- Published on
Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000
- Authors
- Name
- DeepHorus
A rogue ransomware affiliate operating under the name "Ransom Busters" has adopted a novel and deceptive tactic, directly contacting victims and claiming to hack the servers of the very ransomware groups that attacked them. The actor demands a fee, ranging from $20,000 to $60,000, promising to delete the stolen data from the attackers' infrastructure and help the victim recover. This proactive outreach, which begins before the attack is even public, immediately stands out as highly unusual in the cybersecurity landscape.
Cybersecurity firm GuidePoint Research and Intelligence Team (GRIT) highlighted this activity in a recent report. GRIT responded to several incidents involving this threat actor, who is believed to be a ransomware affiliate with connections to multiple ransomware-as-a-service (RaaS) operations, including groups like DragonForce, Settra, and Anubis. The emails from "Ransom Busters" request contact with a victim company's CEO or IT leadership.
In its messages, the threat actor claims to have exploited vulnerabilities in the administrative panels of RaaS groups, maintaining access to their servers for over three years. It alleges that it found the victim's stolen data on a recently accessed server and offers to delete all backups held by the ransomware group in exchange for the payment. The actor provided a puzzling justification when questioned, stating that acting without compensation would risk its ongoing access to the criminal infrastructure.
GRIT's analysis of multiple incidents revealed striking operational similarities, indicating a single actor is likely behind the persona. Common tools included SoftPerfect Network Scanner for reconnaissance, s5cmd for exfiltrating data to AWS cloud storage, and a remote monitoring and management tool installed via PowerShell. Forensic evidence also showed the creation of a local backdoor account with the password "Numlock!123" and the use of the same attacker-controlled hostname across incidents.
Justin Timothy, a Principal Consultant at GRIT, emphasized the severe trust issues this creates. He warned that criminal actors cannot be trusted and may use deceptive tactics to extract further payments. "'Ransom Busters' masquerading as beneficent saviors should be treated as a hoax," Timothy stated, noting that payment offers no guarantee of data deletion and the actor is willing to betray even its own criminal partners for profit.
The implications are clear: victims face layered extortion from multiple criminal factions. This discovery underscores the chaotic and treacherous nature of the cybercriminal ecosystem. Security experts advise against engaging with such unsolicited offers, as they represent a new form of cybercrime-on-cybercrime, further complicating the ransomware crisis for organizations already in distress.
