Learn
archived
Ransom Busters Charges Victims Up to $60K to Delete Stolen Data
- Engineer — Learn: No technical vulnerability or patch action here, but engineers involved in ransomware IR should know secondary extortion schemes like this exist and treat unsolicited ‘data deletion’ offers as suspect.
- SOC/IR — Learn: No IOCs or detectable TTPs are provided, but IR analysts should add this pattern to their ransomware playbooks — unsolicited emails from third parties claiming server access during an active incident are a red flag to escalate, not engage.
- Leader — Learn: If the organization is ever a ransomware victim, communications teams should know that secondary fee-based offers to delete stolen data are likely scams; worth a brief mention in IR tabletop exercises and vendor-communications guidance.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.