Rogue affiliate poses as recovery firm to steal payments

A suspected ransomware affiliate posing as recovery service Ransom Busters contacts victims before attacks go public, offering decryption and data deletion for $20,000 to $60,000. GuidePoint Security's GRIT believes the group is the actual attacker, using access to steal ransom payments from ransomware gangs like DragonForce, Settra, and Anubis.