Ransomware crook poses as recovery firm to steal payments from fellow extortionists

1. Executive summary

GuidePoint Security assesses with moderate confidence that “Ransom Busters” is a ransomware affiliate impersonating a recovery provider to divert payments from victims already targeted through ransomware-as-a-service operations. Across two investigated incidents, GuidePoint reported the same reconnaissance, remote-management and exfiltration tools, local-account password and attacker-controlled hostname before victims received recovery offers of USD 20,000–60,000. For EMEA financial institutions, the principal risk is a second-stage fraud during an active ransomware response: the sender may possess stolen data or encryption material, but payment provides no assurance of recovery or deletion. Attribution to Ransom Busters and links to DragonForce, Settra and Anubis remain unconfirmed; none has a MITRE ATT&CK profile in the verified reference data. This is a campaign report rather than a vulnerability advisory: no CVE is identified, so CVSS score/severity and CISA KEV exploitation state are not applicable.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

The reporting establishes the following activity. It does not provide timestamps sufficient to determine the exact order of the post-compromise tooling in steps 2–5.

1. Initial compromise and ransomware impact: The victims had suffered ransomware incidents involving encrypted files and stolen data. The initial-access vector, exploited product, affected versions and ransomware payload are not disclosed. No CVE is identified; CVSS severity and CISA KEV exploitation state are therefore not applicable.
2. Network reconnaissance: SoftPerfect Network Scanner was used in both investigated environments. The source does not identify scanned address ranges, ports, protocols, credentials or discovered systems.
3. Remote-management deployment: The attacker installed the Remotely remote-management tool using PowerShell. No installation command, binary path, service name, scheduled task, server address or authentication configuration is available. Installation could provide continued remote access, but the precise persistence and command-and-control mechanism is not reported.
4. Backdoor account creation: A local account was created in both environments using the password Numlock!123. The username, group membership and privilege level are not disclosed, so administrative access or privilege escalation should not be assumed without local evidence.
5. Data exfiltration: The attacker used s5cmd to transfer data into AWS cloud storage. The destination account, storage location, network endpoint, credentials, file paths, data volume and file types are not reported. GuidePoint stated that Ransom Busters subsequently demonstrated access to the same datasets held by the ransomware affiliate.
6. Recovery-provider impersonation: Before the ransomware incidents became public, victims received unsolicited emails from Ransom Busters. The sender claimed to have compromised the ransomware operators, located the victims’ data on their infrastructure and obtained the ability to delete it and recover encryption keys.
7. Attempted payment diversion: Ransom Busters offered purported deletion and recovery services for USD 20,000–60,000, below the original extortion demand. The reporting supports an attempted diversion of payment from other ransomware operators; it does not confirm that any victim paid, received a working key or obtained verifiable data deletion.

No lateral-movement method, privilege-escalation mechanism, encryption command, malware filename, registry key, persistence service, external command-and-control infrastructure or specific network protocol is provided.

GuidePoint reportedly observed the common toolset, password and hostname across incidents connected during its investigations to DragonForce, Settra and Anubis. Its conclusion that one affiliate was operating across multiple RaaS programmes and defrauding its partners is a moderate-confidence assessment, not confirmed attribution. None of the four named actors has a MITRE ATT&CK profile in the verified data. The forensic account is ultimately single-sourced to GuidePoint through secondary reporting; verify before enforcement.

4. Mitigation & containment

P1 — within 24 hours

• Treat unsolicited recovery outreach containing non-public incident details as potentially attacker-controlled. Do not pay, execute supplied files, follow supplied links or grant access. Preserve the complete message, headers, attachments and payment instructions.
• If DESKTOP-BBETH6K or Numlock!123 appears in endpoint, identity or remote-access telemetry, activate incident response and isolate the associated systems. DESKTOP-BBETH6K is a local hostname, not a reported Internet domain.
• Identify the local account associated with Numlock!123, preserve creation and usage evidence, then disable the confirmed account. Reset credentials exposed on affected systems and invalidate active sessions.
• Locate unauthorized Remotely installations. Preserve configuration and execution evidence, revoke remote access, remove the deployment and block reinstallation through application control.
• Hunt for SoftPerfect Network Scanner, s5cmd and Remotely on the same systems or under the same identities. These are dual-use tools; require contextual correlation before containment.
• Review process, PowerShell, proxy and network telemetry for s5cmd transfers. Block confirmed attacker-controlled AWS storage destinations and terminate continuing transfers; do not block AWS services indiscriminately.
• Validate any recovery proposal through an independently sourced contact channel. Require cryptographic or operational proof of key validity and independently verifiable deletion evidence; the source reports no assurance that payment results in deletion.
• No patch or version pin is available because no vulnerable product or CVE is identified.

P2 — within 72 hours

• Scope all endpoints accessible to the compromised identities for the reported hostname, password, tool execution and local-account creation.
• Establish the deployment method and configuration of Remotely, including any remaining components, access tokens, server settings and accounts found through local forensic evidence.
• Determine the AWS destinations, transfer times, affected files and data volume associated with s5cmd. Preserve cloud, proxy and endpoint records before retention periods expire.
• Compare material demonstrated by the purported recovery provider with confirmed stolen datasets without sending additional sensitive samples.
• Review accounts created or modified during the intrusion window and validate their group membership, login history and remote-access activity.
• Use independently retained incident-response counsel and providers; do not accept a provider selected through the unsolicited approach.

P3 — within seven days

• Restrict SoftPerfect Network Scanner, s5cmd, Remotely and equivalent dual-use tooling to approved administrators and managed deployment channels.
• Alert on PowerShell-driven remote-management installation, anomalous local-account creation and bulk transfers to unapproved cloud-storage destinations.
• Add recovery-provider impersonation and payment diversion to ransomware playbooks. Require out-of-band identity verification and dual approval for extortion-related payments or recovery engagements.
• Exercise restoration from trusted backups independently of any attacker-provided key and document the evidence required to validate claimed data deletion.
• Retrospectively review recent ransomware incidents for comparable pre-public recovery solicitations.

5. Indicators of compromise

The atomic indicators below were reported across two GuidePoint investigations. They are single-sourced; verify before enforcement.

hostname  DESKTOP-BBETH6K
password  Numlock!123

Behavioural indicators

6. Detection

The YARA rule is intended for scripts, text artefacts and memory-derived material. It requires the reported backdoor password plus another reported artefact to reduce matches against unrelated use.

rule Suspicious_Affiliate_Intrusion_Artifacts_Aug2026
{
    meta:
        author = "Adverse Trace"
        date = "2026-08-20"
        reference = "https://www.theregister.com/cyber-crime/2026/08/20/ransomware-crook-poses-as-recovery-firm-to-steal-payments-from-fellow-extortionists/5290344"
        description = "Detects a reported backdoor password combined with associated intrusion artefacts"

    strings:
        $password = "Numlock!123" ascii wide
        $hostname = "DESKTOP-BBETH6K" ascii wide
        $scanner = "SoftPerfect Network Scanner" ascii wide nocase
        $transfer = "s5cmd" ascii wide
        $remote = "Remotely" ascii wide

    condition:
        $password and 1 of ($hostname, $scanner, $transfer, $remote)
}

The following experimental Sigma rule detects command-line exposure of the reported password or the reported PowerShell/Remotely installation combination.

title: Reported Backdoor Password or PowerShell Remotely Installation
status: experimental
description: Detects process command lines matching artefacts reported across two ransomware incidents
author: Adverse Trace
date: 2026-08-20
references:

  - https://www.theregister.com/cyber-crime/2026/08/20/ransomware-crook-poses-as-recovery-firm-to-steal-payments-from-fellow-extortionists/5290344
logsource:
  product: windows
  category: process_creation
detection:
  selection_password:
    CommandLine|contains: 'Numlock!123'
  selection_remote_install:
    CommandLine|contains|all:

      - 'PowerShell'
      - 'Remotely'
  condition: selection_password or selection_remote_install
level: medium

Both rules rely on a single underlying forensic source and can match copied reporting or legitimate Remotely administration. Correlate with local-account creation, the reported hostname, reconnaissance activity and s5cmd execution before enforcement.

7. Sources

• The Register, “Ransomware crook poses as recovery firm to steal payments from fellow extortionists,” 2026-08-20.
• Dark Reading, “‘Ransom Busters’: Ransomware Actor Poses as Incident-Recovery Service,” date not stated in supplied material.
• DataBreaches.net, “Beware the Ransomware Rescuer: Ransom Busters,” 2026-08-19.

8. Adverse Trace position

Adverse Trace assesses this as a credible and operationally significant post-compromise fraud pattern, but not as confirmed actor attribution. No standalone numerical severity is assigned: the supplied evidence does not establish campaign scale, successful payments or a technical initial-access mechanism, and no CVE, CVSS severity or CISA KEV exploitation state applies. Receipt of a matching pre-public solicitation or detection of the reported password and hostname should be handled at P1 because it may indicate an existing ransomware compromise and data theft; otherwise this is a threat-hunting and response-integrity priority. The Ransom Busters, DragonForce, Settra and Anubis associations remain unconfirmed because none has a MITRE ATT&CK profile in the verified data, while the technical evidence remains single-sourced; verify before enforcement. Adverse Trace will monitor for primary forensic publication, independently corroborated incidents, validated sender infrastructure, destination details and malware artefacts.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.