According to SecurityWeek, a scheme involving fake decryption tools resulted in an $11 million markup in ransomware recovery. Zohar Pinhasi allegedly paid ransoms to obtain decryption keys, then charged victims significantly more for remediation.
The report describes how the recovery services were presented as legitimate decryption tools, masking the underlying ransom payments. The exact mechanics of the markup were not fully detailed, but the article indicates that victims were charged well above the actual ransom costs.
This case highlights how intermediaries in ransomware incidents can exploit victims' desperation, turning a criminal payment into a profitable resale. The source does not mention any legal proceedings or arrests beyond the allegations themselves.