Ransom Busters: A Deceptive "Recovery" Scheme Targeting Ransomware Victims A threat actor operating under the name Ransom Busters has been contacting ransomware victims with a fraudulent offer to restore encrypted files and delete stolen data from criminal infrastructure. According to GuidePoint Security’s Research and Intelligence Team (GRIT), the group is likely a ransomware affiliate attempting to divert extortion payments from established ransomware-as-a-service (RaaS) operations. The actor, posing as Ransom Busters LTD, sends unsolicited emails to CEOs and IT leaders, claiming to have accessed compromised ransomware servers and obtained victims’ exfiltrated data. The messages assert that the group can decrypt files and destroy backups held by the original attackers offers that GRIT assesses as an alternate form of extortion rather than a legitimate recovery solution. Payments demanded range from $20,000 to $60,000, with no guarantee of data deletion or decryption key authenticity. GRIT’s investigation revealed that Ransom Busters possessed the same stolen datasets as the ransomware affiliates responsible for the initial intrusions, suggesting direct involvement in the attacks. The group’s claims of accessing multiple RaaS administrative panels remain unverified. Notably, the actor contacts victims before their breaches become public a tactic that distinguishes it from legitimate incident response firms, which typically engage only after disclosures. Forensic analysis of two affected environments uncovered identical intrusion artifacts, including the use of SoftPerfect Network Scanner for reconnaissance, s5cmd for AWS-based exfiltration, and Remotely RMM tools deployed via PowerShell. Both cases also featured a backdoor account with the password Numlock!123 and an attacker-controlled hostname (DESKTOP-BBETH6K), reinforcing GRIT’s assessment that Ransom Busters is a single affiliate operating across multiple RaaS ecosystems. The scheme highlights the evolving monetization tactics in ransomware, where affiliates may independently exploit victims while undermining the original operators’ extortion efforts. Organizations targeted by such offers are advised to preserve communications, avoid independent negotiations, and report incidents to law enforcement and incident-response providers. The case underscores the risks of unverified recovery claims and the need for disciplined evidence preservation in ransomware incidents.

Anubis Ransomware Exploits Citrix Bleed 2 in Targeted Attacks Across Critical Sectors Threat actors linked to the Anubis ransomware-as-a-service (RaaS) operation are actively exploiting CVE-2025-5777 (Citrix Bleed 2), a critical vulnerability in Citrix NetScaler ADC and Gateway, to gain initial access to victim networks. According to a report by Arctic Wolf, attackers leverage legitimate Remote Management and Monitoring (RMM) tools including ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, and Total Software Deployment to blend in with normal IT activity while maintaining persistent control. Anubis, a rebrand of the Sphinx ransomware, emerged in late 2024 and was formally announced on the RAMP underground forum in February 2025. Since then, the group has claimed 91 victims on its data leak site, with 11 reported in June 2026 alone. Targeted sectors include healthcare, business services, manufacturing, technology, and financial services, with over 50% of victims based in the U.S., followed by the U.K., Australia, France, and Canada. The group employs aggressive tactics, including an irreversible data-wiping feature that reduces files to 0 KB regardless of ransom payment, increasing pressure on victims. Affiliates receive 80% of ransom payments, a lucrative incentive that has fueled the operation’s growth. Beyond Citrix Bleed 2, Anubis actors have also used stolen VPN credentials potentially sourced from initial access brokers, credential stuffing, or info-stealer malware to breach networks via Cisco AnyConnect VPNs, particularly through hosting providers like AS20473 (The Constant Company) and AS55286 (ServerMania). Once inside, attackers move laterally using RDP and PsExec, deploy RMM tools for persistence, and exfiltrate data via Cloudflare Tunnels, S3 Browser, rclone, s5cmd, WinSCP, and PuTTY. They also disable security defenses, including Windows Defender and Sophos, and manipulate logs to hinder forensic analysis. In some cases, the ransomware encryptor is deleted post-execution, further complicating detection. ### The Gentlemen RaaS and Zero-Day Exploits Separately, Kaspersky detailed The Gentlemen RaaS, which exploits known vulnerabilities and weak credentials to deploy a Go-based backdoor for remote command execution. The malware collects system data, exfiltrates it to 81.177.215[.]15:9443, and can establish a SOCKS proxy for network pivoting. The group has also weaponized a zero-day vulnerability in ktapi.sys, a Kontron driver, to bypass Windows security protections and terminate processes from Microsoft, ESET, Palo Alto Networks, and SentinelOne. ### VECT and TeamPCP’s Supply Chain-Ransomware Hybrid A Sophos investigation revealed a partnership between VECT and TeamPCP, announced in March 2026, combining supply chain credential theft with ransomware deployment. TeamPCP, previously operating as CipherForce, rebranded after listing six victims in February 2026. However, VECT’s encryptor contains critical flaws, destroying files larger than 128 KB instead of encrypting them a defect TeamPCP claims it never used in attacks. The alliance represents a shift toward industrialized ransomware deployment, lowering the barrier for cybercriminals by merging large-scale supply chain attacks with mature RaaS operations. Despite technical shortcomings, the model poses a growing threat to enterprises.