Ransom Busters is a deceptive ransomware affiliate that directly contacts victims, claims to have accessed ransomware group servers, and demands $20,000 to $60,000 to delete stolen data. GuidePoint also linked the broader ransomware landscape to UNC6671, rising extortion brands, and increasingly industrialized tactics such as phishing, AitM operations, and pre-encryption access preparation. #RansomBusters #UNC6671 #DragonForce #Settra #Anubis #SilentRansom #LunaMoth #Akira #CRPx0 #Qilin
Keypoints
- Ransom Busters contacts victims before public disclosure and asks for payment to delete stolen data.
- GuidePoint says the group likely operates as a ransomware affiliate across multiple RaaS operations.
- Its activity overlaps with DragonForce, Settra, and Anubis incidents, using tools like SoftPerfect Network Scanner and s5cmd.
- UNC6671 runs extortion campaigns through brands such as Falcon, Helix, Pink, Redact, and BlackFile.
- The ransomware ecosystem is fragmenting, with more groups, more victims, and higher average extortion payments.
Read More: https://thehackernews.com/2026/08/ransom-busters-claims-it-hacked.html