As reported by BleepingComputer, a threat actor operating under the name "Ransom Busters" has been contacting ransomware victims before their breaches become public, offering decryption keys and data deletion services for $20,000 to $60,000. GuidePoint Security's GRIT team has linked this actor to the ransomware affiliates themselves — not a legitimate recovery firm — based on overlapping tooling and infrastructure across multiple incidents.

Ransomware Alert: As reported by BleepingComputer, a threat actor operating under the name "Ransom Busters" has been contacting ransomware victims before their breaches become public, offering decryption keys and data deletion services for $20,000 to $60,000.

Why This Scheme Is More Dangerous Than It Appears

The Ransom Busters model represents a troubling evolution in ransomware monetization. Rather than simply extorting victims through the standard double-extortion playbook, this affiliate is attempting to intercept ransom payments by posing as a trusted intermediary. The actor claims to exploit vulnerabilities in RaaS administrative panels — a plausible technical assertion given the history of security flaws in ransomware affiliate platforms — but the evidence tells a different story.

What makes this particularly insidious is the timing. Victims are contacted before the attack becomes public knowledge. In the chaotic early hours of a ransomware incident, when executives are desperate and incident response teams are still assessing scope, an unsolicited email offering a lifeline can appear remarkably convenient. The psychological pressure is by design.

The Operational Security Failures That Exposed the Actor

GuidePoint's attribution rests on consistent forensic artifacts across multiple incidents — the kind of operational security lapses that separate sophisticated operators from competent ones:

Why This Scheme Is More Dangerous Than It Appears
Identical tooling: SoftPerfect Network Scanner, s5cmd, and the Remotely RMM tool appeared across incidents.
Static credentials: A local backdoor account using the password Numlock!123 was reused across multiple victim environments.
Fixed hostname: The attacker-controlled system DESKTOP-BBETH6K appeared consistently.

For defenders, these artifacts are now valuable threat intelligence. Any IR team encountering these indicators should immediately consider the Ransom Busters angle and warn the victim organization that the "recovery service" contacting them is likely the threat actor itself.

The reuse of a single hostname and password across multiple intrusions suggests this affiliate is either a single individual or a small team with limited operational discipline — but enough technical capability to operate across multiple RaaS platforms including DragonForce, Settra, and Anubis.

Broader Implications for the Ransomware Ecosystem

Coveware's confirmation that similar "middleman" schemes have appeared since 2024 suggests this is not an isolated phenomenon. The ransomware affiliate model is fracturing in interesting ways. Affiliates who feel underpaid or constrained by RaaS operators may attempt to cut out the middleman — or in this case, become the middleman. This creates a trust crisis within the criminal ecosystem that could, paradoxically, benefit defenders if it leads to more infighting and operational errors.

However, it also means victim organizations face a more complex threat landscape. The traditional advice of "engage a reputable negotiation firm" remains sound, but organizations must now be vigilant about unsolicited recovery offers that arrive via email during an active incident.

Shield53 Recommendations

  • Never engage unsolicited recovery services. Any legitimate ransomware recovery firm will be engaged through your incident response retainer, legal counsel, or insurance carrier — not via cold email to your executives.
  • Brief executive teams now. Ensure leadership understands that during an incident, they may receive fraudulent recovery offers. Establish a protocol where all external communications during an incident route through the IR team.
  • Add IOCs to detection systems. Flag the hostname DESKTOP-BBETH6K, the password Numlock!123, and the tools SoftPerfect Network Scanner, s5cmd, and Remotely RMM in your EDR and SIEM. While these tools have legitimate uses, their appearance alongside new local admin accounts warrants investigation.
  • Pre-stage IR relationships. Have a signed retainer with a reputable incident response firm and a ransomware negotiation specialist before you need them. This eliminates the temptation to engage with unsolicited offers.
  • Monitor for unauthorized RMM tools. Remotely and similar remote monitoring tools are increasingly abused by threat actors. Audit your environment for any RMM software that was not deployed by IT.
  • Report fraudulent recovery offers. If your organization receives a "Ransom Busters" or similar solicitation, share it with your IR provider and law enforcement. The timing of the contact itself is valuable intelligence.