Researchers say a group calling itself “Ransom Busters” contacted ransomware victims before the attacks became public, pretending to be a recovery firm. The emails offered to delete stolen data and provide decryption keys for $20,000–$60,000, likely diverting payments away from the victim’s original extortionists, with no guarantee data would actually be deleted.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: your files are locked by ransomware… and before anyone goes public, an email pops up from something called “Ransom Busters.” The message claims, “We have hacked the ransomware gang and located your stolen data; we can delete it and retrieve the encryption keys for a reduced payment between $20,000 and $60,000.” Sounds like a rescue, right? Here’s the twist: researchers say “Ransom Busters” is likely just another ransomware affiliate, trying to hijack the payout. They email victims before the attack is public, push you to pay them instead, and there’s zero proof your stolen data ever disappears. If a mystery “recovery” outfit knows about a ransomware hit and emails you first, treat it as part of the attack, forward it immediately to your incident response lead and legal, and do not engage.
A criminal actor calling itself “Ransom Busters” is emailing organizations that recently suffered ransomware incidents, claiming it hacked ransomware groups’ servers and can delete the victim’s stolen data for a $20,000–$60,000 fee. The messages ask to speak with the CEO or IT leadership and…
After exploiting SonicWall SMA 1000 VPN appliances, attackers tied to INC Ransomware reportedly contacted victims directly using emails and phone calls claiming they could help with “ransomware issues.” One caller said he was “from a group of hackers,” asserted the network was compromised, and…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
Researchers found a criminal operation (StopAndProtect) that used nearly 2,000 hacked WordPress sites as a delivery network. Visitors were shown a fake CAPTCHA that pressured them to copy and run a PowerShell command, which then installed malware that could steal data, capture screenshots, and…
Researchers observed real phishing emails posing as transaction receipts to trick people into opening a PDF attachment. The PDF claims an “Adobe Flash Player update is required,” leading victims to download and run a script that silently installs ScreenConnect for persistent remote access.
SafePal says an order-tracking plug-in flaw exposed order data for 39,798 customers, including names, contact details, shipping addresses, and purchase information. A customer reported receiving a suspicious email, letter, and phone call from someone pretending to be SafePal and urging them to…
