Ransomware Gangs Impersonate Recovery Firms, Demand Up to $60,000

Key Takeaways

• Ransomware victims are being targeted by a deceptive new scheme where attackers impersonate data recovery firms.
• The fake recovery firm, “Ransom Busters LTD,” contacts victims with knowledge of their private breach and demands a second payment ranging from $20,000 to $60,000.
• Security researchers believe these “recovery firms” are likely ransomware affiliates attempting to double-extort victims by leveraging their initial access and stolen data.
• Common tools and tactics observed across multiple incidents suggest a single affiliate group is behind the Ransom Busters persona, operating alongside ransomware operations like DragonForce, Settra, and Anubis.
• Organizations should treat unsolicited recovery offers with extreme suspicion and involve trusted incident response teams and law enforcement.

Ransomware Hackers Pose as Recovery Firm

A disturbing new trend has emerged in the ransomware landscape, where victims, already reeling from a cyberattack, are being approached by entities masquerading as legitimate data recovery firms. These deceptive operations, exemplified by one calling itself “Ransom Busters LTD,” aim to exploit victims’ vulnerability by offering to retrieve encrypted files and erase stolen data, only to demand a second ransom payment. This tactic adds a complex layer of deception and financial strain to an already critical situation.

The modus operandi involves contacting affected companies before the breach becomes public, specifically requesting to engage with chief executives or IT leaders. This immediate access to sensitive information about a private incident raises significant red flags, suggesting an intimate connection to the original attack. According to a report, researchers suspect these alleged recovery services are, in fact, ransomware affiliates employing a new tactic for extortion.

The Deceptive Sales Pitch

Ransom Busters LTD claims to have penetrated criminal servers, located stolen data, and secured access to encryption keys. They promise to restore victim files and permanently delete all copies held by the original ransomware group, positioning themselves as saviors rather than secondary aggressors. However, their subsequent demand for payment, ranging from $20,000 to $60,000 to “remove” the stolen information, exposes their true intent. The fact that they can demonstrate access to the same dataset as the ransomware affiliate strongly undermines their narrative of being an independent helper.

This scheme presents significant legal and practical dilemmas for victims. Engaging with such an entity, particularly if their claims of infiltrating criminal infrastructure are true, could potentially violate laws like the Computer Fraud Abuse Act. Furthermore, a legitimate recovery provider would not typically demand payment for actions that could be construed as illegal or for services that lack a clear, verifiable outcome. The flimsy justification for the fee – that free assistance would jeopardize their access to criminal infrastructure – further suggests an attempt to manipulate negotiations for financial gain. This pattern indicates a sophisticated effort to redirect ransom payments, fitting within a broader ecosystem where ransomware affiliates often share infrastructure but compete for profits.

Shared Tools Reveal a Likely Affiliate

GuidePoint Security said in a report shared with Cyber Security News (CSN) that their incident response team investigated two separate cases where Ransom Busters contacted victims. The forensic analysis of these intrusions revealed a striking consistency in the tools employed for network discovery, cloud data exfiltration, and remote control. Despite the availability of numerous alternative tools for each task, the attackers utilized the same specific suite:

• Network discovery: SoftPerfect Network Scanner
• Data exfiltration: s5cmd for transferring data to AWS cloud storage
• Remote management: Remotely, installed via a PowerShell script

Additionally, both environments exhibited the same local backdoor account password, “Numlock!123“, and the identical attacker-controlled computer name, “DESKTOP-BBETH6K“. While no single shared tool definitively identifies an attacker, the combination of these consistent overlaps across different ransomware-as-a-service (RaaS) operations (including DragonForce, Settra, and Anubis) led researchers to conclude with moderate confidence that a single affiliate is operating the Ransom Busters persona across these incidents.

The recurring involvement of DragonForce is particularly notable. Their operational model, detailed in a DragonForce attack technique review, illustrates its cartel-style services, including dedicated panels and storage for its partners, which could facilitate such double-extortion schemes.

What You Should Do

For organizations that have fallen victim to ransomware, receiving an unsolicited recovery offer can be tempting, but it is crucial to exercise extreme caution.

• Engage your incident response team: Immediately forward any suspicious recovery messages to your internal or external incident response team for analysis and preservation as evidence.
• Involve law enforcement: Report the incident to relevant law enforcement agencies. They can provide guidance and potentially aid in investigations.
• Verify claims independently: Do not trust claims of data access or deletion without independent verification. A legitimate recovery firm would not engage in illicit activities or provide questionable justifications for payment.
• Assume no guarantees: Understand that paying a self-proclaimed “recovery firm” offers no assurance that stolen data will be erased or that further extortion attempts will cease. You may simply

  Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.

  Tags:

  AttackBreachHackerransomwareSecurityThreat