'Ransom Busters': Ransomware Actor Poses as Incident-Recovery Service

GuidePoint Research observed a malicious actor calling itself “Ransom Busters” contacting ransomware victims and offering to return or delete stolen data for fees ($20k–$60k), claiming access to affiliates’ servers and encryption keys; GRIT assesses with moderate confidence this is likely a ransomware affiliate exploiting shared access to monetize victims outside standard RaaS payment channels, undermining the RaaS business model and posing an active extortion risk.