Rogue ransomware affiliate poses as data recovery firm to scam victims
A suspected ransomware affiliate is pretending to be a data recovery service called "Ransom Busters" to extract payments from victims.
Cybersecurity researchers have uncovered a malicious scheme where a suspected ransomware affiliate is impersonating a data recovery service known as "Ransom Busters".
The perpetrator contacts targeted organizations before cyberattacks become publicly known, claiming they can provide decryption keys and delete stolen data in exchange for a fee.
This deceptive tactic highlights how threat actors exploit the vulnerability and panic of breach victims. Organizations targeted by these individuals face the risk of paying extortion money without any guarantee of recovering their systems.
For businesses and IT professionals globally, this serves as a critical warning about the evolving tactics used by cybercriminals. Verifying the legitimacy of any recovery vendor is essential during a security crisis.
Experts strongly advise against negotiating with unknown entities or self-proclaimed recovery firms that approach victims proactively, as they may be directly affiliated with the initial attackers.
