Search: “Ransom Busters”

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000

GuidePoint reports a ransomware affiliate posing as 'Ransom Busters' charges victims $20,000-$60,000 to delete stolen data, and details UNC6671's $8M AitM extortion wave.

GuidePoint's GRIT team reports that 'Ransom Busters', likely a ransomware affiliate active across multiple RaaS operations including DragonForce, Settra and Anubis, proactively emails victims claiming it deleted their stolen data and backups for a $20,000-$60,000 fee, citing claimed access to RaaS administrative panels for over three years. Two analyzed intrusions shared tooling: SoftPerfect Network Scanner for reconnaissance, s5cmd-based exfiltration to AWS cloud storage, an RMM tool installed via PowerShell, a backdoor account with password 'Numlock!123' and the same attacker hostname DESKTOP-BBETH6K. Separately, GRIT detailed UNC6671's (Cordial Spider) adversary-in-the-middle vishing operation running since April under five extortion brands, with more than $8 million across 15 Bitcoin wallets, an average of $600,000 per payment, and 78 phishing sub-domains across 76 organizations, 40% in financial services.

The Hacker News·Aug 18, 17:35 UTC · 28d agoThreat actor in the wild1

55

Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras

Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.

Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.

Risky Business News·Aug 19, 04:52 UTC · 28d agoThreat actor in the wild1

72

Weekly Update 517: Cyber Ransoms

Troy Hunt's weekly commentary argues much ransomware is simple extortion by young actors who struggle to monetize ransoms.

In Weekly Update 517, Troy Hunt comments on the current ransomware landscape, noting many attacks involve pure extortion rather than actual malware. He observes that many actors are young and earn large sums but face practical difficulties spending ransom proceeds. The piece is opinion commentary rather than a new incident disclosure.

Troy Hunt·Aug 18, 03:44 UTC · 29d agoIndustry

15

Srsly Risky Biz: Data Theft Extortion Is Booming! Hooray!

Google's Threat Intelligence Group reports data theft extortion is surging, with Silent Ransom extracting $10M and $18M from two law firms and BlackFile taking $10M.

Risky Business News, citing Google Threat Intelligence Group (GTIG), reports that cybercriminals are shifting from encrypting ransomware to data theft extortion. Law firms Goodwin Procter and WilmerHale paid Silent Ransom (Luna Moth) ransoms of $10 million and $18 million respectively; GTIG says the group often completes contact-to-extortion in a single day, now sometimes compromising systems in person posing as IT staff. BlackFile, now calling itself Redact, used high-volume vishing to steal credentials and pivot through OneDrive, SharePoint and other SaaS apps, collecting more than $10 million between February and mid-May with an average ransom of $750,000, including attempted attacks on Wall Street hedge funds and private equity firms. The piece argues governments should keep pressure on encrypting ransomware gangs while lower-impact extortion absorbs criminal energy.

Risky Business News·Aug 13, 09:46 UTC · Aug 13, 2026Threat actor1

75

Ransomware negotiation tactics have turned into a business process

Intel 471's Dave Ross details ransomware negotiation tactics, with demands typically set at 1-5% of annual revenue and specialized criminal service roles.

In a Help Net Security video, Intel 471 Senior Director Dave Ross explains how ransomware groups research a victim's revenue and insurance coverage, run test decryptions to prove they hold a working key, and set demands at roughly 1% to 5% of annual revenue. He describes negotiation dynamics with shifting deadlines and a criminal service economy supplying language skills, data review, and legal analysis. Multi-extortion methods include data theft, DDoS attacks, and direct contact with customers and journalists.

Help Net Security·Sep 8, 05:40 UTC · 8d agoRansomware

32

Akira Affiliate Crashes Ransomware After Attempting EDR Evasion

Huntress documented an Akira ransomware affiliate attack that failed after its anti-EDR tool crashed legitimate software and stopped encryption before completion.

Infosecurity Magazine reports on Huntress research into a failed Akira ransomware affiliate attack. The affiliate attempted EDR evasion using an anti-EDR tool, but the tool interfered with legitimate software on the client's system. The interference crashed the ransomware before encryption completed, sabotaging the attack; no completed encryption was reported.

Infosecurity Magazine·Aug 13, 09:30 UTC · Aug 13, 2026Ransomware

45

Top 10 Best Ransomware Protection Solutions in 2026

A 2026 buyer's guide ranks ten ransomware protection tools by kill-chain role as extortion shifts from encryption to data theft.

The roundup organizes defenses across the ransomware kill chain: prevention-grade EPP/EDR platforms, containment layers, rollback specialists, and immutable recovery. Recommended products include CrowdStrike, Microsoft Defender, Sophos, SentinelOne, Bitdefender, Trend Micro, Halcyon, Huntress, and Malwarebytes. It stresses that many crews now extort on stolen data without encrypting, making exfiltration detection and response speed as important as rollback.

Cyber Security News·Sep 10, 08:18 UTC · 6d agoIndustry1

15

Local governments in four states dealing with cyberattacks that have shut down services

Ransomware and cyberattacks disrupted local governments in California, Oklahoma, South Dakota, Texas and Wisconsin, taking Suisun City's 911 offline.

Suisun City, California (population 30,000) shut down its IT network after malicious software hit 911 routing, police and fire dispatch; the city declared a state of emergency and the FBI is investigating. Coweta, Oklahoma confirmed a ransomware attack affecting all computers and digital services, with off-site backups slated for restoration. Mitchell (South Dakota), Coryell County (Texas) and Washburn County (Wisconsin) also disclosed cyberattacks that shut down networks and disrupted phone and payment systems.

The Record·Aug 11, 13:14 UTC · Aug 11, 2026Ransomware in the wild

55

Stronger Security Drives Ransomware Groups to Recruit From Within

Researchers report ransomware groups increasingly recruiting insiders at target companies to bypass stronger security, with insider-assisted attacks costing victims millions.

Security researchers have observed an uptick in insider-assisted ransomware attacks as organizations strengthen their defenses. Ransomware groups are reportedly recruiting from within target companies, and malicious insiders also enable other costly threats. No specific victims or campaigns are named in the report.

Dark Reading·Sep 1, 21:03 UTC · 14d agoRansomware

38

12 Best Ransomware Protection Solutions Compared (2026): Features & Pricing

GBHackers compares 12 ransomware protection solutions for 2026, recommending layered stacks of EDR prevention, managed detection, containment, and guaranteed recovery.

The editorial comparison argues no single product stops ransomware, recommending a layered strategy across prevention, early detection, blast-radius containment, and clean recovery. CrowdStrike and SentinelOne are named best-in-class EDR, Huntress and Sophos MDR for managed 24/7 coverage, ColorTokens for microsegmentation containment, and Rubrik and Acronis for guaranteed recovery. The guide notes ransomware is now professionalized with double extortion and encryption sprints measured in minutes.

GBHackers·updated 09:00 UTC · 44m ago·first Sep 11, 07:18 UTC · 5d agoIndustry 11 sources1

13

Dragonforce Turf War Ransomware

Infosecurity Magazine reports a turf war within the DragonForce ransomware operation, which could affect its cartel-style affiliate ecosystem.

The article covers reported internal tensions inside the DragonForce ransomware group, which operates a cartel-style model leasing ransomware tools and infrastructure to affiliates. A turf war could disrupt affiliate relationships, recruitment, and the group's operational tempo. Specific details were not included in the available text.

Infosecurity Magazine·Aug 17, 00:00 UTC · Aug 17, 2026Ransomware

55

Cost-Aware Hierarchical Multi-Agent Ransomware Detection and Family Attribution

Researchers propose a hierarchical multi-agent system that cuts ransomware analysis cost by 44% while reaching 96.57% detection accuracy.

An arXiv paper (2609.04820) presents a Cost-Aware Hierarchical Multi-Agent System (HMAS) for adaptive ransomware detection and family attribution. Specialized agents run static analysis first, with dynamic and memory modalities invoked only when confidence is insufficient or specialists disagree; a Meta Orchestrator balances accuracy against computational cost via a cost model, and a locally deployed LLM verifies difficult cases. The system achieved 96.57% accuracy, 0.96 F1-score, and 0.99 ROC-AUC for binary detection, and 0.90 macro-F1 for multiclass family attribution. Average analysis cost dropped 43.97% versus exhaustive analysis, with 56.05% of cases resolved using static evidence alone.

arXiv cs.CR·Sep 4, 07:17 UTC · 12d agoResearch

38