Threat Actor
Ransom Busters
- First Reported
- Aug 19, 2026
- Latest Reported
- Aug 19, 2026
Reported Context (2)
- GRIT assessed with moderate confidence that this purported recovery service was likely a suspected ransomware affiliate behind attacks, contacting victims to seek ransom payments and potentially diverting payments from ransomware operations. Suspected Ransomware Affiliate Impersonates Recovery Firm to Divert Payments
- A ransomware affiliate persona that GuidePoint reported contacting victims, claiming access to ransomware-group servers, and demanding payment to delete stolen data. GuidePoint considers the offer deceptive and the activity likely unlawful. Ransom Busters Claims Access to Ransomware Servers, Demands Up to $60,000
Malware (1)
People (4)
Threat Actors (11)
MITRE ATT&CK (8)
Vendors (2)
Products (3)
Tools (4)
Industries (2)
Countries (6)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.