Scammers are using fake recovery services to target businesses before attacks become public
A cybercriminal group is posing as a data recovery firm and reaching out to victims of ransomware attacks—before those victims even know the attack has been made public. This group, operating under the name Ransom Busters, claims it can help decrypt files and delete stolen data for a fee. But cybersecurity experts say this is not a legitimate recovery service at all—it’s likely the same people who launched the attack in the first place.
This kind of behavior is extremely concerning. Victims may end up paying for a solution that doesn’t exist, or worse, paying a scammer who already has access to their data. The key takeaway: any third party offering to recover data during a cyberattack must be treated with extreme caution. And for small business owners, it's time to review your cyber risk insurance coverage now, just in case.
How the scam works and why it's so dangerous
Ransom Busters is using the same tools and methods as the ransomware attackers themselves. They're deploying tools that are commonly used in ransomware campaigns, such as a network scanner, a command-line utility, and a remote monitoring application. They also use the same backdoor passwords and computer names, which is a strong indicator that they are not an independent recovery service, but part of the attack chain.
The most alarming detail is the timing. These messages are sent before the attacks are made public. That means Ransom Busters must have inside knowledge of the attack—likely because they are the ones who caused it. This is extremely rare among legitimate recovery services and is a strong sign of fraud.
What to do if you're contacted by someone like Ransom Busters
If you're a business owner and you're contacted by someone claiming to offer data recovery after a cyberattack, do not respond directly. Instead, follow these steps:
- Reach out to your IT team or a cybersecurity professional before engaging with any third party. Verify the situation and what data may have been stolen or encrypted.
- Do not share sensitive information with unknown parties, including details about the attack or the amount of data taken.
- Report the contact to law enforcement or your cyber insurance provider before taking any action. This can help track patterns and prevent others from being targeted.
And remember: never pay a ransom or third party without verifying their legitimacy. Scammers already have access to your data, and paying them could lead to more leaks or follow-up attacks.
How to protect your business from ransomware and similar scams
Prevention is the best defense against ransomware and related scams. Here are a few practical steps to reduce your risk:
- Back up your data regularly and keep backups offline and secure. This ensures you can restore files without paying a ransom.
- Use strong passwords and multi-factor authentication to prevent unauthorized access to your systems.
- Keep your software and systems updated to protect against known vulnerabilities.
- Train your employees to recognize phishing attempts and other common attack methods.
Even with all these steps in place, no business is completely immune to cyberattacks. That’s why it’s important to evaluate your cyber insurance coverage now—before you need it. A policy can help cover the cost of data recovery, legal support, and business interruption in the event of a breach.
What your cyber insurance should cover in a situation like this
Cyber insurance is designed to protect small businesses from the financial fallout of a cyberattack. That includes coverage for ransom payments, data recovery, legal expenses, and more. But not all policies are the same—understanding what your coverage includes is critical. Specifically, you want to know whether your policy would respond to a situation where a third party has stolen data and is now attempting to monetize that breach.
If you're unsure about your current coverage, start your quote on CoRisk to see what options are available. You can compare policies from multiple carriers and choose one that fits your business’s specific needs and risk profile.
