Ransomware Affiliate Poses as Recovery Service to Hijack Payments

A ransomware affiliate has been observed impersonating a legitimate incident-recovery firm in order to intercept and divert ransom payments from victims, according to researchers tracking the threat. The actor reportedly reaches out to organizations mid-incident with unsolicited offers of decryption assistance, exploitation services, and even legal counsel, presenting themselves as an independent consultancy willing to negotiate on the victim's behalf.

Security analysts note that the ruse is designed to exploit the chaos and urgency that follow a ransomware attack. By positioning itself as a trusted intermediary, the affiliate can manipulate negotiations, redirect payments to attacker-controlled cryptocurrency wallets, and in some cases deliver a second payload disguised as a recovery tool. The technique mirrors traditional double-extortion tactics but adds a layer of social engineering that makes it harder for victims and law enforcement to distinguish legitimate negotiators from adversaries.

The campaign underscores how threat actors are increasingly layering deception onto the ransomware model itself, rather than relying solely on encryption and data-leak threats. Victims are urged to independently verify any unsolicited recovery offer through trusted channels, and to use tools like the email breach checker to confirm whether communications originate from known-compromised domains. Organizations should also run a SSL/TLS checker against any portals the supposed recovery service provides, since impersonators frequently spin up look-alike websites with recently issued or self-signed certificates.

Defenders recommend a formal incident-response plan that includes pre-approved third-party contacts, avoiding the use of attacker-supplied channels for negotiation, and performing a comprehensive privacy checkup before sharing sensitive corporate details with any unsolicited party. The incident is a reminder that in ransomware cases, the threat does not end with the initial compromise — it can resurface through seemingly helpful hands.