Beware the Ransomware Rescuer: Ransom Busters

In the communications that followed, the actor claimed to have discovered vulnerabilities in the “administrative panels” (the backend of the threat actor’s ransomware operations portal) of several ransomware-as-a-service (RaaS) operations. 

We observed this behavior while responding to incidents from threat groups including DragonForce, Settra and Anubis. The threat actor claimed this access allowed them control over “almost all of their infrastructure.” Like RaaS groups, Ransom Busters’ motivation appears to be financial. Ransom Busters confirmed access to the exact same dataset that the ransomware affiliate possessed, when questioned. The group offered to delete the victim’s stolen data from the ransomware groups’ servers for a fee of between $20,000 to $60,000.  

Notably, the kind of offensive actions claimed by this third-party, such as unauthorized access to a RaaS operation’s servers to delete data, could be considered a violation of the Computer Fraud Abuse Act. 

We would not expect a legitimate organization to potentially commit a crime, much less to charge a fee in exchange for doing so. This suggests that the operators were very likely either obfuscating the true origin of their access or they were not operating within the confines of the law. When pressed on why they charged for their help, the group offered a puzzling explanation: that acting without compensation would put their access to the threat actor’s infrastructure at risk. Paying this group would have no logical bearing on their ability to access criminal infrastructure, making this a difficult explanation to accept.

Recently, GuidePoint’s DFIR (Digital Forensics and Incident Response) team responded to two incidents where Ransom Busters contacted victims. Upon analyzing the cases, GRIT (part of the DFIR team) discovered striking similarities. While most ransomware intrusions follow similar playbooks, each attack typically has its own unique characteristics in terms of tooling used and persistence mechanisms within the victim’s network. Forensic analysis of both environments revealed overlaps in the tools used, including SoftPerfect Network Scanner for internal reconnaissance, the s5cmd tool for exfiltrating data to cloud storage via AWS and the Remotely remote monitoring and management (RMM) tool installed through a PowerShell script. Threat actors maintain several options available to perform all of these tasks, so the use of identical tools in multiple environments suggest the same operator enacting the intrusions. Both cases also showed that the threat actor created a local backdoor account using the same password of Numlock!123. Since password choice is essentially unconstrained, using the same one is a strong point of correlation between the cases. Furthermore, the same attacker-controlled hostname, DESKTOP-BBETH6K, was identified across both intrusions. 

While these overlaps in tooling, techniques and host machines could simply be a shared playbook and possibly a standardized virtual machine environment distributed to multiple affiliates within the same RaaS operation, we consider this explanation to be less plausible. GuidePoint has observed the overlap in activity across several distinct RaaS programs where “Ransom Busters” has intervened. That supports our assessment that this is not a genuine third-party researcher, but rather a single ransomware affiliate enacting the same set of Tactics, Techniques and Procedures (TTPs) across multiple victims’ environments.

Conclusion

GRIT assesses with moderate confidence that “Ransom Busters” is not a bona fide third-party victim services firm, but rather a single ransomware affiliate with employment across multiple RaaS operations, using their affiliate access to divert ransom payment discussions away from the original ransomware operation.

The implications for ransomware victims are clear: criminal actors cannot be trusted and may employ deceptive tactics to encourage even more limited extortion payments. “Ransom Busters” or, more likely, the ransomware affiliate maintaining this persona, has shown it will betray even its own criminal partners in pursuit of financial gain. 

Payment to any criminal party offers no guarantee that stolen data will be deleted. In other cases, researchers have observed evidence of threat actors retaining multiple copies of stolen data that may later be sold or used for re-extortion. There are no “magic bullets” for remedying data exfiltration and “Ransom Busters’” masquerading as beneficent saviors should be treated as a hoax. 

Victims who receive this type of contact should report it to their incident response team immediately. Law enforcement and reputable incident response firms remain the most reliable resources when navigating a ransomware incident and any unsolicited offer to “help” for a fee should be treated with significant skepticism.