# Ransom Busters — Rogue ransomware affiliate posing as recovery firm to intercept ransom payments

> A suspected ransomware affiliate operating as 'Ransom Busters' contacts ransomware victims before attacks become public, offering decryption keys and stolen data deletion for $20,000–$60,000. GuidePoint Security GRIT assesses with moderate confidence that this is a single affiliate using their access to steal ransom payments from the RaaS operations they work with (DragonForce, Settra, Anubis). The scheme represents a significant escalation in third-party ransomware interference, eroding the traditional 'pay and decrypt' model by introducing an uncontrollable third party with access to victim data.

- **Published:** 2026-08-19T00:00:00Z
- **Last reviewed:** 2026-08-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2074
- **ID:** TL-2026-2074
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Ransom Busters
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Ransom Busters is a fraudulent persona that contacts organizations hit by ransomware, claiming to have breached the administrative panels of the ransomware-as-a-service (RaaS) operations that attacked them. The group offers to permanently delete stolen data from ransomware group servers and provide decryption keys in exchange for $20,000 to $60,000 in Bitcoin, requesting contact with the victim's CEO or IT leadership via ProtonMail. GuidePoint Security's GRIT (Research and Intelligence Team) identified this activity through incident response engagements where the same anomalous tooling, infrastructure, and credentials appeared across two separate ransomware incidents involving different RaaS operations.

GRIT found that the attacker used identical tooling — SoftPerfect Network Scanner for network reconnaissance, s5cmd for high-performance S3-compatible cloud storage exfiltration, and Remotely (an open-source .NET remote monitoring and management tool) for persistent remote access — across incidents involving DragonForce, Settra, and Anubis ransomware. Critically, the same local backdoor account password (Numlock!123) and attacker-controlled hostname (DESKTOP-BBETH6K) appeared in both incidents, strongly indicating a single operator. GRIT assesses with moderate confidence that Ransom Busters is not a legitimate third party but rather a ransomware affiliate 'using its access to steal ransom payments from the ransomware gangs it works with,' effectively double-dipping by collecting both the RaaS affiliate commission and direct victim payments.

Coveware, a ransom negotiation and incident response firm, confirmed responding to at least one such incident where the group contacted the victim via email claiming access to both the decryption key and stolen data. Coveware distinguishes this from traditional 'ambulance chaser' recovery scams that only contact victims after public disclosure — Ransom Busters' pre-public knowledge is 'much more concerning' because paying the original ransomware operator no longer guarantees that all parties with access to the data will honor a non-disclosure agreement.

The scheme creates a trilemma for victims: pay the RaaS gang, pay Ransom Busters, or neither — with no guarantee that any party will not still leak the data. Ransom Busters claimed to have been 'breaking into the servers for over three years' and justified their fees by stating that 'acting without compensation would put their access to the threat actor's infrastructure at risk.' GRIT's principal consultant Justin Timothy noted that the possibility of a legitimate organization is 'extremely unlikely' as it would violate the U.S. Computer Fraud and Abuse Act (CFAA). At the time of publication, no confirmed victims had paid Ransom Busters, and GRIT actively discourages payment to any criminal party.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1569 System Services
- T1078 Valid Accounts
- T1133 External Remote Services
- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1003 OS Credential Dumping
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1560 Archive Collected Data
- T1219 Remote Access Tools
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1490 Inhibit System Recovery
- T1657 Financial Theft

## Sources

- [Rogue ransomware affiliate poses as recovery firm to steal payments](https://www.bleepingcomputer.com/news/security/rogue-ransomware-affiliate-ransom-busters-poses-as-recovery-firm/)
- ['Ransom Busters': Ransomware Actor Poses as Recovery Service](https://www.darkreading.com/cyberattacks-data-breaches/ransom-busters-ransomware-actor-incident-recovery-service)
- [Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000](https://thehackernews.com/2026/08/ransom-busters-claims-it-hacked.html)
- [Ransomware Affiliates Adopt Fake Recovery Services as New Extortion Revenue Stream](https://cybersecuritytimes.com/ransomware-fake-recovery-services/)
- [Ransomware victims being duped with fake Ransom Buster Email Communication](https://www.cybersecurity-insiders.com/ransomware-victims-being-duped-with-fake-ransom-buster-email-communication/)
- [Coveware by Veeam — Cyber Extortion Payment Trends Q2 2026](https://www.veeam.com/blog/cyber-extortion-payment-trends-q2-2026.html)
- [DragonForce Ransomware — Threat Profile and Technical Analysis](https://www.cybereason.com/blog/threat-analysis-report-dragonforce-ransomware)
- [Anubis Ransomware Threat Profile — Vali Cyber](https://valicyber.com/resources/anubis-threat-profile/)
- [Settra Ransomware — MOXFIVE Threat Analysis](https://www.moxfive.com/resources/settra-ransomware-threat-analysis)
- [CISA — FiveHands Ransomware Analysis Report (AR21-126A)](https://www.cisa.gov/news-events/analysis-reports/ar21-126a)
- [Coveware Q1 2026 Ransomware Report](https://www.veeam.com/analyst-reports/coveware-report-q1-2026_wp.pdf)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2074