Ransomware consultant said he would decrypt data, is accused of paying ransoms instead
Summary
The owner of a ransomware remediation company, Zohar Pinhasi, faces wire fraud charges for allegedly defrauding clients. Pinhasi claimed to recover encrypted data without paying ransoms but is accused of actually paying cybercriminals and charging clients significantly more than the ransom amount.
IFF Assessment
This article reports on a ransomware remediation consultant who allegedly defrauded his clients, which is detrimental to the cybersecurity community and defenders.
Defender Context
This case highlights the importance of vetting third-party security service providers, as fraudulent actors can exploit victims' distress after a ransomware attack. Defenders should be aware that some "remediation" services might simply be intermediaries facilitating ransom payments, potentially even inflating costs, rather than offering genuine technical solutions.