Full Report
A suspected ransomware affiliate is posing as a ransomware recovery service called "Ransom Busters," contacting the victims before the attacks become public and claiming to be able to provide decryption keys and delete stolen data for a fee. [...]
Analysis Summary
# Threat Actor: Ransom Busters
## Attribution & Identity
* **Actor Type:** Suspected Ransomware Affiliate (Rogue actor).
* **Aliases:** Ransom Busters.
* **Known Associations:** Linked to multiple Ransomware-as-a-Service (RaaS) operations, including **DragonForce**, **Settra**, and **Anubis**.
* **Identification:** GuidePoint Security (GRIT) and Coveware have identified this actor as a single affiliate or a small group operating within established RaaS networks but acting independently to bypass revenue-sharing agreements.
## Activity Summary
Ransom Busters poses as a legitimate "ransomware recovery service." Unlike typical "ambulance chasers" who contact victims after a breach is public, this actor contacts victims *before* the attack is disclosed. They claim to have exploited vulnerabilities in RaaS admin panels to obtain decryption keys and the ability to delete stolen data. In reality, the actor is the same affiliate that conducted the initial intrusion, attempting to trick victims into paying them directly (between $20,000 and $60,000) rather than paying the RaaS brand’s ransom.
## Tactics, Techniques & Procedures
* **Impersonation:** Posing as a data recovery firm to build false trust with victims.
* **Credential Creation:** Creating local backdoor accounts on compromised systems.
* **Persistence:** Utilizing a specific password for backdoor accounts: `Numlock!123`.
* **Host Identification:** Use of a consistent attacker-controlled hostname: `DESKTOP-BBETH6K`.
* **Lateral Movement/Discovery:** Use of specialized scanning and data transfer tools.
* **Psychological Operations:** Contacting victims privately before public leak pressure begins, creating a false sense of a "cleaner" exit.
**MITRE ATT&CK IDs:**
* **T1136.001:** Create Account: Local Account
* **T1046:** Network Service Discovery (SoftPerfect Network Scanner)
* **T1219:** Remote Access Software (Remotely)
* **T1567:** Exfiltration Over Web Service (s5cmd)
## Targeting
* **Sectors:** Multiple (General ransomware targeting).
* **Geography:** Global (Based on the RaaS groups they affiliate with).
* **Victims:** Organizations currently infected by DragonForce, Settra, or Anubis ransomware that have not yet reached the public leak stage.
## Tools & Infrastructure
* **SoftPerfect Network Scanner:** Used for internal network discovery.
* **s5cmd:** A tool for high-speed S3/cloud storage data transfer, used for data exfiltration.
* **Remotely:** A remote monitoring and management (RMM) tool used for persistence and control.
* **Infrastructure:**
* Hostname: `DESKTOP-BBETH6K`
* Specific credentials: `Numlock!123`
## Implications
* **Trust Erosion in RaaS:** This activity highlights growing distrust between RaaS operators and their affiliates, as affiliates attempt to "skim" profits.
* **Increased Victim Risk:** If a victim pays a "middleman" like Ransom Busters, there is no guarantee the primary RaaS group will honor the agreement, leading to potential double-extortion.
* **Sophisticated Social Engineering:** The shift from technical encryption to "recovery" deception complicates the incident response process for victims who may believe they are negotiating with a helpful third party.
## Mitigations
* **Negotiation Integrity:** Do not engage with unsolicited "recovery services" that contact you privately following a breach; verify all communications through established incident response and legal channels.
* **Account Monitoring:** Audit for the creation of unauthorized local accounts, specifically looking for the hostname `DESKTOP-BBETH6K` or the use of known "dirty" passwords like `Numlock!123`.
* **Tool Blocking:** Restrict or alert on the execution of unauthorized administrative tools such as `s5cmd`, `SoftPerfect Network Scanner`, and `Remotely` within the environment.
* **Egress Filtering:** Monitor and restrict high-volume data transfers to unauthorized cloud storage endpoints (S3, etc.).