The extortion layer your IR playbook has no page for: 'Ransom Busters' emails victims mid-incident

A threat actor calling itself Ransom Busters has been emailing organisations during live ransomware incidents, claiming it has broken into ransomware groups' servers and offering to delete the victim's stolen data for a fee between $20,000 and $60,000 ^[1]. GuidePoint's Research and Intelligence Team (GRIT) assesses that the persona is very likely a ransomware affiliate with work across multiple ransomware-as-a-service operations, which means the helpful stranger in the inbox is probably being paid by the victim twice ^{[2] [3]}.

The pitch is specific. The emails ask to be put in touch with the CEO or IT leadership, claim the sender found vulnerabilities in the administrative panels that RaaS groups maintain, and claim more than three years of access to those servers ^[4]. The sender then says it located the company's stolen data on a server it recently accessed and asks for payment to help the victim regain access to files and to delete all backups held by the ransomware group ^[5]. GRIT called the contact anomalous on timing alone: security firms do solicit ransomware victims, but generally only after an attack is public ^[6].

That routing around the incident response channel and straight to executives is the part most playbooks do not anticipate. GRIT says it saw the same approach while responding to incidents involving DragonForce, Settra and Anubis ^[7], and that a legitimate company doing this is extremely unlikely because it would violate the U.S. Computer Fraud and Abuse Act ^[8]. "This suggests that the operators were very likely either obfuscating the true origin of their access or they were not operating within the confines of the law," said Justin Timothy, a principal consultant at GRIT ^[9]. Asked why they charged, the group said that working for free would put their access to the threat actor's infrastructure at risk ^[10].

The forensics point the same direction. Across two incidents, GRIT found overlapping tooling: SoftPerfect Network Scanner for internal reconnaissance, s5cmd to exfiltrate data to AWS cloud storage, and the Remotely RMM tool installed via a PowerShell script ^[11]. Both intrusions also featured a local backdoor account with the password "Numlock!123" and the same attacker-controlled hostname, DESKTOP-BBETH6K ^[12], which GRIT says raises the likelihood that a single operator, most likely an affiliate rather than a third party, is behind the activity ^[13]. Timothy's conclusion is that the persona will betray its own criminal partners for money, that payment to any criminal party offers no guarantee of deletion, and that Ransom Busters should be treated as a hoax ^{[14] [15]}.

Note the pricing. GRIT frames this as an attempt to encourage more limited extortion payments ^[16], and the numbers support that reading: in the same reporting, GuidePoint attributes more than $8 million in payments across 15 Bitcoin wallets to five extortion brands run by UNC6671, at an average extortion amount of $600,000 ^[17]. A $60,000 ceiling is a tenth of that average ^[18], which is close to the price of a rounding error in a board update and well inside a discretionary spend.

What to watch: whether the persona shows up alongside RaaS families beyond DragonForce, Settra and Anubis ^[7], and whether the DESKTOP-BBETH6K and "Numlock!123" artefacts appear in unrelated engagements ^[12], which would argue for one operator rather than a technique being copied. On the defensive side, the practical control is procedural rather than technical: a written rule that unsolicited mid-incident contact goes to counsel and the IR lead, not to the CEO, since the CEO is exactly who the sender asks for ^[4].