Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000
Summary: A ransomware affiliate calling itself Ransom Busters is emailing victim organizations offering to delete their stolen data from ransomware groups' servers for $20,000 to $60,000, claiming it has held access to RaaS administrative panels for over three years. GuidePoint said it observed the tactic in incidents tied to DragonForce, Settra, and Anubis, and found two intrusions sharing a local backdoor account with the password "Numlock!123" and the same attacker-controlled hostname, DESKTOP-BBETH6K.
Bottom line: GuidePoint's Justin Timothy said payment to any criminal party offers no guarantee stolen data will be deleted, and that Ransom Busters should be treated as a hoax - so a victim weighing a $20,000 to $60,000 payment is negotiating with an actor who may be the same affiliate that encrypted them.
Read the original at The Hacker News ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026