As reported by BleepingComputer, GuidePoint Security's GRIT team has identified a threat actor operating under the name "Ransom Busters," a purported data recovery service that contacts ransomware victims before their breaches become public knowledge. The group claims to exploit vulnerabilities in ransomware-as-a-service administrative panels to obtain decryption keys and delete stolen data—for a fee of $20,000 to $60,000. The evidence, however, tells a very different story.

Ransomware Alert: As reported by BleepingComputer, GuidePoint Security's GRIT team has identified a threat actor operating under the name "Ransom Busters," a purported data recovery service that contacts ransomware victims before their breaches become public knowledge.

Why This Matters: The Affiliate Double-Dip

What makes this case particularly insidious is the timing. Ransom Busters contacted victims before attacks were publicly disclosed. That kind of foreknowledge is not something a legitimate recovery firm would possess—it's the signature of the attacker themselves. GRIT's forensic analysis confirmed this hypothesis: across multiple incidents, the same tooling (SoftPerfect Network Scanner, s5cmd, Remotely RMM), the same backdoor account credentials (Numlock!123), and the same attacker hostname (DESKTOP-BBETH6K) appeared in both the ransomware intrusion and the subsequent "recovery" outreach.

This is not a recovery service. This is a ransomware affiliate attempting to extract a second payment from victims by posing as a savior. It's a confidence scheme layered on top of an extortion scheme—a double-dip that exploits victims at their most vulnerable moment.

The Broader RaaS Ecosystem Implication

The fact that an affiliate can plausibly claim to have breached RaaS admin panels—and that multiple RaaS operations (DragonForce, Settra, Anubis) are involved—suggests the ransomware affiliate economy is far more fractured and insecure than its operators would like to admit.

RaaS operations rely on trust between operators and affiliates. If affiliates can independently access victim data and decryption keys outside the operator's sanctioned negotiation channel, the entire affiliate model is compromised from within. This creates a paradoxical situation: the same infrastructure designed to facilitate criminal collaboration is itself vulnerable to insider exploitation.

Coveware's confirmation that similar "middleman" schemes have appeared as far back as 2024 indicates this is not an isolated incident but an emerging business model within the ransomware underground. Affiliates are realizing they can cut out the RaaS operator and negotiate directly with victims—wearing a white hat they never earned.

Who Is Affected

The Broader RaaS Ecosystem Implication
Ransomware victims across all sectors—particularly those hit by DragonForce, Settra, or Anubis variants, but the model is replicable across any RaaS operation.
Legitimate ransomware negotiation and IR firms—whose reputation is undermined by impersonators eroding victim trust in the recovery process.
RaaS operators themselves—who are losing revenue to rogue affiliates conducting side negotiations.

Shield53 Recommendations: What You Should Do

If You Are Currently Responding to a Ransomware Incident

  • Do not engage unsolicited recovery offers. Any "recovery service" that contacts you with knowledge of your breach before you've disclosed it is suspect by definition. Legitimate IR firms do not cold-contact victims.
  • Engage a verified incident response firm through your cyber insurance carrier, legal counsel, or established relationships—not through inbound emails.
  • Preserve forensic evidence before taking any recovery action. Document attacker hostnames, account credentials, tooling, and email communications—these IOCs can link apparently separate incidents.
  • Never pay a third party claiming to have "deleted" your data from ransomware servers. There is no verification mechanism, and you are likely paying the attacker a second time.

For Proactive Defense Posture

  • Block and monitor for known IOCs from this campaign: hostname DESKTOP-BBETH6K, account password Numlock!123, and usage of SoftPerfect Network Scanner, s5cmd, and Remotely RMM in unexpected contexts.
  • Establish IR retainer relationships now—not after an incident. Victims who have a pre-existing relationship with a trusted IR firm are far less likely to be tempted by unsolicited "recovery" offers.
  • Brief your executive team and legal counsel on this tactic. Decision-makers under extreme pressure are the target of this social engineering layer—they need to know this scheme exists before they're in the hot seat.
  • Report any contact from "Ransom Busters" or similar unsolicited recovery services to law enforcement (FBI IC3, CISA) and your IR provider immediately.

This scheme reveals an important truth about the ransomware landscape: the criminals attacking you are also willing to scam each other. In an economy built on illegitimate trust, even the attackers' allies are adversaries. Defenders must treat every unsolicited offer of help following a breach as potentially hostile until proven otherwise—and the only proof that matters comes from a verified, independently engaged incident response partner.