# Someone Already Knows You Were Hit — And They're Calling to "Help"
The ransom demand hasn't gone public. You haven't told your board yet. The attackers' countdown timer is ticking, your IR team is three hours deep into containment, and your phone rings. It's a company called Ransom Busters. They know about your incident. They say they can get your decryption keys and make the stolen data disappear — for a fee.
Here's the problem: they're the ones who hit you.
A suspected ransomware affiliate is running exactly this scheme, approaching victims in the window between infection and public disclosure, presenting themselves as a specialized recovery service. The operation — branded "Ransom Busters" with apparent deliberateness — exploits the most vulnerable moment in any ransomware incident: those first chaotic hours when organizations will grasp at anything that sounds like a way out.
## How the Double-Dip Works
The mechanics are worth understanding clearly because they reveal something important about who can actually run this scam.
To contact victims before an attack becomes public, you need to know about it before it becomes public. That's not a guess or a lucky coincidence — it requires either being the attacker directly, having a close relationship with the attacker, or sitting inside a threat actor's operational communications. In the ransomware-as-a-service ecosystem, the affiliate is exactly the kind of actor who would have this access: they handle the actual intrusions, they know the victim list, and they often interact with victims directly during negotiation anyway.
The scheme works by inserting a second revenue stream into an attack the affiliate was already running. The victim pays "Ransom Busters" for keys and data deletion. That money likely flows back to the affiliate — possibly at a markup over what the legitimate ransom demand would have been, or as an additional take on top of whatever the victim also pays to the group's official negotiation channel. In some configurations, the affiliate may never intend to get the victim genuine decryption keys at all.
The "we can delete your stolen data" claim is, independently, almost always false. No legitimate recovery firm guarantees data deletion — there's no technical mechanism to verify it, and ransomware groups routinely re-leak data even after receiving payment. Any outfit making that promise as a selling point is either lying or selling you a promise they have no ability to enforce.
## The Trust Vacuum That Makes This Possible
The legitimate ransomware recovery industry exists, but it operates in murky water that predators exploit.
Firms like Coveware, Arctic Wolf, and Mandiant's incident response arm provide real services — breach coaching, technical recovery, ransom negotiation with groups that actually deliver decryptors. But there's no licensing requirement to call yourself a ransomware recovery specialist. No certification. No regulatory body. Anyone can register a website and start calling breach victims.
This problem isn't new. ProPublica documented in 2019 how firms including MonsterCloud and Proven Data were telling clients they'd use "proprietary technology" to recover files while secretly just paying the ransom, pocketing the markup. That was embarrassing but legal-adjacent. Ransom Busters represents a harder criminal escalation: the "recovery firm" is itself the threat actor extracting a second payment.
The timing tells you what threat actors now understand about the incident response market: organizations in acute distress don't do vendor diligence. They're not going through a procurement process. They get a phone call that sounds credible, uses the right terminology, and knows details no outsider should know — and that last part, the insider knowledge, short-circuits the skepticism instinct. *How would they know if they weren't legitimate?*
## What Defenders Need to Change Right Now
The pre-incident answer is straightforward: vet your IR vendors before you need them. Have a retainer relationship with a firm whose credentials you've checked when the pressure's off. Law enforcement, your insurance carrier, and your legal counsel can all provide referrals to vetted organizations.
But the operational answer — what to do when a stranger calls claiming to know about your breach — is worth spelling out concretely:
Never engage an unsolicited recovery contact. Legitimate incident response firms don't cold-call breach victims. If someone contacts you claiming to know about an ongoing incident, treat that call as part of the threat, not relief from it.
Verify against known-good contact information. If a firm name is given, hang up and find contact information independently — not from a website the caller sends you, not from a number they provide. Search independently and call back.
Report the contact to law enforcement immediately. The FBI's IC3, CISA, and relevant sector-specific agencies want to know about these approaches. This is active intelligence that helps map the affiliate's victim list.
Assume your incident data is already in attacker hands. If an unsolicited caller knows details about your breach, your initial containment assessment needs to widen. The insider knowledge isn't magic — it's evidence of scope.
## HackWire Analysis
The Ransom Busters operation is a tell about where ransomware affiliate economics are headed, and the tell is uncomfortable.
For years, the working model held that affiliates were parasitic but predictable: compromise a network, exfiltrate data, encrypt, demand payment, deliver decryptor. The ransom was the exit. This scheme breaks that model by treating the victim as a resource to be extracted from twice — and it only works because the affiliate is positioned inside the attack lifecycle in a way that outside parties cannot replicate.
This is, structurally, a laundering of attacker access into fake legitimacy. The same insider knowledge that proves the "recovery firm" is a fraud is also what makes victims believe it's real. That's a genuinely clever trap.
The broader implication: as ransomware groups face increasing law enforcement pressure and victim organizations get better at not paying, affiliates are improvising secondary revenue. We saw this with the shift toward data extortion without encryption. We're now seeing it with fake recovery as a parallel business line. Expect more variation, not less — the affiliate layer of the ransomware ecosystem is entrepreneurial and adaptive.
For CISOs and legal teams: the pre-breach vendor vetting process needs to include an explicit question — *who contacts us if we're breached, and how?* If you can't answer that before an incident, you're a candidate for exactly this play. The attacker is betting you'll be too disoriented to think clearly. The counter is to have already thought clearly before they call.
One more thing other coverage is skimming past: the data deletion promise isn't just a lie. Offering to "delete stolen data" for payment is, in several jurisdictions, a criminal act in itself — a form of extortion or theft by deception layered on top of the underlying ransomware crime. If law enforcement gets there, affiliates running this scheme face compounding charges. That won't stop them. But it should inform how organizations report these contacts.
— HackWire Editorial
---