A suspected ransomware affiliate is impersonating a recovery service called Ransom Busters, emailing victims before attacks are public and claiming it can provide decryption keys and erase stolen data for a fee. GRIT and Coveware believe the activity may be tied to the same affiliate behind attacks involving DragonForce, Settra, and Anubis, using overlapping tools and tactics to extort victims and siphon ransom payments. #RansomBusters #DragonForce #Settra #Anubis
Keypoints
- Ransom Busters posed as a ransomware recovery service to contact victims directly.
- The group reached out before attacks became public, raising suspicion about its access.
- It claimed to hold decryption keys and stolen data from RaaS operations.
- GRIT linked the activity to attacks using SoftPerfect Network Scanner, s5cmd, and Remotely.
- Coveware warned that this kind of interference increases risk for victims and may disrupt ransom agreements.