Fake Decryption Tools Masked $11M Markup in Ransomware Recovery Scheme

A ransomware recovery scheme involved paying ransoms to obtain decryption keys and then charging victims significantly more for remediation services. The markup in this scheme totaled $11M. Zohar Pinhasi was behind the scheme, which used fake decryption tools to facilitate the operation. The scheme relied on Pinhasi's ability to obtain decryption keys and then resell related services to victims at a substantial profit. This approach allowed Pinhasi to generate significant revenue from ransomware victims. The use of fake decryption tools was a key component of the scheme.