Ransomware fixer claimed he could decrypt files, allegedly defrauded clients instead
Summary
Federal authorities are accusing a ransomware "fixer" of defrauding clients by charging them more for decryption services than the actual ransom amounts. The individual allegedly pocketed the difference after claiming to negotiate and pay the ransoms on behalf of victims.
IFF Assessment
FOE
This article describes a case where an individual exploited ransomware victims for personal gain, acting as a threat actor rather than a defender.
Defender Context
This case highlights a fraudulent scheme that preys on victims of ransomware attacks. Defenders should be aware of such scams and advise victims to seek legitimate incident response services rather than trusting individuals offering dubious 'fixer' services.