Ransomware affiliates are adopting a new “Ransom Busters” tactic, posing as incident-recovery specialists to insert themselves into negotiations with already-breached organizations. In one recently documented scam, a fake security researcher contacted a firm after a ransomware attack, claiming they could recover or delete files stolen by the original gang in exchange for Bitcoin.[3] The impostor framed the offer as victim assistance while in reality seeking to redirect payments and further profit from the same incident.[3]
These fake recovery operators typically reach out via email and other channels, presenting themselves as ethical hackers or groups that have “hacked the hackers” and gained access to the ransomware gang’s infrastructure.[3] They assert they now control the stolen data and can either restore it or permanently delete it if the victim pays a separate fee, usually in cryptocurrency.[3] Other schemes rely on slick online marketing, including paid reviews and social media promotions, to lure victims into WhatsApp-based negotiations with so‑called ransomware recovery experts who ultimately deliver nothing.[11]
The Ransom Busters model slots neatly into the broader ransomware-as-a-service ecosystem, in which affiliates and intermediaries share tools, infrastructure and profit from every stage of the attack lifecycle.[1][14] Modern ransomware crews already practice double and even triple extortion, combining data theft, file encryption and additional pressure such as public shaming or denial-of-service attacks to maximize leverage.[1][14] By inserting a bogus “recovery” layer, affiliates can squeeze victims again after the initial breach, sometimes without deploying any new malware at all.[1][3]
For incident responders, the biggest risk is that desperate victims treat these cold contacts as a shortcut, cutting out established response processes and law-enforcement engagement.[2][11] In addition to financial loss, dealing with impostor recovery services can contaminate evidence, complicate breach notification duties and expose sensitive information to yet another unvetted actor.[2][11] In a separate but related campaign, researchers at Rapid7 observed a threat actor linked to Black Basta who overwhelmed users’ inboxes with junk email and then phoned them while posing as internal IT support, coaxing them to install remote-access tools under the guise of fixing the issue.[12] The same playbook—manufacturing a problem and then rushing in as the helpful fixer—underpins both pre- and post-encryption social engineering around ransomware incidents.[3][12]
Organizations hit by ransomware should treat unsolicited recovery offers as inherently suspicious and instead lean on vetted incident-response partners, legal counsel and national cyber authorities.[2][11] Guides from government coalitions, such as the #StopRansomware framework, stress offline backups, tested recovery procedures, multifactor authentication and prompt patching of internet-facing systems as the foundation for resilience.[2] Victims seeking decryption help should start with trusted initiatives like the No More Ransom project and official law-enforcement or CERT channels, and avoid engaging over consumer messaging apps with unknown individuals promising miracle fixes.[2][11]
References
- How Affiliate Models Are Powering a New Era of Cybercrime
- [PDF] #StopRansomware Guide
- New Ransomware Technique Emerges: Fake Ransomware Support
- RANSOMWARE RECOVERY: DEBUNKING THE MYTH – LinkedIn
- Social Engineering Campaign Linked to Black Basta Ransomware Operators | Rapid7 Blog
- Modern Ransomware’s Double Extortion Tactics and How to Protect …
