Scammers pose as ransomware recovery agents, but just go on to steal more
from victims

Date:
Thu, 20 Aug 2026 15:30:00 +0000

Ransom Busters are not an actual ransomware recovery firm - they're
ransomware affiliates looking to steal your money, too -- Ransomware
operations have evolved again, and this time around the crooks are pretending to be the good guys.

Cybersecurity researchers GuidePoint Security were recently brought in to respond to multiple ransomware attacks against their clients. In some of
those incidents, the victims were also contacted by a group calling
themselves Ransom Busters, which offered to delete the stolen files from the attackers servers, while providing the victims with working decryption keys. What made the offer suspicious was the fact that Ransom Busters reached out
to the victims before the attackers had gone public. The crooks claimed to have hacked into the admin panels of multiple Ransomware-as-a-Service (RaaS) operations, including DragonForce, Settra, and Anubis, giving them not just insight into who was targeted, but also access to stolen data and the decryption keys.

For their services, Ransom Busters ask between $20,000, and
$60,000 - however, the researchers are saying this is all a ruse, and that Ransom Busters are, most likely, just affiliates of these ransomware
services. Not only that, but they are also most likely the ones who infected these companies with ransomware in the first place.

They said that both the attackers and Ransom Busters are using the same software, same tactics, and same identifiers, leading to the conclusion that its the same group on both ends of the spectrum.

The good news is that no one seems to have paid Ransom Busters for their offer. The only thing GuidePoint observed was one victim paying the actual ransom demand, rather than the fake recovery firm. That firm, fortunately,
did not have its name listed on the leak site, and its files remain secure
for now.

Pretending to be a recovery firm is the next evolutionary step in the life of ransomware.

In its early days, ransomware was all about encrypting the computers and asking for payment in exchange for the decryption key. When companies responded by building out strong backups, the criminals moved to stealing files and threatening to release them to the public. Soon after, some added Distributed Denial of Service (DDoS) into the mix, blocking not just the back end but also the front-end, in an effort to force a payment.

Some criminals even called their victims on the phone for further intimidation.

These days, more and more groups are moving away from encryptors and focus solely on data theft, since its cheaper yet equally lucrative.

Via BleepingComputer

Link to news story: https://www.techradar.com/pro/security/scammers-pose-as-ransomware-recovery-ag ents-but-just-go-on-to-steal-more-from-victims

$$
--- MultiMail/DOS
* Origin: capitolcityonline.net * KY, USA (1:2320/107)