A Wolf In Shepherd's Clothing: "Ransom Busters" Is Just Another Coyote With Better Stationery
I have been in this field since before your "threat intelligence platforms" could spell the word "threat." I have seen every grift, every con, every shell game this industry has produced. And yet, somehow, this one still made me put down my coffee.
"Ransom Busters." They are sending cold emails to already-victimized members of the flock, claiming they have penetrated the original attackers' servers and can delete your stolen data. For a modest fee of twenty to sixty thousand dollars.
Let me be very clear: this is fake grain. Sophisticated, well-dressed fake grain, but fake grain nonetheless.
The original coyote already bit your sheep. Now a second coyote is trotting up to the paddock, wearing a little hat, claiming to be a veterinarian. GuidePoint Research flagged this as "immediately anomalous," which I appreciate, though in my day we called it "obviously a scam" and moved on with our lives.
The mechanics here are almost elegant, in a deeply depressing way. The affiliate almost certainly has some connection to the original ransomware operation, or is simply harvesting victim lists from public leak sites. Either way, they know who is bleeding. They show up with a mop and ask for sixty thousand dollars.
The Shepherds in your organization will be tempted. Do not let them near the checkbook.
Here is what nobody wants to admit: there is zero verification possible here. You cannot audit a criminal's file deletion. You are paying for a promise, from a wolf, about what another wolf allegedly did. On the internet. In the Sky Pasture, where nothing is verifiable and everyone is anonymous.
Back when data lived on magnetic tape in a locked room, this particular scam was physically impossible. I am just noting that for the record.
Remediation
First, do not pay. Either of them.
Second, if you receive one of these emails, treat it as evidence and forward it to law enforcement immediately. Document everything. Print it out if you have to. Paper does not get ransomed.
Third, check your Electric Fence. If the original hole in the fence was never properly patched with ointment, you are still exposed, and now you have two coyotes with your address.
Fourth, brief the Shepherds. Use small words and a chart if necessary.
Finally, a competent Sheep Tunnel and properly segmented network architecture, maintained by professionals who remember when "backup" meant something physical you could hold in your hands, remains your best defense against all of this.
Stay skeptical out there. The emails will keep getting friendlier.
Original Report: https://thehackernews.com/2026/08/ransom-busters-claims-it-hacked.html