Ransom Busters is a rogue ransomware affiliate posing as a ransomware recovery firm, contacting victims before their attacks are publicly disclosed. They claim to have exploited vulnerabilities in ransomware administrative panels to access encryption keys and stolen data, offering to delete data and provide decryption keys for a fee. Analysis by GuidePoint Security's Research and Intelligence Team (GRIT) indicates that Ransom Busters is likely the same entity responsible for the ransomware attacks, as evidenced by shared tools (SoftPerfect Network Scanner, s5cmd, Remotely), tactics (local backdoor account with password 'Numlock!123'), and attacker-controlled hostnames. This affiliate attempts to steal ransom payments from the ransomware gangs it collaborates with. Coveware corroborates this behavior, noting that such interference on non-public incidents is unusual and increases victim risk. No confirmed victim payments to Ransom Busters have been observed, and victims are discouraged from engaging with this group.

The rogue affiliate's impersonation of a recovery service can lead victims to pay fraudulent ransom demands, resulting in financial loss without guaranteed data recovery. This behavior undermines trust in ransomware negotiations and complicates victim decision-making. The interference by a third party with access to stolen data increases the risk that paying the original ransomware operators may not prevent data leakage, as multiple parties may control the stolen information. Although no evidence shows that Ransom Busters leaked stolen data externally, their actions disrupt normal ransomware revenue-sharing and victim remediation processes.

Victims are strongly advised not to pay any demands from Ransom Busters, as this group is not a legitimate recovery service but likely the ransomware affiliate responsible for the attacks. Organizations should rely on trusted incident response and ransomware negotiation firms for assistance. There is no indication that patching or technical remediation can prevent this social engineering and fraud tactic. Monitoring for suspicious communications and verifying the legitimacy of recovery offers before engagement is recommended. No official patches or fixes apply to this threat.