Ransomware Scammer Poses as Recovery Firm to Double-Cross Victims
A cybercriminal is tricking ransomware victims with a fake 'recovery service' to scam them twice.
1A New Scam Tactic
Researchers at GuidePoint Security discovered that a group called 'Ransom Busters' contacts ransomware victims before attacks become public. The group offers to recover encrypted files and delete stolen data for a fee much lower than the original ransom demand. However, this seemingly innocent offer hides a darker truth behind it.
2Not a Savior, But a Partner in Crime
GuidePoint's Research and Intelligence Team (GRIT) assesses with 'moderate confidence' that Ransom Busters is actually a ransomware affiliate. The group operates across multiple ransomware-as-a-service operations and attempts to divert payments away from its criminal partners. Traces of Ransom Busters were found during investigations into attacks linked to DragonForce, Settra, and Anubis.
3Convincing Yet Suspicious Offers
Ransom Busters sent emails to victims claiming they had hacked the ransomware gangs and found stolen data on the criminals' servers. They offered to retrieve encryption keys and delete data for a fee between $20,000 and $60,000. However, demonstrating access to the same datasets held by the attackers raised suspicions.
4Forensic Evidence Points to the Culprit
GuidePoint examined two incidents involving Ransom Busters and found that both attacks shared unusually specific digital fingerprints. The use of tools like SoftPerfect Network Scanner, s5cmd, and Remotely, a backdoor account created with the password 'Numlock!123,' and the hostname 'DESKTOP-BBETH6K' were detected in both attacks.
5Links to Multiple Gangs
The same attacker is believed to operate across multiple ransomware gangs, cutting out their employers to increase their own profits. GuidePoint noted this activity across various RaaS (Ransomware-as-a-Service) programs, suggesting a single affiliate is working with multiple gangs.
6No Guarantee of Recovery
GuidePoint warned that paying supposed rescuers does not guarantee stolen data will actually be deleted. Paying groups like Ransom Busters leaves victims at risk of a second scam and emboldens cybercriminals.
7Cybersecurity Warning
Experts advise organizations hit by ransomware to approach unofficial recovery offers with skepticism. A stranger knowing about the attack before it's reported and offering to solve the problem for a low fee suggests a potential scam.
8Impact on the Industry
This new scam tactic is raising alarms in the cybersecurity industry. Internal conflicts and fraud attempts among ransomware gangs show the cybercrime world is becoming increasingly complex. Organizations must enhance security measures and seek help through official channels.