MalwareBleeping Computer
8.0 — CRITICAL
Rogue ransomware affiliate poses as data recovery firm to steal payments
A suspected ransomware affiliate is posing as a ransomware recovery service called "Ransom Busters," contacting the victims before the attacks become public and claiming to be able to provide decryption keys and delete stolen data for a fee. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
A rogue ransomware affiliate is posing as a data recovery firm, Ransom Busters, to steal payments from ransomware gangs it works with, contacting victims before attacks become public and claiming access to decryption keys and stolen data for a fee.
⚙️Technical Details
Affected Systems
administrative panels used by ransomware-as-a-service (RaaS) operations
Attack Vectors
using the same software, including SoftPerfect Network Scanner, s5cmd, and the Remotely remote monitoring tool
💥Impact Assessment
Severity: high
Who Is at Risk
Victims of ransomware attacks who pay Ransom Busters or attempt to negotiate with them
🛡️Recommended Actions
1Do not pay Ransom Busters or any other third-party ransomware recovery services without verifying their legitimacy first
2Monitor email and network activity for suspicious activity from unknown senders claiming access to decryption keys and stolen data
3Implement robust security controls, including multi-factor authentication and secure remote access protocols
📦Affected Products
administrative panels used by ransomware-as-a-service (RaaS) operations
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.