A group identifying itself as Ransom Busters has emerged, contacting organizations affected by ransomware and proposing to erase their stolen data for a payment between $20,000 and $60,000. This unconventional approach has raised eyebrows among cybersecurity experts.
Unusual Ransomware Recovery Offers
GuidePoint Research and Intelligence Team (GRIT) reported on the unusual communications from Ransom Busters, which promises to help ransomware victims recover data for a fee. Unlike traditional cybersecurity firms that offer recovery services post-attack disclosure, Ransom Busters reaches out proactively, claiming access to ransomware group servers.
Emails sent by the group request meetings with company executives, asserting that they have exploited weaknesses in RaaS administrative systems for over three years. Ransom Busters claims to have located victim data on servers they accessed and demands payment to delete backups and restore data.
Analysis of Ransom Busters’ Tactics
GuidePoint has linked Ransom Busters to known ransomware affiliates, including DragonForce and Settra. Justin Timothy of GRIT pointed out the improbability of a legitimate organization operating this way, suggesting potential violations of the U.S. Computer Fraud Abuse Act. The group claims a need for compensation to protect their access to criminal infrastructure.
Incident analyses reveal consistent methods, such as using SoftPerfect Network Scanner and Remotely for reconnaissance and data exfiltration. The creation of a backdoor account and repeated use of the same hostname indicate a single operator, possibly an affiliate, orchestrates these acts.
Implications and Related Cyber Threats
The rise of Ransom Busters highlights the precarious position of ransomware victims, who are advised against trusting criminal entities. The group’s actions coincide with broader trends in ransomware tactics, including targeted extortion and credential theft by groups like UNC6671. GuidePoint’s findings expose the complexity of these operations and the industrialization of cybercrime.
Recent shifts in the ransomware landscape include the emergence of new groups like Majinahanashi and CRPx0, further complicating the cybersecurity environment. These developments underscore the evolution towards sophisticated, targeted attacks on large organizations.
As ransomware strategies evolve, businesses face increasing risks from both established and emerging threats. The challenges posed by groups like Ransom Busters demand a proactive, vigilant approach to cybersecurity, underscoring the importance of robust defenses and strategic planning.
