Ransomware Hackers Pose as Recovery Firm and Demand Up to $60,000
Brief
Ransomware victims are facing a new kind of pressure campaign. Instead of receiving another demand from the attackers who stole their data, some companies are being contacted by a supposed recovery firm that says it can retrieve files and erase stolen copies.
The operation calls itself Ransom Busters. Its emails arrive before an incident is public and ask to speak with a chief executive or IT leader, an unusual approach that raises immediate questions about how the sender learned of a private breach.
Its researchers assess the alleged recovery service as a ransomware affiliate using a different route to extort victims.
GuidePoint Security said in a report shared with Cyber Security News (CSN) that the campaign was observed during responses to intrusions linked to DragonForce, Settra, and Anubis.