Skip to main content

New ransomware scam will take your money, and your files

(Image credit: Image Credit: The Digital Artist / Pixabay)
Audio player loading…

New research from Check Point has revealed a new ransomware business model where companies claim to legitimately unlock encrypted files, but instead simply act as a broker between the attacker and the victim.

The cybersecurity firm's researchers discovered a Russian IT consultancy named Dr. Shifro that claims it is capable of unlocking files scrambled by the Dharma/Crisis ransomware. 

However, no decryption key is currently available for this strain of ransomware which led Check Point to investigate further.

They found that Dr. Shifro was actually contacting the ransomware's creator themselves and negotiating a deal to unlock the victim's files in return for the ransom payment. The Russian IT consultancy then passes that cost on to the victim along with their own fee which means that the victims actually end up paying twice.

Ransomware broker

Correspondence between Dr. Shifro and a ransomware creator was found that revealed that Dr. Shifro's is actually a broker between the victim and attacker:

“I’m an intermediary. We redeem keys for clients since 2015 on a regular basis. Send bitcoins tight, don’t ask dumb questions. Clients frequently addressed under recommendation. Could you give a discount to 0.15 btc?” 

From 2015 to the present, Dr. Shifro is estimated to have completed over 300 ransomware decryptions for customers. Typically customers pay an additional $1,000 on top of the ransom to unlock their files.

Dr. Shifro's business model could easily be replicated by other cybercriminals and it serves as a new development of the ransomware industry that both consumers and businesses should be aware of.

After getting his start at ITProPortal while living in South Korea, Anthony now writes about cybersecurity, web hosting, cloud services, VPNs and software for TechRadar Pro. In addition to writing the news, he also edits and uploads reviews and features and tests numerous VPNs from his home in Houston, Texas. Recently, Anthony has taken a closer look at standing desks, office chairs and all sorts of other work from home essentials. When not working, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.