Ransom Busters: A Deceptive "Recovery" Scheme Targeting Ransomware Victims A threat actor operating under the name Ransom Busters has been contacting ransomware victims with a fraudulent offer to restore encrypted files and delete stolen data from criminal infrastructure. According to GuidePoint Security’s Research and Intelligence Team (GRIT), the group is likely a ransomware affiliate attempting to divert extortion payments from established ransomware-as-a-service (RaaS) operations. The actor, posing as Ransom Busters LTD, sends unsolicited emails to CEOs and IT leaders, claiming to have accessed compromised ransomware servers and obtained victims’ exfiltrated data. The messages assert that the group can decrypt files and destroy backups held by the original attackers offers that GRIT assesses as an alternate form of extortion rather than a legitimate recovery solution. Payments demanded range from $20,000 to $60,000, with no guarantee of data deletion or decryption key authenticity. GRIT’s investigation revealed that Ransom Busters possessed the same stolen datasets as the ransomware affiliates responsible for the initial intrusions, suggesting direct involvement in the attacks. The group’s claims of accessing multiple RaaS administrative panels remain unverified. Notably, the actor contacts victims before their breaches become public a tactic that distinguishes it from legitimate incident response firms, which typically engage only after disclosures. Forensic analysis of two affected environments uncovered identical intrusion artifacts, including the use of SoftPerfect Network Scanner for reconnaissance, s5cmd for AWS-based exfiltration, and Remotely RMM tools deployed via PowerShell. Both cases also featured a backdoor account with the password Numlock!123 and an attacker-controlled hostname (DESKTOP-BBETH6K), reinforcing GRIT’s assessment that Ransom Busters is a single affiliate operating across multiple RaaS ecosystems. The scheme highlights the evolving monetization tactics in ransomware, where affiliates may independently exploit victims while undermining the original operators’ extortion efforts. Organizations targeted by such offers are advised to preserve communications, avoid independent negotiations, and report incidents to law enforcement and incident-response providers. The case underscores the risks of unverified recovery claims and the need for disciplined evidence preservation in ransomware incidents.