A suspected ransomware affiliate is posing as a ransomware recovery service called "Ransom Busters," contacting the victims before the attacks become public and claiming to be able to provide decryption keys and delete stolen data for a fee. [...]
Rogue ransomware affiliate poses as recovery firm to steal payments
Summary + source link. No paywalls, no tracking.