The email arrived before anyone outside knew there had been an incident. Only someone who has been inside knows that.
On 18 August, GuidePoint's research team (GRIT) described something it had been seeing across several recent incident responses: on top of the usual ransom note, the victim was getting a second email. Not from the group that had encrypted them, but from a third party introducing itself as Ransom Busters LTD and offering to get them out of the mess.
What the email says
The wording GRIT quotes opens like this: "I am a representative of a project that assists victims of cyberattacks. We have been identifying vulnerabilities and infiltrating the servers of criminal groups for over three years." Then comes the offer: it claims to have got into the ransomware operation's admin panels, to have found your company's stolen data there, and to be willing to delete it — and hand over the key — for somewhere between $20,000 and $60,000.
GRIT did the obvious thing with a claim like that: it asked. And when questioned, Ransom Busters confirmed access to the same stolen dataset the affiliate behind the intrusion held. Its own word, not an independent verification — but it fits everything else.
And on the forensic side, the same fingerprints repeating across the incidents GuidePoint's forensics team worked: SoftPerfect Network Scanner for internal reconnaissance, s5cmd to move data out to AWS storage, the Remotely remote management tool deployed via PowerShell, a local backdoor account created with the password Numlock!123, and always the same attacker machine name, DESKTOP-BBETH6K. Activity tied to three different operations: DragonForce, Settra and Anubis.
GRIT's conclusion, in its own words and with its own hedge — "with moderate confidence" — is that Ransom Busters is neither a vigilante nor a researcher: it is a single affiliate working across several ransomware operations at once who, having access to the data, decided to charge on the side and cut out the gang supplying the malware. An employee skimming the till.
What changes everything is the date on the email
Vultures circling a ransomware victim is not new, and it's worth saying so rather than selling this as unheard of. In 2019, Emsisoft researcher Fabian Wosar posed as a client and stung a Scottish data recovery firm; ProPublica published it that June. While telling the fake client it was "running tests" to unlock the files, the firm was negotiating the ransom directly with the attacker, before invoicing $3,950 — four times the agreed ransom. Ugly and expensive, but it was a middleman, and the client came looking for it.
Not here. Here the victims got the email before the incident was public. There's no list to pull you from, no leak site that just posted you, no reporter who broke it. There is only one way to know that this particular company was encrypted on this particular day: having been inside it.
Which is why the email isn't an offer. It's evidence. If it arrives before anything is public, it is confirming two things you may still have been arguing about internally: that exfiltration actually happened, and that whoever did it still has the data to hand.
It targets the person, not the system
Look at who the email asks to speak to: the CEO, or whoever runs IT. Not the response team, not the security mailbox. And it lands early, when you still don't know the blast radius, when you've been on your feet for hours, and when what you want most in the world is for this to be over today and to stay in-house. It is written for that state of mind. No technical control stops it, because it attacks no system and exploits no software: it comes in through ordinary email, and the only thing it exploits is the exhaustion of the person deciding.
The practical effect is worse than it looks: it opens a second negotiation running in parallel with the first, with someone accountable to nobody — not even to the gang they work for — and with neither side inside your company knowing about the other. If two different people in your company are each talking to a different counterparty, you are no longer managing one incident: you are managing two.
The first-morning protocol
This isn't improvised on the day, because on the day nobody is in any state to write procedures. It's half an hour of meeting on an ordinary Tuesday. What we'd put in writing with a client before it's needed:
- ✓A channel outside the perimeter, agreed in advance. If corporate email may be compromised, it is not where you coordinate the response. A group somewhere else, with personal mobile numbers written down on paper. It sounds crude; paper is the one thing that doesn't get encrypted.
- ✓One single external spokesperson, named. Written down before the incident. Anything arriving from a stranger goes to that person and is answered from nowhere else. That's what prevents the parallel negotiation.
- ✓You don't reply "just to see what they say". Replying confirms three things for free: the mailbox is live, there's a frightened person behind it, and there is room to talk money. GRIT recommends treating these offers with serious scepticism and passing them to the response team; we'd put it more bluntly: there is no cheap curiosity in the middle of an incident.
- ✓Forward it with full headers and record the exact time it arrived. It is timeline data. If the email landed before the ransom note, or before anything was known outside, that pins down the exfiltration window better than a lot of logs do.
- ✓The decision to pay is not made by whoever receives the email. Ever. It belongs to the board, with legal counsel and the insurer if there is one, and with the fact on the table of whether you can restore without them. Paying for your data to be "deleted" is buying a promise with nothing behind it: GRIT says it plainly — payment to any criminal party offers no guarantee the stolen data will be deleted — and there is no way to audit a deletion that happens on a criminal's computer.
What this protocol does NOT save you from
None of the five points above would have prevented the intrusion, and none of them decrypts a single file. A communications protocol brings order to a horrible morning; it doesn't cancel it. If you reach the day of the email unable to rebuild on your own, you have exactly the same bad options you had, slightly better organised.
What decides whether a ransom is a negotiation or a formality is whether you can rebuild the house without them. We already wrote about this in the case of the Romanian land registry whose backups were wiped too: the word that matters is "immutable", not "daily". And the other side of the same coin is having an RTO and an RPO that were actually calculated, because when someone asks you for $60,000 for a promise, the only sound answer is knowing what it costs you not to pay it.
A second caveat, this one about the indicators. The password Numlock!123 and the machine name DESKTOP-BBETH6K are useful for looking backwards through your logs: if they show up, you're having a very different conversation this afternoon. They are not a defence. Changing a machine name takes thirty seconds, and whoever reused it across those incidents will have changed it by now. What is stable is the pattern in between — a network scanner, a remote management tool nobody installed, and a new local account — which is exactly what a managed service is supposed to catch while it happens. We already wrote about how an EDR gets switched off with a plain reboot into safe mode: the reconnaissance phase is the window where you still can.
When this isn't about you
If your company already has an incident response team on retainer, a tested crisis communications plan and someone who knows what to do with an email like this, this article doesn't give you much: you forward it, you carry on, done. Telling you otherwise would be selling you smoke. The problem is that this isn't the case for most companies of the size we work with, where the crisis plan is one person picking up the phone at three in the morning and deciding alone.
What you do with tomorrow's email
Time of arrival, full headers, one spokesperson, and the decision where it belongs. That is everything you have to do with it on the day it lands. Someone inside the chain that attacked you has your data in front of them and has decided to charge for it twice, and their email is telling you so for free. And save the important conversation for another day, a quiet one, when the question is how long it takes you to rebuild the house without them.
Sources: the wording of the emails, the $20,000–$60,000 figures, the forensic indicators (SoftPerfect Network Scanner, s5cmd, Remotely, the password Numlock!123 and the machine name DESKTOP-BBETH6K), the operations involved (DragonForce, Settra, Anubis), the "moderate confidence" assessment and the advice to victims — "Beware the Ransomware Rescuer: Ransom Busters", GuidePoint Security (GRIT), 18 Aug 2026, by Justin Timothy; confirmation that the emails arrived before the incidents were public — BleepingComputer and The Hacker News; the 2019 case of the recovery firm that negotiated the ransom and billed four times the agreed amount — the Fabian Wosar sting (Emsisoft), published by ProPublica on 24 June 2019.
Who picks up the phone at your company at three in the morning?
At everyWAN we provide 24x7 IT support and build the disaster recovery plan that turns an email like this into a forward and little else. Half an hour of meeting now is worth more than anything we can do on the day — and if what you already have is fine, we'll tell you so.
Talk to everyWAN
Microsoft 365
ES 
CAT 
EN