TLDR
A US CEO running a ransomware remediation firm has been criminally charged with allegedly defrauding victims: prosecutors say he secretly paid the attackers for decryption keys, then billed clients as if he had used his own proprietary...
How it works
A US CEO running a ransomware remediation firm has been criminally charged with allegedly defrauding victims: prosecutors say he secretly paid the attackers for decryption keys, then billed clients as if he had used his own proprietary...
Red flags
- Vendor insists it has a "proprietary decryptor" but cannot demonstrate it on a test file. No technical logs, screenshots, or step by step recovery notes are ever shared. Quote is unusually high and payment is rushed before any proof of recovery. What to do Demand a written recovery plan, evidence of techniques used, and itemised billing. Verify the firm's reputation through independent reviews and law enforcement references (e.g. FBI, NoMoreRansom). Never pay the "recovery" fee before you have access to your data and can confirm it is intact
What to do
- 1Verify the firm's reputation through independent reviews and law enforcement references (e.g.
- 2Never pay the "recovery" fee before you have access to your data and can confirm it is intact.
Source
bleepingcomputer
Source reviewed by Mythos Forensic Team
https://www.bleepingcomputer.com/news/security/ransomware-recovery-ceo-charged-over-secret-ransom-payments/FAQ
Is Ransomware recovery CEO charged for secretly paying attackers and lying about proprietary decryptors a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Vendor insists it has a "proprietary decryptor" but cannot demonstrate it on a test file. No technical logs, screenshots, or step by step recovery notes are ever shared. Quote is unusually high and payment is rushed before any proof of recovery. What to do Demand a written recovery plan, evidence of techniques used, and itemised billing. Verify the firm's reputation through independent reviews and law enforcement references (e.g. FBI, NoMoreRansom). Never pay the "recovery" fee before you have access to your data and can confirm it is intact
What should I do first?
Verify the firm's reputation through independent reviews and law enforcement references (e.g.; Never pay the "recovery" fee before you have access to your data and can confirm it is intact.
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.