FAKE RECOVERY FIRM TARGETS RANSOMWARE VICTIMS

The fraudulent operation targets organizations already compromised by ransomware, exploiting their desperation to recover encrypted files and prevent stolen data leaks. How the scam works: The fake "Ransom Busters" service reaches out to victims proactively, before ransom demands become known to the public. They claim to possess decryption keys and the ability to delete stolen data, charging a fee for these services. The risk: Victims paying the imposter gain neither decryption keys nor data deletion. The scheme compounds initial ransomware damage with financial losses and may inadvertently fund criminal activity. Response: Security researchers recommend victims verify recovery services through independent channels before payment. Legitimate cybersecurity firms typically do not initiate unsolicited contact regarding specific attacks. Organizations hit by ransomware should engage established incident response providers and law enforcement rather than contact suspicious recovery services.