Full Report
A ransomware affiliate calling itself Ransom Busters has been spotted proactively sending emails to victim organizations and claims to delete stolen data from ransomware groups' servers in exchange for a fee ranging from $20,000 to $60,000. "In these messages, the third-party offers to help the victim recover from ransomware attack. This immediately stands out as anomalous," GuidePoint Research
Analysis Summary
# Incident Report: Extortion Scheme by "Ransom Busters" Affiliate
## Executive Summary
A ransomware affiliate operating under the alias "Ransom Busters" is targeting organizations already compromised by RaaS groups (e.g., DragonForce, Settra). The threat actor poses as a third-party "white hat" or "recovery specialist," claiming to have hacked the ransomware groups' servers to delete stolen data in exchange for a $20,000–$60,000 fee. Investigations reveal this is a deceptive double-extortion tactic likely performed by the original attacker to secure a secondary payment.
## Incident Details
- **Discovery Date:** August 18, 2026 (Public Report)
- **Incident Date:** Ongoing (Activity observed over a three-year period according to actor claims)
- **Affected Organization:** Multiple (Victims of DragonForce, Settra, and Anubis)
- **Sector:** Cross-sector (Financial services, Legal, and others mentioned in context)
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Variable (Post-ransomware infection)
- **Vector:** Likely the same vector as the original ransomware attack (Phishing/Vulnerability exploitation).
- **Details:** The actor contacts the victim's CEO or IT leadership via email *after* an initial ransomware breach but often *before* the breach is public.
### Lateral Movement
- Tools used include **SoftPerfect Network Scanner** for internal reconnaissance.
- Backdoor accounts created for persistent access.
### Data Exfiltration/Impact
- **Exfiltration:** Data is stolen and uploaded to cloud storage (AWS) using **s5cmd**.
- **Impact:** Financial extortion; threat of data exposure despite claims of "deletion services."
### Detection & Response
- **Detection:** Identified by GuidePoint Research (GRIT) during incident response for ransomware victims.
- **Anomalous Behavior:** Proactive outreach to victims offering "recovery" services before public disclosure of the breach.
## Attack Methodology
- **Initial Access:** RaaS Affiliate operations (Standard RaaS vectors).
- **Persistence:** Creation of a local backdoor account with the password `Numlock!123`.
- **Defense Evasion:** Use of legitimate RMM tools and masquerading as a benevolent third party.
- **Discovery:** SoftPerfect Network Scanner.
- **Lateral Movement:** Remote Monitoring and Management (RMM) tool "Remotely," installed via PowerShell.
- **Exfiltration:** Use of **s5cmd** to transfer data to attacker-controlled cloud buckets.
- **Impact:** Double extortion; deceiving victims into paying for "data deletion" that cannot be verified.
## Impact Assessment
- **Financial:** Demands ranging from $20,000 to $60,000 per victim.
- **Data Breach:** High; full exfiltration of sensitive corporate data.
- **Operational:** Secondary disruption due to deceptive negotiations.
- **Reputational:** High; data remains in the hands of criminals regardless of payment.
## Indicators of Compromise
- **Hostnames:** `DESKTOP-BBETH6K`
- **Passwords:** `Numlock!123` (used for backdoor accounts)
- **Tools:**
- `s5cmd` (Data transfer)
- `SoftPerfect Network Scanner` (Recon)
- `Remotely` (RMM Tool)
## Response Actions
- **Containment:** Audit for the specific hostname `DESKTOP-BBETH6K` and the "Numlock" local account.
- **Eradication:** Terminate unauthorized RMM sessions and delete PowerShell-based backdoors.
- **Recovery:** Standard restoration from offline, unencrypted backups.
## Lessons Learned
- **Affiliate Deception:** Ransomware affiliates may betray their RaaS partners to secure "lower" payments directly from victims.
- **Trust Factor:** Claims from third parties alleging they have "hacked the hackers" are almost universally fraudulent and used as a social engineering tactic to facilitate extortion.
## Recommendations
- **Zero Trust for "Helpers":** Do not engage with third parties who proactively reach out regarding a non-public breach.
- **Credential Hygiene:** Monitor for the creation of local accounts on servers and workstations.
- **Cloud Monitoring:** Implement alerts for large data transfers to AWS or other cloud providers using CLI tools like `s5cmd`.
- **Legal Compliance:** Note that paying such "services" likely violates legal frameworks (e.g., CFAA) as the actor is essentially admitting to unauthorized access of infrastructure.