Ransom Busters scam targets ransomware victims for payment
Source headline: Rogue ransomware affiliate poses as recovery firm to steal payments
Intelligence Summary
A suspected ransomware affiliate is contacting victims before the attacks become public. The affiliate poses as a ransomware recovery service called “Ransom Busters.” It claims it can provide decryption keys and delete stolen data in exchange for a fee. The scam is designed to intercept payment attempts and exploit victims’ urgency. This matters because victims may be tricked into paying crooks even when recovery claims are unverified. Report any “recovery” payment requests and do not pay without corroborated, legitimate guidance.
Recommended Action
Confirm whether the affected technology is in use in your environment before deciding on remediation. Until then, watch authentication and outbound traffic logs for the indicators described in the source. This signal rests on a single report, so corroborate it before acting on anything irreversible.