Ransomware victims targeted by fake hack-back offers

Arctic Wolf investigated cases in Oct–Nov 2023 where organizations hit by Royal and Akira ransomware were approached by a scammer posing as a security researcher offering to delete stolen data for a fee (up to ~5 BTC); consistent messaging across cases suggests a coordinated follow-on extortion campaign that increases financial and operational risk for ransomware victims.