Loading story…
GuidePoint Security's GRIT reported that an entity calling itself "Ransom Busters" contacted ransomware victims with unsolicited offers to recover encrypted files and delete stolen data, claiming it had access to ransomware groups' infrastructure and encryption keys. Investigators assessed with moderate confidence that the operation was not a legitimate incident-recovery service but a ransomware affiliate conducting secondary extortion across multiple ransomware-as-a-service ecosystems, including intrusions linked to DragonForce, Settra, and Anubis. In several cases, the outreach arrived before the incidents were publicly disclosed, raising concerns that the sender had direct knowledge of the attacks.
GRIT tied the activity together through overlapping tooling and infrastructure, including SoftPerfect Network Scanner, s5cmd, Remotely, a reused local backdoor password, and a shared attacker-controlled hostname. The actor reportedly demanded $20,000 to $60,000 and pushed for Bitcoin payment while using a privacy-focused email service and early pricing demands as part of the scheme. Researchers said the campaign appears designed to divert ransom negotiations and let an affiliate monetize victims outside the normal revenue-sharing model, and they urged organizations to preserve the messages as evidence and work with incident responders and law enforcement rather than pay the actor.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Coveware said it responded to at least one incident involving the same group or individual behind Ransom Busters-style outreach. It also reported seeing similar middlemen operating under other names as far back as 2024, indicating the tactic predates the newly disclosed cases.
GuidePoint assessed that the activity represents an alternate extortion technique in which an affiliate monetizes victims outside the normal ransomware revenue-sharing model. The report says the actor appears to be redirecting ransom discussions by posing as an independent recovery helper.
Based on incident-response observations, GuidePoint's GRIT assessed with moderate confidence that Ransom Busters is not a legitimate third-party recovery provider. GRIT concluded the persona is likely a single ransomware affiliate operating across multiple ransomware-as-a-service ecosystems.
Across the investigated intrusions, researchers found overlapping reconnaissance, exfiltration, and remote-management tooling, including SoftPerfect Network Scanner, s5cmd, and Remotely. They also identified reuse of the local backdoor password "Numlock!123" and the attacker-controlled hostname "DESKTOP-BBETH6K."
GuidePoint's incident responders examined multiple ransomware cases, including two in detail, where Ransom Busters approached victims during active incidents. The investigated intrusions were tied to ransomware activity involving groups such as DragonForce, Settra, and Anubis.
During several recent ransomware incidents, victims received emails from an entity calling itself "Ransom Busters" offering, for a fee, to recover files and delete stolen data. In observed cases, the outreach occurred before the attacks had become public knowledge.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
9 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourcexakep.ru
Open sourcecyberveille.ch
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourcedatabreaches.net
Open sourceguidepointsecurity.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Silent Ransom Group** — also tracked as **UNC3753**, **Luna Moth**, and **Chatty Spider** — has been targeting U.S. law firms and other professional, financial, insurance, and healthcare organizations with data-theft extortion campaigns that rely on social engineering instead of file encryption. FBI alerts and Google Mandiant reporting say the actors send invoice-themed phishing emails and follow up with voice calls impersonating internal IT or help desk staff, persuading employees to join screen-sharing sessions or install legitimate remote management tools such as AnyDesk, Zoho Assist, Bomgar, Splashtop, Syncro, Atera, and SuperOps. Once inside, the group rapidly searches document repositories and cloud stores for legal files, tax records, financial data, PII, and other sensitive material, then exfiltrates it with tools including WinSCP, hidden or renamed Rclone, Google Drive, Microsoft OneDrive, or victim-controlled file-sharing channels. Authorities said the campaign has escalated beyond remote access attempts to **in-person intrusions**, with imposters arriving at offices posing as technicians and connecting USB drives or external disks to steal data when remote social engineering fails. Mandiant said dozens of U.S. organizations were targeted between January and May, and in some cases the intrusion, theft, and extortion cycle was completed within a single business day, with ransom demands sent shortly after access ended. Researchers and the FBI linked the operation to the post-Conti cybercrime ecosystem and noted that its abuse of legitimate tools leaves few forensic artifacts, while Resecurity reported fast-flux infrastructure supporting leak sites including `business-data-leaks[.]com` and `ep6pheij[.]com`. The FBI and Google urged organizations to verify anyone claiming to be IT staff, restrict unauthorized remote management and VDI access, harden USB and removable-media controls, deploy phishing-resistant MFA, and closely monitor sensitive document systems.
Jun 29, 2026
Ransomware groups are increasingly operating like structured criminal businesses, outsourcing key functions to specialists and launching formal affiliate programs across underground forums. Researchers and reporting describe growing demand for **initial access brokers** and dedicated **negotiators** who handle ransom talks, pressure tactics, and extortion messaging, while forums such as **RAMP** emerged to support ransomware recruitment after other Russian-speaking sites restricted such advertising. New and revived operations have continued to market themselves aggressively, including **Eclipse Ransomware** with a managed affiliate model, Tor-based negotiation portals, leak-site support, and revenue-sharing terms, as well as earlier examples such as REvil-linked infrastructure reappearing to recruit affiliates and Maze partnering with other gangs through shared leak platforms.
Aug 15, 2026
Ransomware operators have expanded **double-extortion** tactics by targeting people around a victim organization, including senior executives, employees, customers, and business partners, to force ransom payments. Reporting tied the approach primarily to the **Clop** ecosystem, with similar behavior also attributed to **REvil** affiliates. Attackers were described as prioritizing executive mailboxes and workstations to find sensitive files, litigation records, and internal discussions that could be used to embarrass leadership or strengthen negotiations. The pressure campaign also extended beyond the company itself, with gangs emailing victims’ customers and associates to amplify reputational and legal risk. One cited case involved **RaceTrac Petroleum**, where data stolen via exploitation of a zero-day in **Accellion File Transfer Appliance** services used by a third party included some customer contact details, though the company said its corporate network and payment systems were not affected. Similar outreach was reportedly used against people linked to the **University of California**, underscoring how ransomware groups increasingly use public exposure and direct contact with stakeholders as leverage even when stolen data may later be leaked regardless of payment.
Aug 15, 2026