Ransomware Recovery Firm Caught Wanting to Pay Off Hacker

(Photo credit should read Rob Engelaar/AFP/Getty Images)

Be careful around companies that charge to recover a computer from a ransomware attack. A sting operation has uncovered evidence that one such ransomware recovery provider in the UK has simply been paying off the hackers to release the computers — and then charging clients to pay an inflated fee.

The provider, Red Mosquito Data Recovery, specializes in rescuing machines infected with ransomware and has earned rave reviews from thankful clients. The company’s website also claims it’ll offer customers “honest advice” on dealing with ransomware attacks.

However, Red Mosquito is now facing accusations that it’s business model is a sham, according to ProPublica. A security researcher at antivirus provider Emsisoft went undercover, using email accounts that posed as both the victim and the hacker behind a ransomware attack. He then contacted Red Mosquito as a victim looking for help on freeing a server hit by a dummy ransomware strain he created.

“I don’t have any backups but I do not want to pay those a**holes,” the researcher Fabian Wosar wrote in his emails to Red Mosquito, which were shared with PCMag.

Red Mosquito responded by telling Wosar it was “very confident” the company could recover the server files encrypted in the attack. However, the email evidence shows Red Mosquito contacted the hacker behind the attack only two minutes later with a message that read “How much for decrypt?”

As the hacker, Wosar initially demanded $1,200 in Bitcoin in exchange for the decryption key, but Red Mosquito wanted to pay only $500. In response, Wosar wrote: “$900. Take it or kiss data bye bye. We don’t run chairity [sic] here.”

The next morning, a Red Mosquito representative sent a message to Wosar’s victim email account, saying, “I am pleased to confirm that we can recover your encrypted files.” The cost: $3,950, or more than four times the original ransom fee.

So far, Red Mosquito hasn’t responded to Emsisoft’s sting operation. But the practice of IT security firms paying off ransomware hackers may be more widespread than previously thought. Last month, ProPublica published a report about two companies that’ve regularly made the payments to the attackers while charging victims extra.

Paying off the hackers is problematic because it incentivizes them to strike again. The FBI estimates ransomware attacks led to $3.6 million in losses last year.

According to Emsisoft, some of these ransomware recovery providers are also extracting fees from customers when they’ve used free tools to release victim computers from the infections. Emsisoft is among the antivirus providers that offers no-cost ransomware decryption tools, which anyone can download. Other free tools can be found on the Nomoreransom.org site.

“There’re some legit (ransomware recovery) companies that provide a valuable service,” an Emsisoft spokesperson told PCMag in an email. “It can be useful to have someone guide you though the process, but you need to be careful who you work with and ensure they’re transparent as to what their processes are.”