The ransomware crisis is escalating, and a bombshell report from ProPublica exposes a disturbing reality: many companies offering to “rescue” victims from ransomware attacks are simply paying the hackers. Firms like Proven Data and MonsterCloud promise advanced data recovery solutions but often secure decryption keys by negotiating with cybercriminals, then charge victims steep fees for their efforts. This practice not only fuels the ransomware economy but also raises serious ethical concerns about transparency and accountability.Coveware, a cybersecurity firm tracking ransomware trends, reports that the average ransom demand jumped 89% from $6,733 in Q4 2018 to $12,762 in Q1 2019. This spike is driven by sophisticated ransomware like Ryuk and Bitpaymer, which target large organizations and cause significant disruption. Coveware notes that downtime from these attacks increased from 6.2 days in Q4 2018 to 7.3 days in Q1 2019, pushing desperate companies to seek quick solutions. For many, paying the ransom seems like the fastest way to get back online, even if it means funding criminal enterprises.ProPublica’s investigation revealed that Proven Data, which markets itself as a high-tech recovery specialist, often pays hackers for decryption tools rather than using proprietary methods. Internal emails, former clients, and an FBI affidavit obtained by ProPublica confirm this practice. Similarly, MonsterCloud, a Florida-based firm, claims to use unique recovery techniques but frequently pays ransoms—sometimes without disclosing this to clients, including law enforcement agencies. Both companies charge substantial fees on top of the ransom, profiting from victims’ distress. They also offer services like securing systems against future attacks, but their use of pseudonyms for employees adds a layer of opacity that undermines trust.Despite efforts to curb ransomware, such as the U.S. indictment of two Iranian hackers behind the SamSam strain, attacks have surged beyond 2018 levels. Coveware’s CEO, Bill Siegel, explains that ransomware is highly lucrative, attracting hackers who often live in jurisdictions beyond Western law enforcement’s reach. These individuals, Siegel suggests, are often skilled but lack legitimate economic opportunities, viewing cybercrime as a low-risk venture. Coveware itself negotiates with hackers, arguing it’s the most effective way to recover data quickly. However, this approach risks funding criminal networks, including potential terrorist groups, and complicates efforts to combat cybercrime.The ransomware landscape is growing more complex, with new variants requiring increasingly sophisticated decryption methods. While researchers develop free tools for strains like WannaCry, many victims rely on firms like MonsterCloud, which emphasizes its cybersecurity expertise. MonsterCloud’s Zohar Pinhasi claims the company uses advanced techniques and offers a money-back guarantee, but its lack of transparency about paying ransoms is troubling. As ransomware attacks worsen, businesses face a grim choice: pay up and perpetuate the problem, or endure costly downtime. Without stronger global enforcement and better cybersecurity practices, the cycle of ransomware and profiteering will only intensify.
