← Back to articles

Fake Decryption Tools Used in $11M Ransomware Scam

Zohar Pinhasi ran a scheme that sold bogus decryption tools, charging victims far more than the ransom they had already paid to obtain real keys. The operation added an estimated $11 million in markup to the cost of ransomware recovery. The victims were individuals and small businesses whose data had been encrypted by ransomware. After paying the attackers for the original decryption keys, they were directed to Pinhasi’s service, which claimed to provide a “complete recovery package.” In reality, the tools offered did not contain functional code and the fees charged were many times higher than the original ransom. The scam worked by exploiting the desperation of victims who had already lost access to critical files. Pinhasi presented himself as a trusted recovery specialist, using professional‑looking websites and email communications to appear legitimate. By promising a quick fix, he convinced victims to hand over additional payments, often via wire transfer or cryptocurrency, which are difficult to trace. To avoid falling for similar schemes, do not trust any third‑party service that offers decryption after you have already paid the attackers.  Use reputable anti‑malware software to scan any downloaded files and keep regular, offline backups of important data. If you are hit by ransomware, report the incident to law enforcement and consult a certified cyber‑security professional before paying any ransom. A practical step you can take right now is to create a fresh backup of your most important files on an external drive that is not constantly connected to your computer. This simple habit can protect you from data loss and reduce the leverage attackers have over you. Source: Read the original report