A criminal is selling deletions nobody can check

The offer with no receipt

Someone calling itself Ransom Busters has been emailing companies that were just hit by ransomware [1]. The pitch sounds like help. It says it broke into the servers of several ransomware gangs, found your stolen files there, and will delete them and destroy the gangs’ backups. The price is $20,000 to $60,000 [2].

Ransomware is malware that scrambles your files and demands payment to unscramble them. Modern gangs also copy the files out first, so they can threaten to publish them even if you restore from backup.

GuidePoint Security’s research team, GRIT, ran into Ransom Busters while responding to real incidents involving the DragonForce, Settra and Anubis gangs [1]. Several things did not add up. The emails arrived before the attacks were public knowledge. Legitimate recovery firms make contact after a breach is disclosed [1]. The sender claimed to have been breaking into criminal admin panels for over three years [2]. Asked why it charged, it said working for free would put its access at risk [2].

Then GRIT compared its own case notes from two separate intrusions. The same scanning tool. The same method of copying data out to cloud storage. A local back-door account with the same password, “Numlock!123”. The same attacker machine name, DESKTOP-BBETH6K, in both [2]. GRIT concluded with moderate confidence that Ransom Busters is not an outside researcher at all. It is one freelance criminal who rents ransomware from several gangs, quietly diverting payments away from the gangs he works for [1].

The important part is what a victim can and cannot check. Stolen files get copied between people. A single member of a gang rarely controls every copy. So, as GRIT put it, victims have little ability to verify claims that data has actually been deleted [1]. Justin Timothy of GuidePoint was blunter: payment to any criminal party offers no guarantee that stolen data will be deleted [2].

There is no receipt for a deletion. That is the whole trick.

When the record itself is the target

A different version of the same problem ran through this week’s flaws.

Broadcom disclosed a critical hole in VMware vCenter on 29 July, rated 9.8 out of 10 [3]. vCenter is the console that runs a company’s virtual machines. The specific piece with the hole is the syslog server: the machine that collects the logs, the running written record of what every other machine did [3]. German incident-response firm QUIRSO found the flaw under attack at 361 internet addresses across 47 countries, most heavily in the US, France, Iran and Turkey [4][5]. It traced the activity to a single suspected state-backed group [4].

Patching may not be enough. The attacker leaves behind a hidden back channel out to itself, using an open-source tool called reverse_ssh, and that channel survives the update [3][4]. QUIRSO’s Denis Szadkowski told Dark Reading the access persists even after the software is fixed, and recommended going back through the records to rule out an existing compromise [4].

GitLab shipped an emergency patch on 17 August, outside its normal schedule, for a flaw rated 9.4 [6]. Under some conditions it let a stranger with no account and no password remotely change or delete public projects and user data [6]. Only self-managed installations are affected; GitLab’s own hosted service was already patched [6].

And a new self-spreading worm called ChainDrop poisoned 444 packages on npm, the shared library of building blocks JavaScript programmers pull code from [7]. Microsoft and others named it on 4 August. The packages it hit are downloaded roughly two billion times a month [7]. What is notable is how it spreads: through packaged archives and developer-tool hooks that leave little trace in the matching source repository [7]. The published code looked clean. The thing people actually installed was not.

Elsewhere: attackers began probing an unpatched GeoServer flaw within hours of a researcher posting it publicly [8]. WatchTowr has logged hundreds of attempts from a small number of addresses. There is still no fix available [9]. CISA, the US cyber-defence agency, gave federal agencies three days to fix a flaw in Ray, rather than the usual fourteen [10]. Ray is an open-source tool used by Amazon, Apple and OpenAI to run large computing jobs [11]. And the Dutch national cyber centre warned that a patched macOS Screen Sharing flaw is being used on internet-exposed Macs to install a crypto-mining program [33].

What a year of records can say, and where they stop

CISA, the FBI and the US health department updated their advisory on the Medusa ransomware gang on Tuesday [12][13]. It is built on a year of ongoing FBI investigations. Medusa’s confirmed victim count rose from more than 300 in March 2025 to more than 500 as of April 2026 [13]. The gang buys its way in from access brokers, paying between $100 and $1 million [13]. It uses newly announced flaws within 24 hours, and has been seen using some up to a week before they were publicly disclosed [12]. Healthcare is its most frequent target [13].

None of that is guesswork. It is what a year of case files adds up to.

The security firm Reco could say the same about a campaign it calls City-Forum, after a domain tied to the attacker’s address [14]. It has been quietly pulling data out of misconfigured Salesforce and ServiceNow portals since at least March 2025 [14]. The attacker built their own tools for interfaces that are barely documented anywhere [14]. Reco recorded more than 560,000 attacks worldwide [15]. Targets spanned telecoms, banks, enterprise software and public-sector portals [14].

Then the gap. A seller using the name TheHatman is advertising employee records taken from the Microsoft cloud accounts of nine large companies [17]. The claimed haul includes 1.7 million records from McDonald’s, 800,000 from Tata Consultancy Services and 425,000 from Vodafone [16]. Hudson Rock assessed the samples as highly likely authentic [16]. But it could not establish how the attacker got in [16]. The records reportedly include job titles, reporting lines and which accounts hold top administrator rights, which is a ready-made target list [16].

Authentic data. No record of the way in.

The week’s breaches

France’s tax authority, the DGFiP, confirmed late on a Thursday that an attacker viewed and copied data on individuals and businesses [18]. The access happened in late June, and was detected and cut off in late June [18]. It only became public when the hacker claimed it this month [18]. A hacker using the alias ZeroBytes claimed data on more than 600,000 people; the authority now puts the figure at 680,000 [18][19].

Poland is investigating a breach at MyDr, which supplies software to more than 12,000 clinics and doctors and connects them to the national health platform [20]. Up to 19 million people may be affected. Officials say attackers reached historical records held through April 2024 [20]. As a precaution, the country’s e-Health Centre is replacing the digital certificates medical systems use to connect [20].

RingCentral, a business phone and messaging platform, says 1.6 million people had names, addresses, emails and phone numbers stolen in July [21]. It blames a social engineering campaign: tricking a person rather than picking a lock [22]. The stolen data has since been published [21].

Heights Finance, a consumer lender across five US states, is notifying customers of a breach discovered in early May [23]. Names, Social Security numbers, bank account details and driver’s licence numbers were taken from a third-party cloud platform [24]. The two published counts differ because they measure different things: the company told Texas regulators that 734,828 people were affected, while its wider notification covers more than 1.2 million [23][24].

Crypto hardware wallet maker SafePal says a flaw in an order-tracking add-on exposed the details of 39,798 customers, and emailed them on 16 August [25]. It says no wallet keys, recovery phrases or payment card numbers were involved [25].

The Ceva Logistics attack keeps widening. Eight European warehouses were disrupted from 29 July [26]. Pokemon Center is now telling customers in the UK and Germany that their order details were taken, because it had shared them with Ceva to ship the orders [27]. Valve told Steam hardware customers the same thing [27].

The University of Texas at San Antonio, which serves 40,000 students, took phones and other systems offline after spotting hostile activity over the weekend [28][29]. Chief technology officer Michael Schnabel said it was caught at the edge of the network and contained before reaching core systems [28]. He also said the investigation has found no evidence that university data was accessed or copied out [28]. Classes started Wednesday; payment deadlines were pushed to Friday [28].

And Fortra’s research team confirmed that the extortion group ExfilSquad really does hold what it claims [30]. The published files ran to 382.64 GB and about 27 million records across 13 victims, released on 7 August [30]. The named victims include the City of Atlanta and the UK Department for Education [30]. That is what verification looks like when it is possible.

Two more numbers from the LiteLLM supply-chain attack landed this week. CloudSEK and Hudson Rock put the damage at more than 2,500 organisations and over 430,000 build pipelines [32]. All of it came from a 40-minute window in March, when poisoned versions sat in the official Python package repository [31]. Hudson Rock analysed a 195-terabyte file of what came out [31].

A new set of hands

President Trump signed a memo on 12 August directing his administration to use the private sector to help conduct cyber operations against foreign criminal organisations [34]. The White House says the work would be done “under the direction, control, and authority of the U.S. Government” [34]. The memo authorises limited operations at the government’s direction, not open-ended freedom for companies to hack [35]. It still hands the private sector a role long reserved for government agencies [35].

Which raises the question this whole week keeps asking: when several parties can act, and each keeps its own account of what it did, whose record settles what happened?