Organizations falling victim to ransomware look for any way to ensure they get their files back. One Belasurian businessman promises decryption but is merely conning victims out of more money.
You’ve just become the next victim of a ransomware attack. Your company policy is to not pay the ransom. Backups don’t appear to be able to get it done. So, you search on the web for anyone that can decrypt files… and stumble upon “Dr. Shifro” – a Russian-based business that claims to be the only company that specializes in decrypting files, urging users to call.
Anyone who knows anything about encryption knows you absolutely must have the private key to decrypt ransomed files. So, how does Dr. Shifro do it? Does he have a Cray supercomputer? Is the good doctor a specialist in encryption and has figured out a way to break RSA-1024 encryption?
Researchers at Check Point wondered “what if he just pays the ransom himself and makes a profit while doing it?” So, they setup a scenario where they played both sides of a scam – pretending to be both the cybercriminal and victim!
In the end, the researchers found that Dr. Shifro was simply acting as a mediator, asking the ransomware creator for a “discount” (from 0.2 BTC to 0.15 BTC in Check Point’s case), and applying a surcharge for his “service” (the equivalent of approximately $1000).
According to Check Point, Dr. Shifro has netted more than $375K in the last two years.
In the end, the assumption is Dr. Shifro does provide the decryption key, but organizations have wasted time and money, paying a middleman for services they could have done themselves.
Organizations shouldn't rely on third-party services, unless they are well-known reputable companies. The best way to avoid needing to pay for ransomware decryption is to avoid infection altogether. Security Awareness Training provides users with real-world training around social engineering tactics, scams, threat tactics, and more to elevate their overall sense of security when interacting with email and the web.
Find out how affordable new-school security awareness training is for your organization. Get a quote now.
