guidepointsec
"id": "guithe1787135084",
"linkid": "guidepointsec, the-fraudbusters",
"type": "Ransomware",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'type': 'Organizations targeted by ransomware'}],
'attack_vector': 'Unsolicited emails to CEOs and IT leaders',
'data_breach': {'data_encryption': 'Yes (ransomware encryption)',
'data_exfiltration': 'Yes (AWS-based exfiltration using '
'*s5cmd*)',
'type_of_data_compromised': 'Exfiltrated data from ransomware '
'victims'},
'description': 'A threat actor operating under the name *Ransom Busters* has '
'been contacting ransomware victims with a fraudulent offer to '
'restore encrypted files and delete stolen data from criminal '
'infrastructure. The group, posing as *Ransom Busters LTD*, '
'sends unsolicited emails to CEOs and IT leaders, claiming to '
'have accessed compromised ransomware servers and obtained '
'victims’ exfiltrated data. The messages assert that the group '
'can decrypt files and destroy backups held by the original '
'attackers, but these offers are assessed as an alternate form '
'of extortion rather than a legitimate recovery solution.',
'impact': {'data_compromised': 'Exfiltrated data from ransomware victims',
'financial_loss': '$20,000 to $60,000 (demanded payments)'},
'initial_access_broker': {'backdoors_established': 'Yes (backdoor account '
'with password '
'*Numlock!123*)'},
'investigation_status': 'Ongoing (forensic analysis conducted on two affected '
'environments)',
'lessons_learned': 'The scheme highlights the evolving monetization tactics '
'in ransomware, where affiliates may independently exploit '
'victims while undermining the original operators’ '
'extortion efforts. Organizations are advised to preserve '
'communications, avoid independent negotiations, and '
'report incidents to law enforcement and incident-response '
'providers.',
'motivation': 'Financial gain through fraudulent recovery offers',
'post_incident_analysis': {'root_causes': 'Use of *SoftPerfect Network '
'Scanner* for reconnaissance, '
'*s5cmd* for AWS-based '
'exfiltration, and *Remotely* RMM '
'tools deployed via PowerShell. '
'Identical intrusion artifacts '
'across affected environments.'},
'ransomware': {'data_encryption': 'Yes',
'data_exfiltration': 'Yes',
'ransom_demanded': '$20,000 to $60,000'},
'recommendations': 'Preserve communications, avoid independent negotiations, '
'report incidents to law enforcement and incident-response '
'providers, and ensure disciplined evidence preservation '
'in ransomware incidents.',
'references': [{'source': 'GuidePoint Security’s Research and Intelligence '
'Team (GRIT)'}],
'response': {'third_party_assistance': 'GuidePoint Security’s Research and '
'Intelligence Team (GRIT)'},
'threat_actor': 'Ransom Busters (likely a ransomware affiliate)',
'title': "Ransom Busters: A Deceptive 'Recovery' Scheme Targeting Ransomware "
'Victims',
'type': 'Ransomware Extortion Scheme'}