TL;DR: If things got real and a cyber criminal offered to help undo the damage another one caused, would you take them up on it? Two ransomware groups have been feuding publicly, and one has offered to help the other's victims recover their files. It sounds like an opening. It isn't. Criminal organisations have no obligation to keep any promise, and businesses that get caught relying on one for help are gambling with their recovery. The only thing that actually protects you is proper security before an attack happens: active monitoring, tested backups, and a plan you've already rehearsed.
If things got real and a cyber criminal offered to help undo the damage another one caused, would you take them up on it?
That's exactly the position some businesses have found themselves in recently. Two ransomware gangs have been feuding publicly, threats flying back and forth, one accusing the other. From the outside it looks almost entertaining, criminals doing some of the fighting for you.
Then one of them offers to help the other's victims unlock their files, and that's where it stops being entertaining and starts being a genuine risk to any business caught in the middle.
The offer isn't what it looks like
If your business has already been hit and someone claiming to be from a rival gang says they can get your data back, the instinct to take that seriously is understandable. You want your files. Someone is offering a shortcut.
But there's no proof that offer is real, and no way to hold anyone to it if it isn't. You'd be trusting a criminal organisation to follow through on a promise made in the middle of a turf war, with a business that isn't theirs and files that were never meant to be a bargaining chip in someone else's dispute.
Want to know more?
Why not book a free 15-minute conversation with us?
No obligation, no jargon - just our team and your questions.
Nothing about their motivation changes
Ransomware groups don't operate on fairness, and a public falling-out doesn't change that. Whether they're attacking a business or attacking each other, the goal is the same: leverage, pressure, and money. A rival gang offering to "help" isn't suddenly acting in your interest. It's still acting in its own.
Being caught between two criminal groups and hoping one of them is the trustworthy one isn't a position any business should be in, and it's not one you can plan your way out of once you're already there.
What actually protects you
The only real answer here is the boring one: put the right protections in place before you need them.
That means 24/7/365 monitoring that flags unusual activity early enough to act on it. It means backups that are tested regularly and genuinely accessible, not just backed up in theory. And it means having a response plan written down and rehearsed, so decisions during an attack aren't being made from scratch under pressure.
If the worst happens, the people helping you recover should be the ones whose job is to defend your business, not a criminal group with a story about why this time is different.
So, would you trust a hacker to help you? The decisions made in the first hours of a cyber attack tend to set the direction for everything that follows. If you're not confident your business would respond well, that's worth fixing now rather than during an actual incident. Get in touch and we'll help you put a proper plan together.