The “Rescue” Was Another Ransom... Inside Ransom Busters

Full spoken transcript

Some ransomware victims are getting a second ransom demand disguised as a rescue from the first one.

GuidePoint Security says it's responded to several recent ransomware incidents where the victims received an unexpected email from a group calling itself Ransom Busters.

According to the message, Ransom Busters claimed to have returned the files and deleted every backup the ransomware group had made, all for the low, low price of twenty thousand to sixty thousand US dollars.

If the name Ransom Busters, or the fact that there’s no reliable way to verify every stolen copy was deleted isn’t enough to make you suspicious, there’s more.

Some of the companies being contacted hadn’t made the initial attack public yet. So the victims are being contacted before anyone outside the incident response team even knew what happened.

So imagine you’re running one of these companies. Your systems are down, your data’s been stolen, and everyone’s waiting for answers as to what happened.

Then a stranger shows up with accurate information that only someone connected with the attack would know, and offers to fix it all if you pay them. It’s basically just the same attack with a slightly different paint job.

It’s like if someone steals your car, and before you report it as stolen or tell anyone about it, a stranger shows up while you’re still standing in the parking lot looking at where your car was and says they broke into the thief’s garage.

They know your license plate number, and they know what you had sitting in the back seat. And they say they can return your car if you pay them a small fee.

Now, the fact that they know these details strongly suggests that they do have access to your car, but it shouldn’t prove that they’re your rescuer in this situation. It should make you wonder why they knew what your car was in the first place.

If the context alone wasn’t enough to suggest that the initial attack and Ransom Busters were connected, GuidePoint found some other similarities. The same reconnaissance tools were used across both incidents, the same attacker-controlled computer name was used, and the exact same unusually specific password was used when creating a backdoor account.

In short, the situation looks like criminals undercutting other criminals they’re working with and trying to call it customer service. There was never a guarantee your stolen data would be deleted if you pay, and you should have a healthy skepticism of your friendly neighborhood Good Samaritan.

That desperate moment where you think, maybe this can fix everything, connects really well to prospect theory. Similar to loss aversion, it reveals our willingness to gamble can change once we’re already facing a loss.

When we’re choosing between possible gains, we’re usually fairly cautious.

But once we’re already losing, a risky option can become more attractive because it keeps the hope alive that we can escape the loss completely.

In a 1979 experiment, ninety-five people were given a hypothetical choice. They could accept a guaranteed loss of three thousand dollars, or they could take an eighty percent chance of losing four thousand dollars with a twenty percent chance of losing nothing.

Ninety-two percent chose to gamble. And it does sound pretty good, right? You’re already facing a loss of three thousand dollars, and here’s this opportunity to lose nothing, even if you’re risking a high chance of a larger loss.

Now, choosing between two losses and making a hypothetical gamble in a study isn’t quite the same thing as running an organization during a ransomware attack. Real ransomware decisions involve employees, customers, legal obligations, insurance, and potentially millions of dollars. So there are a lot more variables on the table.

But the lesson here is still useful. Being in the middle of a loss can change what feels reasonable. The people that make the offer don’t necessarily need to feel trustworthy. They just have to offer something that feels like the last remaining path back to zero.

So the practical takeaway here isn’t that ransomware victims are irrational or that leaders need to find ways to improvise better decisions when the heat is on. It’s that you need to decide before the crisis: who’s allowed to communicate with the attackers and who verifies the recovery claims.

If an unexpected offer shows up, it should go directly to your incident response lead, legal counsel, or to law enforcement.

There should be a clear playbook on how these situations get handled.

The offer may be enticing. But there’s no guarantee of anything positive.

A small ransom is still a ransom, even when it’s wrapped up like a miracle way out.

So as always, stay mindful, stay resilient. Remember, sometimes a bad gamble can look good in the wrong light. And follow for more cyberpsychology breakdowns.