Full Report
Because apparently even ransomware gangs can't trust the people they do business with
Analysis Summary
# Incident Report: "Ransom Busters" Affiliate Double-Extortion Scheme
## Executive Summary
A ransomware affiliate is moonlighting as a "recovery firm" named "Ransom Busters" to defraud both victims and their own Ransomware-as-a-Service (RaaS) partners. The threat actor contacts victims before attacks are public, claiming to have hacked the ransomware gangs to offer cheaper recovery services. In reality, the affiliate is using their authorized access to the stolen data to facilitate a secondary, fraudulent extortion attempt.
## Incident Details
- **Discovery Date:** August 20, 2026 (Publication Date)
- **Incident Date:** Circa 2024-2026
- **Affected Organization:** Multiple undisclosed organizations
- **Sector:** Cross-sector (targets of DragonForce, Settra, and Anubis)
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Variable per incident.
- **Vector:** Likely credential compromise or exploitation of RDP/VPN (standard RaaS entry).
- **Details:** The affiliate gains entry as a partner for established RaaS brands (DragonForce, Settra, Anubis).
### Lateral Movement
- **Tools:** The attacker utilized **SoftPerfect Network Scanner** for internal reconnaissance and the **Remotely** remote-management tool deployed via PowerShell to maintain a presence across the network.
### Data Exfiltration/Impact
- **Mechanism:** Large-scale data theft using **s5cmd** to move data directly to attacker-controlled AWS S3 buckets.
- **Impact:** Encryption of files via RaaS binaries and theft of sensitive corporate data.
### Detection & Response
- **Discovery:** GuidePoint Security (GRIT) identified the scheme while investigating disparate attacks that shared identical "fingerprints" and tools.
- **Response Actions:** Investigation of the "Ransom Busters" email solicitations led to the correlation of forensic artifacts between the "hackers" and the "recovery firm."
## Attack Methodology
- **Initial Access:** RaaS Affiliate access.
- **Persistence:** Creation of local backdoor accounts; installation of **Remotely** RMM.
- **Privilege Escalation:** Creation of a local admin account with the password `Numlock!123`.
- **Defense Evasion:** Posing as a "recovery specialist" to prevent victims from involving law enforcement or professional IR firms.
- **Credential Access:** Not specified, but likely harvested via standard RaaS tools.
- **Discovery:** SoftPerfect Network Scanner.
- **Lateral Movement:** PowerShell-based deployment of RMM tools.
- **Collection:** Staging data for cloud exfiltration.
- **Exfiltration:** **s5cmd** to AWS cloud storage.
- **Impact:** Double extortion; the affiliate attempts to collect a private payment ($20k-$60k) bypassing the RaaS gang's negotiation portal.
## Impact Assessment
- **Financial:** Fraudulent "recovery" fees ranging from $20,000 to $60,000.
- **Data Breach:** High; full exfiltration of corporate datasets.
- **Operational:** Business disruption from initial encryption; potential for long-term risk if victims believe data was deleted when it was not.
- **Reputational:** High; victims may pay "Ransom Busters" believing they are resolving the issue, only for the data to be leaked later by the original RaaS gang.
## Indicators of Compromise
- **Network Indicators:**
- Traffic to AWS S3 buckets via `s5cmd`.
- Connections to `Remotely` RMM infrastructure.
- **File Indicators:**
- Presence of `netscan.exe` (SoftPerfect).
- PowerShell scripts deploying RMM.
- **Behavioral Indicators:**
- Hostname: `DESKTOP-BBETH6K`
- Local Account Password: `Numlock!123`
- Solicitation from "Ransom Busters" via email prior to public leak site posting.
## Response Actions
- **Containment:** Identify and disable the local backdoor account and the "Remotely" RMM software.
- **Eradication:** Terminate AWS sessions used for exfiltration (if possible) and wipe the specific attacker hostname from the environment.
- **Recovery:** Restore from backups; do not engage with "Ransom Busters" or the original extortionists.
## Lessons Learned
- **Honor Among Thieves:** Ransomware affiliates are increasingly willing to betray their RaaS "employers" for a 100% cut of a smaller ransom.
- **The "Recovery" Trap:** "Unsolicited" recovery offers are almost certainly a continuation of the initial attack.
- **Tool Fingerprinting:** Specific tool combinations (s5cmd + Remotely + specific passwords) are highly effective at attributing disparate attacks to a single human operator.
## Recommendations
- **Restrict RMM Tools:** Block unauthorized Remote Management Tools (e.g., Remotely, AnyDesk) at the network and endpoint level.
- **Monitor for Exfiltration Tools:** Alert on the execution of command-line cloud transfer tools like `s5cmd` or `rclone`.
- **Credential Hygiene:** Implement MFA across all external-facing services to prevent the initial affiliate access.
- **Verify Recovery Partners:** Only engage with vetted, reputable Incident Response and recovery firms; disregard any unsolicited outreach regarding data breaches.