Fake 'Ransom Busters': Ransomware Gang Poses as Recovery Experts to Steal Payments

A newly observed tactic sees a ransomware affiliate approaching victims not as attackers, but as helpful third-party recovery specialists offering to negotiate or resolve the incident on their behalf. In reality, this 'assistance' is a disguise that allows the criminal group to redirect ransom payments back to itself, effectively double-dipping on the same attack while appearing to act as a trusted intermediary.

This approach exploits the confusion and urgency that follow a ransomware incident, when business owners are often scrambling to find help and may not have the expertise to verify who they're really dealing with. Because the fake 'recovery service' has intimate knowledge of the attack, it can appear highly credible, making it harder for victims to distinguish genuine support from a continuation of the extortion scheme.

For small and medium businesses, this development underscores the importance of only working with verified, reputable incident response providers following a cyberattack. Engaging unknown parties, even those who seem to have inside knowledge of your breach, can compound the damage and lead to further financial loss.