A ransomware affiliate known as 'Ransom Busters' is approaching victims of cyberattacks, falsely presenting itself as a recovery service while intending to divert ransom payments. This group claims to have infiltrated criminal organizations and offers to return files for a fee, which raises red flags regarding their legitimacy.
Threat intelligence experts from GuidePoint Security observed that the tactics employed by Ransom Busters undermine traditional ransomware payment structures by creating uncertainty about data deletion after payment. They emphasize that legitimate incident-response firms do not typically engage victims mid-incident and warn that communications from Ransom Busters indicate malicious intent, including the use of unverified email domains and requests for payment in Bitcoin.
Ultimately, the group appears to be targeting victims outside established ransom payment frameworks while damaging the credibility of the ransomware operations they claim to operate alongside.