Ransomware victims choose recovery partners at the exact moment they cannot judge one

A customer allegedly paid around US$150,000 to recover encrypted files. US prosecutors say the recovery firm had paid the attacker roughly US$8,200 for the decryption key in August 2023.

That gap is at the centre of a wire fraud case reported by TechBarrista on 10 October. The owner of Florida-based MonsterCloud faces charges over an alleged scheme in which clients were told his firm could decrypt ransomware without paying criminals, while behind the scenes it allegedly paid those same criminals for keys and billed customers substantially more. The charges are allegations and the accused is presumed innocent.

A provider chosen under duress is a supplier you have not vetted

The immediate lesson seems obvious: vet your recovery provider. But vetting is exactly what a ransomware incident destroys. Systems are inaccessible, customers and employees want answers, attackers may have imposed payment deadlines, and the decision often lands on a single administrator who has never bought incident response before. A plausible website, a claim of proprietary decryption technology and a recovery guarantee can all stand in for due diligence when the clock is running.

The indictment alleges that MonsterCloud told clients it could recover files using advanced decryption methods, and that the owner later admitted privately the firm lacked proprietary decryption technology. That is a distinction unlikely to surface mid-incident. The alleged economics make the point: one approximately US$8,200 ransom payment became a customer bill of around US$150,000. In another example, a payment of around US$236,000 became a bill of approximately US$380,000. Across the relevant period, prosecutors allege more than US$19 million was collected and more than US$8 million passed to attackers.

If the allegations hold, customers thought they were paying for independent recovery. Prosecutors say they were paying an intermediary to negotiate with the same criminals who had encrypted their systems. The post-incident market places a desperate buyer in front of suppliers who know more about the buyer's position than the buyer knows about them. That asymmetry is an attack surface in its own right.

The indictment also alleges that recovery was presented as a fix without remediating the underlying access. That matters beyond fraud. Decryption alone leaves the original route open, so the same attackers can walk back in. A credible response has to include investigation and containment alongside restoration.

The decision that belongs in peacetime

For an organisation without a standing security operations rota, the incident plan often stops at the sentence about calling someone. In a board paper that reads as prudent. During an incident it means the largest recovery-related spend is being decided by the person with the least headroom, at the moment they are least able to compare options. The source's own advice is to ask a list of questions before signing an emergency agreement. Most of those questions cannot be reliably answered under emergency conditions.

A retainer changes the sequence. Terms are pre-negotiated, response times are set, and the provider has already been tested against questions about whether it pays attackers, how it recovers files, and what its invoices will contain. An incident response retainer is the one procurement decision made while you can still walk away. It turns a pressured purchase into a pre-agreed arrangement with named contacts, a tested call path and an agreed way of working. The first call stops being a search engine query at three in the morning.

Questions to put in writing before the pressure starts

Ask whether the provider ever pays or contacts attackers, and who authorises a payment. Ask how recovery would work if there is no decryptor from the attacker. Ask what the quoted fee includes and how third-party costs pass through. Ask whether the response covers investigation and containment as well as decryption. Ask these now, when a refusal to answer is simply a reason to choose someone else. During an incident, silence is just another pressure.

Where NIS2 or DORA applies, the required response plans and contact protocols are easier to meet when terms already exist. What applies depends on sector and size; framework mapping can help identify which obligations touch incident response, but it is a starting point rather than legal advice.

The alleged US$150,000 figure is best read as the price of a procurement decision made after the leverage had shifted. The gap between the ransom payment and the customer bill will keep appearing wherever an incident plan names no one in advance. The retainer's quiet advantage is that the decision happens while you can still ask questions and expect answers.