Filed under: Cybersecurity — Ransomware Scams — August 2026

What happened

Security researchers uncovered a scam where a ransomware affiliate poses as a data-recovery company called “Ransom Busters.” After attacks tied to gangs like DragonForce, Settra, and Anubis, victims are contacted before the breach is even public, with an offer to retrieve stolen files and destroy the criminals’ copies of the data for $20,000 to $60,000. Investigators found the same “recovery firm” used the exact same hacking tools and backdoor passwords as the original attackers — it isn’t a rescue service, it’s the same crew running a second scam on the same victims.

Why it matters to your business

If your Phoenix business ever gets hit by ransomware, the instinct is to grab any lifeline that promises to make the problem disappear. This scam is built to exploit exactly that panic, tacking a second extortion payment onto the first with no real guarantee anything gets deleted. Because the outreach arrives before news of the breach has spread, it can look unsettlingly credible — which is what makes it work.

What to do this week

Decide now, before any incident, that ransomware response goes through a pre-agreed plan — not through whoever emails you first. If you ever experience a breach: don’t negotiate directly, loop in law enforcement (FBI IC3), and call your IT provider or incident response contact before responding to anyone claiming they can “recover” or “delete” stolen data for a fee. Never trust a recovery offer that shows up before you’ve publicly confirmed an incident, and never engage through any contact channel tied to the attack itself.

The bigger picture

Ransomware crews are now running secondary extortion rackets against their own victims, which means the financial and psychological pressure after a breach isn’t a one-time event — it can keep coming from unexpected directions. — Rogue ransomware affiliate poses as recovery firm to steal payments

Want a response plan in place before you ever need one? Book a free consult — https://micro1tech.com/contact/