Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000
Summary
A ransomware affiliate operating under the name "Ransom Busters" is actively contacting victim organizations, claiming to have compromised ransomware servers. They are extorting victims for fees between $20,000 and $60,000 in exchange for deleting stolen data from the original ransomware groups' servers.
IFF Assessment
This is bad news for defenders as it represents a new tactic where a third party profits from both the initial ransomware attack and the subsequent data exfiltration.
Defender Context
Defenders should be aware of this emerging trend of "ransomware disruption" services, where attackers or their affiliates intermediate in ransomware attacks to extract additional payments. Organizations need robust incident response plans that account for such multifaceted extortion attempts and avoid paying ransoms, as this encourages further criminal activity.