Suspected Ransomware Affiliate Impersonates Recovery Firm to Divert Payments
Summary
GRIT and Coveware say a suspected ransomware affiliate posing as Ransom Busters contacted victims before attacks became public, claiming it could provide decryption keys and delete stolen data for a fee.
Key points
- Ransom Busters reportedly contacted victims about non-public ransomware incidents and offered recovery services for $20,000 to $60,000.
- GRIT suspects the service is the affiliate behind the attacks, citing overlapping tools and tactics across two incidents; it assesses the link with moderate confidence.
- The attacks involved SoftPerfect Network Scanner, s5cmd, Remotely, a backdoor account using the password “Numlock!123,” and the hostname “DESKTOP-BBETH6K.”
- GRIT says it has not seen victims pay Ransom Busters and discourages them from doing so.
- In one case, the victim paid the ransomware-as-a-service operation instead; researchers found no evidence the data was leaked outside its environment.
- Coveware warns that third-party access to stolen data could undermine agreements not to publish it, even if victims pay the ransomware operators.
Article Details
- Event Type
- Suspected ransomware affiliate impersonating a recovery service and attempting to divert ransom payments
- Impact
- Victims were contacted before attacks became public and offered decryption keys and data deletion for $20,000–$60,000. Coveware warned that a rogue party with access to stolen data may increase the risk of leaks even if victims pay the ransomware operation. GRIT reported seeing no victims pay Ransom Busters and found no evidence that it leaked stolen data outside the ransomware environment.
MITRE ATT&CK
People
Threat Actors
AnubisNamed as a ransomware-as-a-service operation whose servers Ransom Busters claimed it could remove stolen data from; the article associates the suspected affiliate’s activity with attacks involving Anubis.DragonForceNamed as a ransomware-as-a-service operation whose servers Ransom Busters claimed it could remove stolen data from; the article associates the suspected affiliate’s activity with attacks involving DragonForce.Ransom BustersGRIT assessed with moderate confidence that this purported recovery service was likely a suspected ransomware affiliate behind attacks, contacting victims to seek ransom payments and potentially diverting payments from ransomware operations.SettraNamed as a ransomware-as-a-service operation whose servers Ransom Busters claimed it could remove stolen data from; the article associates the suspected affiliate’s activity with attacks involving Settra.
Vendors
CovewareGRIT and Coveware believe the activity may be tied to the same affiliate behind attacks involving DragonForce, Settra, and Anubis, using overlapping tools and tactics to extort victims and siphon ransom payments.GuidePoint SecurityGuidePoint Security’s Research and Intelligence Team (GRIT) disclosed this activity after responding to several recent ransomware attacks in which victims received emails from Ransom Busters offering to help recover
Tools
RemotelyGRIT linked the activity to attacks using SoftPerfect Network Scanner, s5cmd, and Remotely.s5cmdGRIT linked the activity to attacks using SoftPerfect Network Scanner, s5cmd, and Remotely.SoftPerfect Network ScannerGRIT linked the activity to attacks using SoftPerfect Network Scanner, s5cmd, and Remotely.