MalwareBleeping Computer
8.0 — CRITICAL
Rogue ransomware affiliate poses as recovery firm to steal payments
A suspected ransomware affiliate is posing as a ransomware recovery service called "Ransom Busters," contacting the victims before the attacks become public and claiming to be able to provide decryption keys and delete stolen data for a fee. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
A rogue ransomware affiliate is posing as a recovery firm, Ransom Busters, to steal payments from ransomware gangs it works with, contacting victims before attacks become public and claiming access to decryption keys and stolen data for a fee.
⚙️Technical Details
Attack Vectors
Exploiting vulnerabilities in administrative panels used by RaaS operationsUsing the same software, including SoftPerfect Network Scanner, s5cmd, and Remotely remote monitoring tool
💥Impact Assessment
Severity: High
Who Is at Risk
Businesses and organizations targeted by ransomware gangs
🛡️Recommended Actions
1Verify the authenticity of recovery services before contacting them
2Be cautious when receiving emails from unknown parties claiming access to decryption keys or stolen data
3Do not pay ransom demands without verifying the legitimacy of the demand and the identity of the party making it
📦Affected Products
Software:SoftPerfect Network Scanners5cmdRemotely remote monitoring tool
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.