Ransom Busters' Secondary Extortion Tactics Target Ransomware Victims
In August 2026, a ransomware affiliate known as 'Ransom Busters' initiated a deceptive campaign targeting organizations previously victimized by ransomware attacks. The group claimed to have infiltrated ransomware groups' servers, offering to delete stolen data in exchange for payments ranging from $20,000 to $60,000. This approach involved direct communication with victim organizations, asserting unauthorized access to threat actors' infrastructure and proposing data recovery services for a fee. The legitimacy of these claims is highly questionable, as such actions would constitute violations of the U.S. Computer Fraud and Abuse Act. This incident underscores the evolving tactics within the ransomware ecosystem, where affiliates may exploit victims through secondary extortion schemes. Organizations are advised to exercise caution and skepticism toward unsolicited offers of assistance from unverified entities, as engaging with such actors may lead to further financial loss without any assurance of data recovery.
Kill Chain
