Federal investigators are examining alleged links between ShinyHunters and ransomware negotiation executives. The article also documents a real Dharma ransomware exchange in which the attacker steered a victim toward an alleged Canadian IT intermediary, using a reassuring “guarantees” offer to keep the victim moving toward payment.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A ransomware crew offers you a trusted IT contact. Trusted by whom? In a Dharma ransomware email, the reply said, 'If you want guarantees, you can write to the IT company.' It pointed to ghostbyte@tutanota.com, then pushed a phone call and services contract. Here’s the catch: the extortionist picked your adviser. The email even says, 'You’ll still have to pay.' And payment can’t prove stolen files were deleted. Don’t contact their referral. Send the demand to your pre-approved incident-response team.
Leaked chat logs linked to the Silent Ransom Group describe efforts to pressure U.S. law firms through extortion and, unusually, by sending in-person “agents” to physically enter offices and copy data. The FBI previously warned that people tied to the group were posing as IT staff to gain access,…
U.S. prosecutors say the owner of MonsterCloud told ransomware victims he could recover data with proprietary tools and avoid paying criminals, but instead allegedly paid the ransom and charged clients far more. The scheme reportedly used a paid “analysis” step where clients shared the ransom note…
The FBI warns about phone scams where callers impersonate police or federal agents and threaten arrest unless the victim pays immediately. The scams use pressure tactics (keeping victims on the phone, urging secrecy) and push hard-to-trace payments like prepaid cards, crypto, wire transfers, or…
The FBI says scammers posing as law enforcement or government officials stole over $1.6B since January 2025, mainly by calling victims and threatening arrest, fines, or legal trouble unless they pay. Variants include jury-duty threats, targeted calls to medical professionals about license issues,…
Revolut confirmed it disclosed sensitive customer information after fraudsters sent “emergency” information requests from a legitimate government email domain. The attackers appear to have targeted high-net-worth customers, including people involved in crypto, and attempted to extort Revolut to…
Researchers say a group calling itself “Ransom Busters” contacted ransomware victims before the attacks became public, pretending to be a recovery firm. The emails offered to delete stolen data and provide decryption keys for $20,000–$60,000, likely diverting payments away from the victim’s…
