Ransom Busters fraud claims decryption keys ahead of ransomware
Source headline: Rogue ransomware affiliate poses as data recovery firm to steal payments
Intelligence Summary
A suspected ransomware affiliate is posing as a data recovery service called "Ransom Busters." The scam involves contacting victims before the ransomware attack becomes public. It claims it can provide decryption keys and delete stolen data for a fee. This could trick victims into paying while the underlying ransomware incident is ongoing. The risk is added fraud layered on top of extortion. Treat any offers claiming decryption or data deletion for a fee as untrusted and verify through legitimate incident response channels.
Recommended Action
Confirm whether the affected technology is in use in your environment before deciding on remediation. Until then, watch authentication and outbound traffic logs for the indicators described in the source. This signal rests on a single report, so corroborate it before acting on anything irreversible.