Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000
GuidePoint reports a ransomware affiliate posing as 'Ransom Busters' charges victims $20,000-$60,000 to delete stolen data, and details UNC6671's $8M AitM extortion wave.
GuidePoint's GRIT team reports that 'Ransom Busters', likely a ransomware affiliate active across multiple RaaS operations including DragonForce, Settra and Anubis, proactively emails victims claiming it deleted their stolen data and backups for a $20,000-$60,000 fee, citing claimed access to RaaS administrative panels for over three years. Two analyzed intrusions shared tooling: SoftPerfect Network Scanner for reconnaissance, s5cmd-based exfiltration to AWS cloud storage, an RMM tool installed via PowerShell, a backdoor account with password 'Numlock!123' and the same attacker hostname DESKTOP-BBETH6K. Separately, GRIT detailed UNC6671's (Cordial Spider) adversary-in-the-middle vishing operation running since April under five extortion brands, with more than $8 million across 15 Bitcoin wallets, an average of $600,000 per payment, and 78 phishing sub-domains across 76 organizations, 40% in financial services.
- Ransom Busters claims three years of access to RaaS admin panels and offers data deletion for $20,000-$60,000
- Shared tooling: SoftPerfect Network Scanner, s5cmd to AWS, an RMM tool, backdoor account 'Numlock!123'
- UNC6671's AitM vishing operation took $8 million+ across 15 wallets, averaging $600,000 per victim
- 78 phishing sub-domains across 76 organizations; 40% in financial services
- ATT&CK
- T1566.004 Spearphishing VoiceT1557 Adversary-in-the-MiddleT1567.002 Exfiltration to Cloud StorageT1219 Remote Access SoftwareT1046 Network Service Discovery
- Products
- SoftPerfect Network Scanners5cmd
- Organizations
- GuidePointGRIT
- Countries
- United States
From the original article
6 min read at thehackernews.com
A ransomware affiliate calling itself Ransom Busters has been spotted proactively sending emails to victim organizations and claims to delete stolen data from ransomware groups' servers in exchange for a fee ranging from $20,000 to $60,000. "In these messages, the third-party offers to help the victim recover from ransomware attack.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.