Ransomware crook poses as recovery firm to steal payments from fellow extortionists

Researchers at GuidePoint Security discovered an actor calling itself "Ransom Busters" that contacts ransomware victims offering cheaper recovery and data-deletion services while likely being an affiliate who redirects ransom payments; forensic evidence (shared tools, a reused password, and a common hostname) links this activity across multiple RaaS groups and suggests an affiliate is skimming payoffs from criminal partners.