Ransomware crook poses as recovery firm to steal payments from fellow extortionists
- ID
- 16060
- Status
- summarized
- Published
- 20 Aug 2026, 10:27 PM
- Fetched
- 20 Aug 2026, 10:43 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/cyber-crime/2026/08/20/ransomware-crook-poses-as-recovery-firm-to-steal-payments-from-fellow-extortionists/5290344
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 2.0
- Created
- 20 Aug 2026, 10:44 PM
- Tags
- Audience
- developers
What happened
GuidePoint Security researchers identified a ransomware affiliate operating across multiple ransomware-as-a-service programs (DragonForce, Settra, Anubis) that contacted victims posing as a recovery firm called 'Ransom Busters,' offering to delete stolen data and recover files for $20,000-$60,000. Forensic evidence linked the 'recovery' outfit to the original attackers through shared tooling (SoftPerfect Network Scanner, s5cmd, Remotely via PowerShell), an identical backdoor password ('Numlock!123'), and the same attacker hostname ('DESKTOP-BBETH6K').
Why it matters
No direct impact for builders shipping AI/ML, agents, or SaaS. The only practical signal is forensic: if you investigate incidents, shared fingerprints like identical backdoor passwords and hostnames across separate intrusions can reveal a single affiliate working across multiple RaaS programs rather than distinct threat actors.
Discussion angle
Brief mention only: how attackers reusing the same backdoor password and hostname across jobs is the kind of operational sloppiness that incident responders can exploit to map affiliate activity across multiple ransomware gangs.