Full Report
A suspected ransomware affiliate is posing as a ransomware recovery service called "Ransom Busters," contacting the victims before the attacks become public and claiming to be able to provide decryption keys and delete stolen data for a fee. [...]
Analysis Summary
# Threat Actor: Ransom Busters
## Attribution & Identity
**Ransom Busters** is identified as a suspected rogue ransomware affiliate rather than a legitimate recovery firm.
- **Type:** Ransomware-as-a-Service (RaaS) Affiliate.
- **Associated Groups:** The actor is known to be an affiliate for multiple RaaS operations, including **DragonForce**, **Settra**, and **Anubis**.
- **Evidence of Identity:** Security researchers (GRIT) link the activity to a single actor based on overlapping hostnames, credentials, and software sets used across different ransomware brand attacks.
## Activity Summary
Ransom Busters engages in a "double-dip" scheme where they contact victims of their own ransomware attacks before the incidents are publicly disclosed. Posing as a third-party recovery service, they claim to have exploited vulnerabilities in RaaS administrative panels to obtain decryption keys and delete stolen data. They demand a separate fee (typically $20,000–$60,000) to "rescue" the victim from the very ransomware gang they are currently working with.
## Tactics, Techniques & Procedures
- **Pre-Public Contact:** Contacting victims via email before the leak is publicized, indicating direct involvement in the initial breach.
- **Deceptive Recovery:** Masquerading as a "Ransomware Recovery Service" to extort payments outside the standard RaaS revenue-sharing model.
- **Backdoor Creation:** Creating local backdoor accounts with a static password: `Numlock!123`.
- **Infrastructure Consistency:** Repeated use of the attacker-controlled hostname `DESKTOP-BBETH6K`.
- **Administrative Access Scams:** Claiming (likely falsely) to have hacked the RaaS operators' backend to gain victim trust.
**MITRE ATT&CK Mapping:**
- **T1046:** Network Service Discovery (SoftPerfect Network Scanner)
- **T1136.001:** Create Account: Local Account
- **T1219:** Remote Access Software (Remotely)
- **T1486:** Data Encrypted for Impact
- **T1567.002:** Exfiltration Over Web Service (s5cmd)
## Targeting
- **Sectors:** Not sector-specific; targets any organization vulnerable to the RaaS families they represent (DragonForce, Settra, Anubis).
- **Geography:** Global / Not specified.
- **Victims:** Organizations currently undergoing active, non-public ransomware negotiations.
## Tools & Infrastructure
- **SoftPerfect Network Scanner:** Used for internal reconnaissance.
- **s5cmd:** Used for rapid data exfiltration to cloud storage.
- **Remotely:** A remote monitoring and management (RMM) tool used for persistence and execution.
- **Hostnames:** `DESKTOP-BBETH6K`
- **Passwords:** `Numlock!123`
## Implications
- **Erosion of Trust:** This behavior highlights increasing fragmentation and distrust within the RaaS ecosystem. Affiliates are increasingly willing to defraud their own "partners" (the RaaS operators) to keep 100% of the profit.
- **Increased Victim Risk:** Interference by a rogue party makes recovery more complex. Even if a victim pays the primary ransomware group, the rogue affiliate (Ransom Busters) still retains the data and can continue extortion.
- **Operational Security (OPSEC) Failures:** The actor’s reliance on static passwords and hostnames allows threat intelligence teams to link disparate ransomware attacks to a single human operator.
## Mitigations
- **Monitor for Specific IOCs:** Scan environments for the hostname `DESKTOP-BBETH6K` and accounts created with the password `Numlock!123`.
- **RMM Tool Auditing:** Audit and restrict the use of remote management tools like "Remotely" within the network.
- **Verification of Recovery Services:** Treat any unsolicited "recovery" outreach with extreme skepticism, especially if the service knows about a breach before it is public.
- **Ignore "Middlemen":** Follow the advice of firms like Coveware and GRIT: do not engage with third-party "recovery" firms that claim access to RaaS backends, as these are often the attackers themselves.