[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmO313Cz1V5cz3EkjvcnjLPJUyy30BQOq4QGD2JFwL_s":3},{"article":4,"iocs":36},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":21,"category":22,"article_tags":25},"f2f2e4ae-9d1c-4e1c-b914-517796a9253f","'Ransom Busters': Ransomware Actor Poses as Incident-Recovery Service","ransom-busters-ransomware-actor-poses-as-incident-recovery-service-1f616d","A ransomware affiliate appears to be sidling up to victims with offers of aid, masking its true intention of diverting ransom payments.","A ransomware affiliate, operating under the guise of 'Ransom Busters,' is attempting to deceive victims into believing they are an incident recovery service. This tactic aims to trick victims into paying the ransom to the affiliate instead of the actual ransomware group, thereby diverting funds and potentially compromising the recovery process.","Ransomware actor poses as an incident recovery service to divert victim payments.",null,"https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fransom-busters-ransomware-actor-incident-recovery-service","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fbltd51dac9db97608a9\u002F6a83674527cfd1d34eec915a\u002FRansomware_encryption-AndreyPopov-GettyImages-2225634481.jpg?width=720&quality=80&disable=upscale","2026-08-18T13:00:00+00:00","2026-08-18T14:00:19.372667+00:00",7,[18],{"name":19,"type":20},"Ransom Busters","threat_actor","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":21,"icon":11,"name":23,"slug":24},"Ransomware","ransomware",[26,31],{"category":27},{"id":28,"icon":11,"name":29,"slug":30},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":32},{"id":33,"icon":11,"name":34,"slug":35},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[]]