Ransom Busters Claims to Hack Ransomware Servers, Demands Fees from Victims

According to reports from The Hacker News, a group calling itself Ransom Busters has been sending emails to victim organizations following ransomware incidents. The messages claim that the group has accessed ransomware group infrastructure and can delete the victim's stolen data. In exchange for a fee between $20,000 and $60,000, Ransom Busters purports to offer recovery assistance. GuidePoint Research analysts stated that the nature of these communications immediately stands out as anomalous. The legitimacy of the group's claims, their actual access to ransomware servers, and their intentions remain unverified. Security experts warn that victims paying these fees may not receive data deletion confirmation and could face secondary extortion or fraud. The emergence of such a service, whether genuine or fraudulent, highlights the evolving monetization schemes and potential internal conflicts within the ransomware ecosystem. Organizations are advised to verify the legitimacy of any third-party recovery offers, consult incident response professionals, and rely on offline backups for data restoration rather than paying undisclosed fees.