Ransom Busters rogue ransomware middleman skims payments across RaaS operations
Threat Actor Meta
Summary
Hide ▲
Show ▼
Researchers identified Ransom Busters as a suspected ransomware middleman that contacts victims before attacks are public, offering decryption and data-deletion help while potentially diverting ransom payments across multiple RaaS operations. The pattern raises payment integrity and trust risks for both victims and ransomware crews by inserting a rogue affiliate into the extortion chain. Evidence ties the activity to outreach around DragonForce, Settra, and Anubis, with claimed deletion prices of $20,000-$60,000.
Related Happenings
Ransom Busters as a rogue ransomware affiliate posing as a recovery middleman
Threat Actor Meta
H score19
First: 19.08.2026 23:59
Last: 19.08.2026 23:59
Sources 1
About this happening:
Ransom Busters has emerged as a suspected rogue ransomware affiliate posing as a recovery service, creating a criminal middleman layer that can siphon ransom payments...
Ransom Busters as a rogue ransomware affiliate posing as a recovery middleman
Threat Actor MetaAbout this happening: Ransom Busters has emerged as a suspected rogue ransomware affiliate posing as a recovery service, creating a criminal middleman layer that can siphon ransom payments...
The Gentlemen ransomware group’s 90/10 RaaS model and rapid victim growth
Threat Actor Meta
H score26
First: 10.06.2026 17:03
Last: 10.06.2026 17:03
Sources 1
About this happening:
The Gentlemen ransomware group has become a high-volume RaaS operation, using a 90/10 affiliate split to attract operators and expand its reach. The group now ranks as...
The Gentlemen ransomware group’s 90/10 RaaS model and rapid victim growth
Threat Actor MetaAbout this happening: The Gentlemen ransomware group has become a high-volume RaaS operation, using a 90/10 affiliate split to attract operators and expand its reach. The group now ranks as...
The Gentlemen RaaS split exposed by hastalamuerte
Threat Actor Meta
H score25
First: 19.03.2026 18:00
Last: 19.03.2026 18:00
Sources 1
About this happening:
hastalamuerte exposed the internal workings of The Gentlemen ransomware group, revealing a Qilin-related RaaS split that shows how affiliate-driven ecosystems can rapi...
The Gentlemen RaaS split exposed by hastalamuerte
Threat Actor MetaAbout this happening: hastalamuerte exposed the internal workings of The Gentlemen ransomware group, revealing a Qilin-related RaaS split that shows how affiliate-driven ecosystems can rapi...
Latest development: 17.07.2026 12:00
ReliaQuest reported that The Gentlemen ransomware gang became the most active ransomware group over a three-month period, with 300 incidents and 1,368 victim claims tracked across 11 ransomware groups. The analysis said The Gentlemen overtook Qilin, which had 289 incidents, and linked the rise to aggressive affiliate recruitment, a pre-packaged intrusion kit, and AI-accelerated development.
Ransomware victim payment rates fall to record low as claimed attacks rise
Trend
H score61
First: 26.02.2026 16:00
Last: 26.02.2026 16:00
Sources 1
About this happening:
Ransomware victim payment rates fell to 28% last year, a record low, even as claimed attacks rose 50% year over year, signaling a widening gap between attack volume and re...
Ransomware victim payment rates fall to record low as claimed attacks rise
TrendAbout this happening: Ransomware victim payment rates fell to 28% last year, a record low, even as claimed attacks rose 50% year over year, signaling a widening gap between attack volume and re...
DragonForce shifts ransomware-as-a-service into a cartel-style affiliate umbrella
Threat Actor Meta
H score38
First: 05.02.2026 00:14
Last: 05.02.2026 00:14
Sources 1
About this happening:
DragonForce has shifted into a cartel-style ransomware-as-a-service model, letting affiliates launch their own brands while sharing a common umbrella. That change expands...
DragonForce shifts ransomware-as-a-service into a cartel-style affiliate umbrella
Threat Actor MetaAbout this happening: DragonForce has shifted into a cartel-style ransomware-as-a-service model, letting affiliates launch their own brands while sharing a common umbrella. That change expands...
Timeline
-
19.08.2026 23:59 2 articles · 1h ago
Ransom Busters poses as a recovery service to skim ransomware payments
Initial DisclosureGuidePoint Security GRIT disclosed a suspected ransomware affiliate called Ransom Busters after recent incidents in which victims received emails before their attacks became public. The group claimed it could exploit vulnerabilities in ransomware-as-a-service administrative panels to obtain decryption keys and stolen data, then offered to delete data from DragonForce, Settra, and Anubis servers for $20,000-$60,000. GRIT tied the activity to overlapping use of SoftPerfect Network Scanner, s5cmd, Remotely, the password 'Numlock!123', and the hostname 'DESKTOP-BBETH6K', and assessed with moderate confidence that Ransom Busters is a single affiliate trying to divert ransom payments across multiple RaaS operations.
Show sources
- Rogue ransomware affiliate poses as data recovery firm to steal payments — www.bleepingcomputer.com — 19.08.2026 23:59
- Rogue ransomware affiliate poses as data recovery firm to steal payments — www.bleepingcomputer.com — 19.08.2026 23:59