IT consultancy firm caught running ransomware decryption scam