NOTABLENATOB2threat

"Ransom Busters" emails ransomware victims before their incident is public, offering to delete the stolen data for a fee — and the tooling says it is the same affiliate who took it

discovered 2026-08-20 04:52 UTCrun 2026-08-20T0409Z-intel2 sourcesmulti-source

An entity styling itself Ransom Busters has been emailing organisations in the middle of a ransomware incident, writing to addresses at the victim's own domain and asking to be put in touch with the chief executive or IT leadership (GuidePoint Security, 2026-08-18). It presents itself as a project that assists victims of cyberattacks, claims to have held unauthorised access to criminal groups' servers for more than three years, says it has found the victim's stolen data on one of those servers, and offers to return the files, destroy the attackers' backups and — because it claims access to the operation's key storage — help restore encrypted data. The fee is $20,000 to $60,000 to delete the stolen data from the ransomware group's servers.

The property that separates this from ordinary ambulance-chasing is when it arrives. GuidePoint notes that legitimate recovery-service solicitation generally follows an attack becoming public knowledge; this outreach lands before the incident is publicly known at all, which means the sender knew about an intrusion nobody had disclosed (GuidePoint Security, 2026-08-18). Responding to two of these incidents, GuidePoint's teams found the same set of artefacts in both victim environments: one network-scanning utility used for internal reconnaissance, one cloud-object-storage command-line tool used to move data out to attacker-controlled cloud storage, one remote-monitoring-and-management tool installed through a PowerShell script as a secondary access channel, a locally created backdoor account whose password was identical in both intrusions, and an identical attacker-controlled workstation name appearing in both. GuidePoint weighed and rejected the obvious innocent explanation — a standardised affiliate playbook or a shared virtual-machine image distributed inside one programme — because the same overlap recurred across incidents belonging to different ransomware operations, which makes it a fingerprint of an operator rather than of a programme. On that basis it assesses with moderate confidence that Ransom Busters is a single affiliate employed across several operations, using affiliate-level access to divert ransom negotiations away from the operation it is working for, and states it observed the behaviour while responding to incidents involving DragonForce, Settra and Anubis (GuidePoint Security, 2026-08-18).

A second incident-response firm has seen the same thing independently. Coveware confirmed to BleepingComputer that it responded to at least one incident involving contact from the same group or individual, and its senior director of incident response drew the same distinction — that what makes this different from a routine recovery-service pitch is the approach to a victim whose incident was not yet public (BleepingComputer, 2026-08-19). No victim is reported to have paid Ransom Busters; in one incident the victim paid the underlying ransomware operator instead.

Defender takeaway

during a ransomware incident, unsolicited inbound contact is part of the incident and belongs in the evidence, not in the inbox of whoever received it. A message offering to recover or delete data for a fee, arriving before anything is public, is a claim of foreknowledge that only a participant can honestly make — so it should be preserved, routed to the incident lead and treated as adversarial communication, not evaluated as a vendor proposal by an executive acting alone. Paying it buys nothing that can be verified: GuidePoint's own guidance is that no criminal party's promise to delete stolen data can be relied on, and retention for later re-extortion is a documented pattern. Triage: legitimate recovery and negotiation firms are retained by the victim, normally through counsel or an existing incident-response contract, and they approach victims — if at all — only once an incident is public; the discriminators are the direction of first contact, the pre-disclosure timing, and a claim of standing access to the attacker's own infrastructure, which no lawful firm would advertise. For hunt teams, GuidePoint's reasoning is reusable in its own right: the co-occurrence of an internal network scanner, a cloud-storage exfiltration utility, a script-installed remote-management agent and a freshly created local account across two nominally unrelated ransomware cases is a signal that the same operator worked both, whatever brand claimed the victims.

GRIT assesses with moderate confidence that “Ransom Busters” is not a bona fide third-party victim services firm, but rather a single ransomware affiliate with employment across multiple RaaS operations, using their affiliate access to divert ransom payment discussions away from the original ransomware operation.

We observed this behavior while responding to incidents from threat groups including DragonForce, Settra and Anubis.

GuidePoint Security (GRIT) 2026-08-18

ATT&CK mapping

6 techniques mapped from the cited reporting · MITRE ATT&CK v19.2

Execution TA0002

T1059.001Command and Scripting Interpreter: PowerShell

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).

overlap matrix · ATT&CK page ↗

Persistence TA0003

T1136.001Create Account: Local Account

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

overlap matrix · ATT&CK page ↗

Discovery TA0007

T1046Network Service Discovery

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.

overlap matrix · ATT&CK page ↗

Command and Control TA0011

T1219Remote Access Tools

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

overlap matrix · ATT&CK page ↗

Exfiltration TA0010

T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.

overlap matrix · ATT&CK page ↗

Impact TA0040

T1657Financial Theft

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware, business email compromise (BEC) and fraud, "pig butchering," bank hacking, and exploiting cryptocurrency networks.

overlap matrix · ATT&CK page ↗

Sources

GuidePoint Security (GRIT)primary BleepingComputercorroborating

PROVENANCE

AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.

Assessment

NATOB2NATO Admiralty code

Source reliabilityB Usually reliable

Info credibility2 Probably true

Verificationmulti-source

Confidencemedium

The identity conclusion is explicitly an assessment at moderate confidence, and this entry carries it as one. The observed facts beneath it — the outreach pattern, the sums demanded, the artefact overlap across incidents — are reported by GuidePoint as directly observed during its own incident response. GuidePoint did not verify the actor's claim to have compromised any ransomware operation's administrative panel; it observed only that the actor could demonstrate knowledge of the same stolen dataset the affiliate held. BleepingComputer supplies independent corroboration from a second incident-response firm, Coveware, which responded to at least one incident involving contact from the same party. Neither source names a victim, a sector or a region, and neither reports any victim having paid Ransom Busters.