Ransom Busters as a rogue ransomware affiliate posing as a recovery middleman
Threat Actor Meta
Summary
Hide ▲
Show ▼
Ransom Busters has emerged as a suspected rogue ransomware affiliate posing as a recovery service, creating a criminal middleman layer that can siphon ransom payments and complicate RaaS negotiations. The activity raises the risk that victims may be misled before an attack becomes public and that paying one party will not prevent data leakage by others with access. Researchers linked the behavior to overlapping tradecraft across multiple ransomware-as-a-service operations and said the actor appears to exploit its access for profit outside normal affiliate sharing.
Related Happenings
Ransom Busters rogue ransomware middleman skims payments across RaaS operations
Threat Actor Meta
H score19
First: 19.08.2026 23:59
Last: 19.08.2026 23:59
Sources 1
About this happening:
Researchers identified Ransom Busters as a suspected ransomware middleman that contacts victims before attacks are public, offering decryption and data-deletion help while...
Ransom Busters rogue ransomware middleman skims payments across RaaS operations
Threat Actor MetaAbout this happening: Researchers identified Ransom Busters as a suspected ransomware middleman that contacts victims before attacks are public, offering decryption and data-deletion help while...
The Gentlemen ransomware gang's affiliate-driven rise to most-active RaaS operator
Threat Actor Meta
H score36
First: 17.07.2026 12:00
Last: 17.07.2026 12:00
Sources 1
About this happening:
The Gentlemen ransomware gang became the most-active ransomware-as-a-service operator over a three-month period, overtaking Qilin with 300 incidents. Its rise...
The Gentlemen ransomware gang's affiliate-driven rise to most-active RaaS operator
Threat Actor MetaAbout this happening: The Gentlemen ransomware gang became the most-active ransomware-as-a-service operator over a three-month period, overtaking Qilin with 300 incidents. Its rise...
The Gentlemen ransomware group’s 90/10 RaaS model and rapid victim growth
Threat Actor Meta
H score26
First: 10.06.2026 17:03
Last: 10.06.2026 17:03
Sources 1
About this happening:
The Gentlemen ransomware group has become a high-volume RaaS operation, using a 90/10 affiliate split to attract operators and expand its reach. The group now ranks as...
The Gentlemen ransomware group’s 90/10 RaaS model and rapid victim growth
Threat Actor MetaAbout this happening: The Gentlemen ransomware group has become a high-volume RaaS operation, using a 90/10 affiliate split to attract operators and expand its reach. The group now ranks as...
The Gentlemen RaaS split exposed by hastalamuerte
Threat Actor Meta
H score25
First: 19.03.2026 18:00
Last: 19.03.2026 18:00
Sources 1
About this happening:
hastalamuerte exposed the internal workings of The Gentlemen ransomware group, revealing a Qilin-related RaaS split that shows how affiliate-driven ecosystems can rapi...
The Gentlemen RaaS split exposed by hastalamuerte
Threat Actor MetaAbout this happening: hastalamuerte exposed the internal workings of The Gentlemen ransomware group, revealing a Qilin-related RaaS split that shows how affiliate-driven ecosystems can rapi...
Latest development: 17.07.2026 12:00
ReliaQuest reported that The Gentlemen ransomware gang became the most active ransomware group over a three-month period, with 300 incidents and 1,368 victim claims tracked across 11 ransomware groups. The analysis said The Gentlemen overtook Qilin, which had 289 incidents, and linked the rise to aggressive affiliate recruitment, a pre-packaged intrusion kit, and AI-accelerated development.
2025 Ransomware trend toward built-in Windows tooling and lower ransom payment rates
Trend
H score32
First: 17.03.2026 23:41
Last: 17.03.2026 23:41
Sources 1
About this happening:
Ransomware operators are increasingly leaning on built-in Windows tooling while ransom payment rates continue to decline across 2025, weakening extortion returns f...
2025 Ransomware trend toward built-in Windows tooling and lower ransom payment rates
TrendAbout this happening: Ransomware operators are increasingly leaning on built-in Windows tooling while ransom payment rates continue to decline across 2025, weakening extortion returns f...
Timeline
-
19.08.2026 23:59 2 articles · 2h ago
Ransom Busters poses as a recovery service to target ransomware victims
Initial DisclosureRansom Busters impersonated a recovery service and emailed ransomware victims before attacks became public, claiming it could provide decryption keys and delete stolen data for a fee. GRIT said the activity followed several recent ransomware attacks and, based on two incidents, assessed that Ransom Busters was likely a single ransomware affiliate using overlapping tradecraft across multiple RaaS operations, including SoftPerfect Network Scanner, s5cmd, Remotely, the password `Numlock!123`, and the hostname `DESKTOP-BBETH6K`.
Show sources
- Rogue ransomware affiliate poses as recovery firm to steal payments — www.bleepingcomputer.com — 19.08.2026 23:59
- Rogue ransomware affiliate poses as recovery firm to steal payments — www.bleepingcomputer.com — 19.08.2026 23:59