'Ransom Busters': Ransomware Actor Poses as Incident-Recovery Service

A ransomware affiliate is posing as an incident-recovery service to deceive victims. The group's true intention is to redirect ransom payments, rather than actually providing assistance. This tactic allows the affiliate to manipulate victims and potentially gain financially from the situation. The approach is a new twist on traditional ransomware attacks, where attackers typically demand payment directly from victims. By masquerading as a recovery service, the affiliate can build trust with victims and increase the chances of receiving a ransom payment. This method highlights the evolving nature of ransomware attacks and the need for caution when seeking help after a cyber incident.