Ask who pays the ransom before you hire a recovery firm

· · Security

The worst time to choose a supplier is the morning your files will not open. Nothing works, the phones are ringing, and a search for "ransomware recovery" returns a page of firms promising to get your data back without paying criminals a penny.

That promise is the one to be careful of. In early October US prosecutors charged the owner of one such firm with fraud, and the allegations are a useful guide to what you are buying when you hire help in a hurry.

What prosecutors allege

MonsterCloud is a Florida company that advertised ransomware recovery using "proprietary tools" and "advanced decryption techniques". Its owner, Zohar Pinhasi, has been charged with wire fraud and conspiracy, according to the US Department of Justice. He has pleaded not guilty, and nothing here has been tested in court.

The allegation is simple. Prosecutors say the firm had no such tools. It contacted the attackers, paid them for the unlocking key, used the key, and presented the result as its own work. The Register's report picks out the detail that matters to anyone holding the invoice. In one case the firm allegedly paid a ransom of about $8,200 and charged the client about $150,000. In another it paid about $236,000 and charged about $380,000. Across the scheme, prosecutors say clients were billed more than $19 million while more than $8 million went to the criminals.

The indictment quotes Mr Pinhasi answering a question from one of his own paid spokespeople in 2019: "MonsterCloud doesn't hold any proprietary technology [to] decrypt the ransomware data."

Why the claim should make you suspicious

Modern ransomware scrambles files with the same kind of mathematics that protects online banking. Without the attacker's key there is usually no way back. The exceptions are real but narrow: sometimes criminals make a mistake, and sometimes police seize their servers and publish the keys. When that happens the unlocking tools are given away free.

So a firm that says it can routinely decrypt files without paying is describing something that mostly does not exist. Either it means "we will restore you from your backups", which is honest work and worth paying for, or it means something it would rather not say.

This matters for more than the bill. If a ransom is paid on your behalf without your knowledge, you have funded criminals without deciding to. Your insurer may not have agreed to it. Paying certain groups can be unlawful if they are under sanctions, which is a question for your lawyer and not for a contractor acting in secret. The National Cyber Security Centre and the Information Commissioner's Office have said plainly that paying a ransom will not be viewed as mitigation if the regulator later looks at what happened. And if nobody tells you how the attackers got in, the way in is still open.

What to ask before you sign

  • Will you contact the attackers, and will you pay them? You want a yes or a no in writing. Negotiating with criminals is sometimes part of a legitimate response. Doing it without telling the client is not.
  • If files are recovered, how? From backups, from a publicly released key, or from a key bought from the attacker. A firm that will not say is telling you something.
  • What is your fee, separately from any payment to anyone else? Ask for the two to be itemised.
  • Will you find out how they got in? Recovery without that is a repair with the door left open.
  • Who do you work for? Ask whether your insurer knows the firm, and whether it appears on a recognised scheme.

Line the help up before you need it

The better answer is not to be searching at all.

  • Ring your insurer first. Most policies that cover this name an incident response firm and a phone number. Using somebody else can put the claim at risk. Find the number today and keep it somewhere that is not on the network.
  • Know the recognised list. The National Cyber Security Centre runs an assured incident response scheme. Firms on it have been checked against a published standard, which is more than a search result can tell you.
  • Report it. In the UK that means Report Fraud, and the Information Commissioner's Office within 72 hours if personal data is involved.
  • Test a restore. A backup you have successfully restored from is the only thing that reliably makes the ransom question go away.

How Steelwise can help

Deciding who you would call, what your insurer expects, and whether your backups would hold is a short piece of security advisory work best done on a quiet day. Get in touch.

Further reading

← All filings

We use cookies to understand how visitors use this site. More information.