As reported by The Hacker News, a threat actor branding itself "Ransom Busters" has been contacting ransomware victims proactively, offering to delete stolen data from RaaS infrastructure for fees between $20,000 and $60,000. GuidePoint Research and Intelligence Team (GRIT) linked the activity to incidents involving DragonForce, Settra, and Anubis ransomware groups. Shield53 views this development as a significant evolution in ransomware monetization — one that weaponizes victim desperation and regulatory anxiety.

Ransomware Alert: As reported by The Hacker News, a threat actor branding itself "Ransom Busters" has been contacting ransomware victims proactively, offering to delete stolen data from RaaS infrastructure for fees between $20,000 and $60,000.

What's Actually Happening Here

The narrative Ransom Busters presents — a rogue actor exploiting vulnerabilities in ransomware administrative panels to liberate stolen data — is strategically designed to exploit two victim pressures: the fear of data publication and the urgency of regulatory notification deadlines. The pricing model is calibrated to sit just below what many organizations would consider a ransom payment, framing the transaction as a "recovery service" rather than extortion.

However, the operational indicators tell a different story.

The overlap of tools (SoftPerfect Network Scanner, s5cmd, Remotely RMM), the identical backdoor credential Numlock!123, and the reuse of hostname DESKTOP-BBETH6K across incidents strongly suggests the same threat actor is conducting the initial intrusion and subsequently offering the "recovery."

This is not a rival hacking ransomware groups out of altruism. This is an affiliate monetizing both ends of the attack lifecycle — deploying ransomware, then selling the cure.

Why This Matters

What's Actually Happening Here
Legal exposure for victims: Paying Ransom Busters likely constitutes a payment to a sanctioned or criminal entity under OFAC guidance and may violate the U.S. CFAA. There is no mechanism to verify data deletion actually occurred.
Erosion of trust in legitimate IR: Genuine incident response firms do not proactively cold-call victims mid-attack. This tactic poisons the well for legitimate outreach after public disclosure.
Regulatory risk amplification: Organizations that quietly pay for "data deletion" without documenting the incident properly may face compounded penalties under SEC, HIPAA, or GDPR frameworks when the breach inevitably surfaces later.

Who Is Most at Risk

Mid-market organizations (500–5,000 employees) with limited in-house IR capability are the prime targets. These organizations are large enough to afford a $20K–$60K payment but often lack the mature incident response processes to recognize the approach as anomalous. Healthcare providers, manufacturers, and regional financial institutions — frequent targets of DragonForce and Anubis — should treat any unsolicited recovery offer as a potential extension of the attack itself.

Shield53 Recommendations

  • Establish a vendor verification protocol: Any unsolicited contact offering ransomware recovery services should be treated as hostile until proven otherwise. Verify through independent channels — never through contact information provided in the unsolicited message.
  • Engage established IR retainers proactively: Have a contracted incident response firm on retainer before an incident occurs. Legitimate IR engagements originate from your engagement, not cold outreach.
  • Deploy detection for shared IoCs: Search endpoint and network telemetry for Numlock!123 as a local account password, the hostname DESKTOP-BBETH6K, and deployment of Remotely RMM via PowerShell. Flag s5cmd execution and SoftPerfect Network Scanner in restricted environments.
  • Document everything for regulators: If contacted by any party offering data deletion services, preserve the communications, notify legal counsel immediately, and document the decision-making process. Silent payments create downstream liability.
  • Report to authorities: File reports with FBI IC3 and CISA. The Ransom Busters model depends on victims staying quiet — reporting disrupts the revenue cycle.

The ransomware ecosystem has always been entrepreneurial, but Ransom Busters represents a cynical new tier: monetizing the victim's recovery instinct itself. Defenders should treat any party that contacts them mid-incident with the same suspicion as the attacker — because in this case, they likely are the attacker.