Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000

A threat actor calling itself Ransom Busters is offering to delete stolen ransomware data from servers in exchange for a payment, ranging from $20,000 to $60,000. GuidePoint Research and Intelligence Team (GRIT) has identified this tactic as part of a larger campaign orchestrated by UNC6671, a persistent adversary targeting financial services and other industries since April. The group uses sophisticated techniques like a custom console (Work Panel) and phishing templates to steal credentials and conduct reconnaissance. Ransom Busters’ actions are part of a broader trend of ransomware groups shifting towards pre-positioned access operations and abusing trusted enterprise infrastructure. Recent data indicates a significant increase in ransom payments, driven by large data exfiltration incidents.