Home / Cybersecurity / Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for…
Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000
thehackernews.com Aug 19, 2026

Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000

Curated by · TechCapsules ·

AI-summarised brief · reviewed before publication

A ransomware affiliate operating under the name Ransom Busters is proactively contacting victim organizations to offer data deletion services for fees between $20,000 and $60,000. The group claims to have breached ransomware-as-a-service servers, including those of DragonForce, Settra, and Anubis, to locate stolen data. GuidePoint Research and Intelligence Team identified this behavior as anomalous, noting that legitimate firms typically engage only after attacks become public. Evidence suggests Ransom Busters is likely a criminal actor rather than a legitimate third party, citing violations of the U.S. Computer Fraud Abuse Act. Investigators found striking similarities across incidents, including identical backdoor credentials and hostnames, indicating a single operator. The group argues that unpaid assistance would jeopardize their unauthorized access to criminal infrastructure. Experts warn victims against trusting these offers, as they represent deceptive tactics designed to extract additional extortion payments from organizations already suffering from cyberattacks.

💡 Why It Matters

  • · This scheme exploits victim desperation by masquerading as a rescue service, effectively doubling the financial burden on compromised organizations.
  • · It reveals how ransomware affiliates are monetizing their own illicit access to criminal infrastructure, turning the recovery process into a secondary extortion vector.
Capsules Cybersecurity
Read full article on thehackernews.com
More in Cybersecurity →
Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data
thehackernews.com · Aug 19

Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

A bespoke JavaServer Pages web shell, linked to the Clop ransomware group, was deployed after exploiting CVE‑2026‑12569 in PTC Windchill and FlexPLM servers. The shell decrypts all Windchill keystore credentials, maps the application’s file vault, and can execute arbitrary Java code via a custom class loader. It enables rapid lateral movement, data exfiltration, and persistence without additional tools, targeting engineering data and LDAP credentials that could compromise entire enterprise networks. The attack demonstrates a tailored, application‑specific threat model.

💡 The shell’s ability to harvest privileged credentials in one step turns a single PLM breach into a full‑network compromise, exposing sensitive product designs and corporate infrastructure. Its custom design bypasses traditional defenses, underscoring the need for targeted monitoring of critical PLM environments.

The Pokémon Company Cancels 30th Anniversary Card Orders Following ‘Cyber Incident,’ Warns of Customer Data Breach
ign.com · Aug 19

The Pokémon Company Cancels 30th Anniversary Card Orders Following ‘Cyber Incident,’ Warns…

The Pokémon Company has cancelled all 30th Anniversary Card orders linked to a cyber incident that exposed customer data. The breach involved CEVA, the logistics partner handling European shipments, and may have compromised names, addresses, phone numbers, emails, and order contents. Pokémon Center staff notified affected customers via email, explaining the data exposure. The company has not clarified why orders were cancelled or the extent of the impact, leaving many pre‑orders voided. The incident adds to ongoing concerns over card scarcity and scalping.

💡 The cancellation signals a severe breach of consumer trust, potentially eroding confidence in Pokémon’s digital sales channels. It also underscores the vulnerability of third‑party logistics in protecting personal data.

European Space Agency Confirms Server Breach
infosecurity-magazine.com · Aug 19

European Space Agency Confirms Server Breach

Europe’s space agency confirmed that hackers accessed servers outside its corporate network last month, compromising data used for unclassified collaborative engineering. ESA said a forensic analysis is underway and only a small number of external servers appear affected. The breach was first hinted at in a BreachForums post on Dec. 18, where a threat actor claimed to have exfiltrated over 200 GB, including private Bitbucket repositories, source code, CI/CD pipelines, API tokens, configuration files and hard‑coded credentials. ESA has informed stakeholders, secured potentially affected devices and will issue updates. Experts warn the stolen information could enable supply‑chain attacks, underscoring the growing attack surface of distributed space‑technology collaborations and the sector’s struggle to meet EU cybersecurity mandates and to protect future mission data.

💡 The incident proves that seemingly low‑value engineering data can serve as a gateway for deeper supply‑chain sabotage, compelling space agencies to tighten security around open‑collaboration frameworks.

Bybit Strengthens Security Defences Against Evolving Crypto Threats, Intercepting $700 Million in Potential User Losses
prnewswire.co.uk · Aug 19

Bybit Strengthens Security Defences Against Evolving Crypto Threats, Intercepting $700 Million in…

Bybit, the world’s second‑largest crypto exchange, released its H1 2026 Risk & Security Report detailing a multi‑layered defense upgrade after a February 2025 hack that stole roughly $1.46 billion. The new system combines user‑account safeguards, full‑coverage on‑chain monitoring and AI‑assisted threat detection to shorten detection‑to‑response times. In the first half of 2026 the platform blocked over 30,000 dubious withdrawal attempts, shielding nearly 20,000 users from more than $700 million in potential losses, with an average initial review of 4.7 minutes and 95 % completed within ten minutes. Bybit also flagged $212 million in suspicious on‑chain funds, blacklisted over 10,000 malicious addresses, and handled ten token‑project security incidents without any platform losses, often acting faster than rival exchanges.

💡 Bybit’s rapid, AI‑driven interception demonstrates that real‑time, data‑centric security can materially protect users and curb fraud in a market where billions are routinely targeted.

StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
thehackernews.com · Aug 19

StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal…

Check Point Research has uncovered a global cybercrime operation dubbed StopAndProtect that hijacks nearly 2,000 WordPress sites to deliver a multi‑component malware toolkit. The campaign begins with a ClickFix‑style social‑engineering prompt that triggers a PowerShell command, launching .NET downloaders and loaders which install ransomware, a SMB/USB worm, lock‑screen modules, a VBS spreader, a chat utility and credential stealers. The actors also exfiltrate files, screenshots and WhatsApp data, using a custom WordPress MU plugin that permits arbitrary file uploads and remote code execution. Researchers observed operational‑security mistakes that exposed infection logs and over 700 data archives, including internal development tools. Most compromised sites run outdated WordPress versions with dozens of known vulnerabilities, facilitating the fake CAPTCHA injection against unsuspecting visitors worldwide.

💡 By turning compromised blogs into a distributed malware delivery network, the attackers bypass traditional defenses and reach victims directly through trusted web traffic, dramatically widening the attack surface.

Web3 Platform Mixin Network Hit by $200m Crypto Hack
infosecurity-magazine.com · Aug 19

Web3 Platform Mixin Network Hit by $200m Crypto Hack

Hong Kong‑based decentralized finance project Mixin Network disclosed a cyber‑attack that compromised its cloud service provider’s database on September 23, 2023, resulting in the loss of roughly $200 million in cryptocurrency. The breach forced the platform to suspend deposit and withdrawal services while transfers remained operational, and Mixin enlisted Google and blockchain security firm SlowMist to investigate. Founder Feng Xiaodon addressed users in a live Mandarin briefing on September 25, outlining remediation steps, and the project later reported a $30 million drop in total value locked, according to DeFi Llama. Launched in 2017, Mixin’s XIN token supports cross‑chain transactions for about 10,000 DApps. The incident ranks as the fifth‑largest crypto hack outside exchanges, trailing incidents such as Ronin, Poly Network, BNB Bridge and Wormhole.

💡 The hack exposes the vulnerability of “decentralized” platforms that still depend on centralized cloud infrastructure, challenging the core security premise of Web3.