GuidePoint Research and Intelligence Team

The extortion layer your IR playbook has no page for: 'Ransom Busters' emails victims mid-incident

GuidePoint says the persona offering to delete stolen data for $20,000 to $60,000 is very likely a ransomware affiliate, which makes the rescue fee a second payment to the same attacker.