Reported by 4 outlets

Timeline

1. update from cyberpress.org

   Ransomware Affiliate Poses as Recovery Firm to Re-Extort Victims After Data Theft

   cyberpress.org · 55d ago · August 19th, 2026

   GuidePoint Security’s Research and Intelligence Team (GRIT) has uncovered a ransomware extortion tactic in which an alleged recovery service, “Ransom Busters,” contacts victims before their cyberattack becomes public. The group claims it can retrieve stolen files, destroy criminal backups, and provide ransomware decryption keys. However, GRIT assesses with moderate confidence that Ransom Busters is actually a ransomware affiliate attempting to divert payments from the original ransomware operation. The scheme has been observed in incidents involving DragonForce, Settra, and Anubis ransomware activity. Instead of using a standard ransom note alone, the suspected affiliate presents itself as a helpful third party that has supposedly breached ransomware gangs’ infrastructure. Victims receive emails from “Ransom Busters LTD” requesting contact with CEOs or IT leaders. The emails state that the group discovered stolen company data on ransomware servers and can delete it for a fee. It also claims to have access to the gangs’ encryption-key storage and administrative panels. The offer is suspicious because legitimate cybersecurity firms generally contact ransomware victims only after an incident becomes publicly known. Ransom Busters, however, contacted organizations while their attacks were still private. That level of knowledge strongly suggests the actor already had access to the stolen data or details of the intrusion. Ransomware Affiliate Re-Extorts Victims GRIT analyzed two ra

2. update from gbhackers.com

   Ransom Busters Ransomware Affiliate Targets Victims With Fake Data Recovery Extortion

   gbhackers.com · 55d ago · August 19th, 2026

   GuidePoint Security’s Research and Intelligence Team (GRIT) assesses with moderate confidence that the purported recovery service is actually a ransomware affiliate attempting to divert extortion payments […] The post Ransom Busters Ransomware Affiliate Targets Victims With Fake Data Recovery Extortion appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from malware.news

   Beware the Ransomware Rescuer: Ransom Busters

   malware.news · 55d ago · August 19th, 2026

   Justin Timothy reports: The GuidePoint Research and Intelligence Team (GRIT) has responded to several recent ransomware incidents in which victims received an unexpected email from an ostensible third-party entity referring to itself as “Ransom Busters.” In these messages, the third-party offers to help the victim recover from ransomware attack. This immediately stands out as anomalous… Source Article Link: https://databreaches.net/2026/08/19/beware-the-ransomware-rescuer-ransom-busters/

4. update from bleepingcomputer.com

   Rogue ransomware affiliate poses as recovery firm to steal payments

   bleepingcomputer.com · 55d ago · August 19th, 2026

   The messages were suspicious because they were sent to victims before the attacks became public, raising questions about how they knew about the cyberattacks in the first place. Ransom Busters claimed it exploited vulnerabilities in administrative panels used by ransomware-as-a-service (RaaS) operations, giving it access to encryption keys and data stolen from victims. The group offered to delete the stolen data from ransomware servers, including those belonging to DragonForce, Settra, and Anubis, for between $20,000 and $60,000. However, evidence from two incidents leads GRIT to believe Ransom Busters is likely not a true recovery firm, but the ransomware affiliate responsible for the attacks. In both cases, the attackers used the same software, including SoftPerfect Network Scanner, s5cmd, and the Remotely remote monitoring tool. They also utilized the same tactics, including creating a local backdoor account using the password 'Numlock!123' and the same attacker-controlled hostname, 'DESKTOP-BBETH6K'. GRIT says it obs