--- title: 'Ransom Busters': Ransomware Actor Poses as Recovery Service description: A ransomware affiliate calling itself 'Ransom Busters' has been contacting ransomware victims claiming to be a third-party recovery service that infiltrated... canonical: https://daily.dev/posts/ransom-busters-ransomware-actor-poses-as-recovery-service-qzvomta1w twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 'Ransom Busters': Ransomware Actor Poses as Recovery Service | daily.dev og:description: A ransomware affiliate calling itself 'Ransom Busters' has been contacting ransomware victims claiming to be a third-party recovery service that infiltrated... og:url: https://daily.dev/posts/ransom-busters-ransomware-actor-poses-as-recovery-service-qzvomta1w og:image: https://api.daily.dev/og/posts/QZVomta1w.png og:image:alt: 'Ransom Busters': Ransomware Actor Poses as Recovery Service og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 'Ransom Busters': Ransomware Actor Poses as Recovery Service **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary A ransomware affiliate calling itself 'Ransom Busters' has been contacting ransomware victims claiming to be a third-party recovery service that infiltrated criminal groups' servers and can delete stolen data and provide decryption keys for a fee of $20,000 to $60,000. GuidePoint Security's GRIT team assessed with moderate confidence that this is not a legitimate researcher but a single ransomware affiliate working with multiple RaaS groups (including DragonForce, Settra, and Anubis), attempting to divert ransom payments away from the original ransomware operation. Red flags include outreach before the attack was public, requests for Bitcoin payment, pricing quoted before any scoping call, and use of privacy-focused email addresses like ProtonMail rather than a corporate domain. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the 'Ransom Busters' scam targeting ransomware victims? Ransom Busters is a fraudulent scheme where a ransomware affiliate contacts victims claiming to be a third-party recovery service that has infiltrated ransomware group servers and can delete stolen data and provide decryption keys. GuidePoint Security's GRIT team linked it to affiliates working with DragonForce, Settra, and Anubis, charging victims between $20,000 and $60,000, likely to divert ransom payments from the original RaaS operation. _Security teams tracking ransomware negotiation tactics follow incident analysis like this on daily.dev._ ### How can I tell if a ransomware recovery offer is a scam? Warning signs include outreach before the breach becomes public, pricing quoted before any scoping call or investigation, use of privacy-focused email services like ProtonMail instead of a corporate domain, and demands for payment in Bitcoin. Legitimate incident-response firms need to understand an incident before quoting a price and never request cryptocurrency payment, according to GuidePoint's Justin Timothy. _Teams vetting incident-response vendors compare red flags like these on daily.dev._ ## Similar posts on daily.dev - [Ransomware has a new target. Is your backup ready?](https://daily.dev/posts/ransomware-has-a-new-target-is-your-backup-ready--9ngd2ioy2) · BleepingComputer · 0 upvotes · 0 comments - [The economics of ransomware 3.0](https://daily.dev/posts/the-economics-of-ransomware-3-0-lblgsdf5w) · CSO Online · 1 upvotes · 0 comments - [Russian hackers debut simple ransomware service](https://daily.dev/posts/russian-hackers-debut-simple-ransomware-service-8lbimqkfi) · The Register · 0 upvotes · 0 comments - [If you pay a hacker’s ransom, chances are that they’ll come back for more](https://daily.dev/posts/if-you-pay-a-hacker-s-ransom-chances-are-that-they-ll-come-back-for-more-s5y67i6nt) · TechCrunch · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ransomware](https://daily.dev/tags/ransomware) [View this post on daily.dev](https://daily.dev/posts/ransom-busters-ransomware-actor-poses-as-recovery-service-qzvomta1w) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"'Ransom Busters': Ransomware Actor Poses as Recovery Service","url":"https://daily.dev/posts/ransom-busters-ransomware-actor-poses-as-recovery-service-qzvomta1w","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ransom-busters-ransomware-actor-poses-as-recovery-service-qzvomta1w"},"datePublished":"2026-08-18T13:02:36.775Z","dateModified":"2026-08-20T14:40:10.903Z","description":"A ransomware affiliate calling itself 'Ransom Busters' has been contacting ransomware victims claiming to be a third-party recovery service that infiltrated...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dc212d07044fe7d3a26e124cd9586997?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dc212d07044fe7d3a26e124cd9586997?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ransom-busters-ransomware-actor-poses-as-recovery-service-qzvomta1w","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ransomware","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"'Ransom Busters': Ransomware Actor Poses as Recovery Service"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ransom-busters-ransomware-actor-poses-as-recovery-service-qzvomta1w#faq","mainEntity":[{"@type":"Question","name":"What is the 'Ransom Busters' scam targeting ransomware victims?","acceptedAnswer":{"@type":"Answer","text":"Ransom Busters is a fraudulent scheme where a ransomware affiliate contacts victims claiming to be a third-party recovery service that has infiltrated ransomware group servers and can delete stolen data and provide decryption keys. GuidePoint Security's GRIT team linked it to affiliates working with DragonForce, Settra, and Anubis, charging victims between $20,000 and $60,000, likely to divert ransom payments from the original RaaS operation. Security teams tracking ransomware negotiation tactics follow incident analysis like this on daily.dev."}},{"@type":"Question","name":"How can I tell if a ransomware recovery offer is a scam?","acceptedAnswer":{"@type":"Answer","text":"Warning signs include outreach before the breach becomes public, pricing quoted before any scoping call or investigation, use of privacy-focused email services like ProtonMail instead of a corporate domain, and demands for payment in Bitcoin. Legitimate incident-response firms need to understand an incident before quoting a price and never request cryptocurrency payment, according to GuidePoint's Justin Timothy. Teams vetting incident-response vendors compare red flags like these on daily.dev."}}]} ```