Comment by mpnordland

Given the references the author found to apparently reputable ransomware recovery firms, my reading is that the decryptor was built by one of those companies using the key provided by the intruder.