Cyber criminals arguing with each other sounds like good news. One ransomware group targeting another, threats flying back and forth, even public promises to “help” the victims caught in the middle. It almost feels like justice. It is not, and the reason why matters for every business.
Hi, I am Andy from Initial IT in Lichfield. We look after cyber security for small businesses across Staffordshire and the West Midlands, and this story is worth telling because it exposes the one rule that never changes: there is only one thing you can rely on cyber criminals for, and that is looking after themselves.
Key takeaways
- One ransomware group has been threatening a rival: exposing identities, leaking data, and offering to unlock files for the rival’s victims.
- However tempting that “help” sounds to a business locked out of its own data, there is no proof the group can deliver, and no obligation on them to honour anything.
- Criminal infighting does not change criminal motives. It is still about pressure, control and money, whoever the target is.
- Your recovery plan should never include trusting an attacker. The reliable path is tested backups, early-warning monitoring and a rehearsed response plan.
- All of that has to be in place before an attack. Decisions made under ransom pressure are the worst decisions a business ever makes.
What happens when ransomware groups turn on each other?
Recently, one ransomware group started publicly threatening another. They claimed they would expose the rival group’s identities, leak their data, and even offered to help the rival’s victims unlock their files.
If your business had been hit and someone credible-sounding appeared offering to undo the damage, it would be tempting. Desperate situations make almost any offer sound reasonable. That is precisely the moment to slow down.
Why you can never take a criminal’s offer of help
These groups do not operate with fairness or responsibility, even towards each other. When they fight, the motive does not change: pressure, control and profit. A group offering to unlock a rival’s victims is not performing a public service. It is scoring points and hunting opportunities.
There is no proof they can actually decrypt the files. And even if they could, you would be handing trust, and possibly money and access, to a criminal organisation with no obligation to follow through. It is like being caught between two scammers and hoping one of them is the honest one. That is not a position any business should be in.
What does the reliable path out actually look like?
When an attack happens, your options should never include trusting another attacker, no matter how convincing the offer or how desperate the situation. The only reliable path is proper protection in place before anything happens, and trusted people beside you when it does.
That means backups that are tested and genuinely restorable, not just ticked off. Monitoring that spots unusual activity early, while there is still time to act. And a clear, written plan for how your business responds if something gets through, so nobody is inventing a process at 2am under ransom pressure.
How do Staffordshire businesses prepare before it happens?
Stack the basics so an attack is survivable: multi-factor authentication everywhere, so one stolen password is not a disaster. Tested backups kept separate from the live network. Early-warning monitoring. Staff who know what a phishing email looks like. The National Cyber Security Centre’s small business guide is a good free benchmark.
And if the worst does happen, work with people whose job is to defend your business, not exploit it. That is what we do through our cyber security and IT support for firms across Lichfield and the West Midlands: the protections before, and the calm hands during.
Quick check: where does your business stand on cyber security?
The questions in our free 2-minute Cyber Security Health Check are the eleven we ask every new client first. Score yourself, see the per-category breakdown, and get the three highest-impact fixes for your specific gaps. No marketing list.
Take the 2-minute Cyber Security Health Check
If you are not completely confident your team would spot something like this, that is worth fixing before it is tested for real. We would far rather have a quiet word now than a difficult one later.
Frequently asked questions
Should we ever pay a ransom or negotiate with attackers?
Paying is a last resort with no guarantees: you are trusting criminals to keep a promise, funding the next attack, and possibly marking yourself as a payer. Take advice from your IT support provider, insurer and, where relevant, the police before any decision. The better answer is backups good enough that the question never has power over you.
A group claims it can unlock our files. Is that ever genuine?
Treat it as hostile, whoever they claim to be. There is rarely proof they hold working keys, and engaging tells criminals you are desperate, which invites further pressure. Route every recovery decision through your own IT support provider and insurer, never through anyone who contacts you unprompted.
What should the first hour after discovering an attack look like?
Isolate affected machines from the network but leave them powered on, call your IT support provider immediately, and start your incident plan. Change key passwords from a clean device, starting with email. Do not wipe anything, do not tidy up quietly, and do not respond to the attackers.
What protections actually make ransomware survivable?
Four things do most of the work: multi-factor authentication everywhere, backups that are tested and kept separate from the live network, monitoring that flags unusual activity early, and a written response plan people have actually rehearsed. That combination turns a catastrophe into a bad week.
– Andy Price, Founder & MD, Initial IT · 01543 524 594 · hello@initialit.co.uk