Ransomware recovery CEO charged over secret ransom payments

Ransomware recovery firm boss charged with secretly paying attackers and overcharging victims The owner of Florida-based ransomware remediation company MonsterCloud has been charged with fraud for allegedly paying ransomware gangs behind his clients’ backs and billing them far more than the ransom. Zohar Pinhasi (aka “Zack Silver” and “Zack Green”), a 50-year-old US and Israeli national from Hollywood, Florida, allegedly charged MonsterCloud clients more than $19 million while paying more than $8 million to the ransomware gangs that attacked them. According to the indictment, Pinhasi told prospective clients that MonsterCloud offered a principled alternative to paying ransomware attackers. The company’s website advised victims not to pay the ransom, saying “our team specializes in helping businesses recover their data without succumbing to ransom demands” with the help of “advanced decryption techniques and cutting-edge technology.” Some of the testimonials on the site came from paid spokespersons. Prosecutors allege Pinhasi had no special technology to decrypt data. He would contact the cybercriminals who had attacked a client and pay them for a decryption key, which MonsterCloud employees then used in an attempt to decrypt the client’s files. “Pinhasi typically charged MonsterCloud’s clients a fee that was substantially higher than the ransom that MonsterCloud secretly paid. For example, in August 2023, Pinhasi made a ransom payment of approximately $8,200 to a cybercriminal and charged the client approximately $150,000 ,” according to a DoJ press release. In May 2019, a paid spokesperson asked Pinhasi whether MonsterCloud truly had proprietary decryption software. “Monstercloud doesn’t hold any Proprietary technology [to] decrypt the ransomware data,” he allegedly replied. US Attorney Joseph Nocella, Jr. said that by falsely claiming to decrypt ransomware without paying the attackers, Pinhasi “re-victimized his clients while extracting a hefty profit for himself.” FBI Assistant Director in Charge James C. Barnacle, Jr. stated that Pinhasi claimed to fix ransomware while never remediating the underlying threat, and “turned the victim’s crisis into his own profit center.” “This deception is unacceptable, and the FBI is committed to ensuring accountability for those who choose to victimize the very people who trusted them for help,” Barnacle added. Pinhasi is charged with two counts of wire fraud and one count of wire fraud conspiracy. If convicted, he could get up to 20 years in prison on each count.

The U.S. Department of Justice (DoJ) on Wednesday announced charges against a 50-year-old U.S. and Israeli national for allegedly defrauding ransomware victims by secretly paying the attackers to obtain decryptors while claiming to use proprietary tools to recover their data. Zohar Pinhasi (aka Zack Silver and Zack Green) has been charged with two counts of wire fraud and one count of wire fraud conspiracy. If convicted, the defendant faces up to 20 years in prison for each count. "By falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself," said U.S. Attorney Joseph Nocella, Jr. for the Eastern District of New York. Pinhasi, who owned and operated a Florida company called MonsterCloud, is alleged to have made false representations to ransomware victims, urging them not to pay a ransom and claiming to have "proprietary tools" and "advanced decryption techniques" in possession that could be used to recover encrypted data without yielding to ransom demands. On its website, MonsterCloud claims it uses "advanced decryption techniques and cutting-edge technology" to restore data. Under a section called "Should I Pay The Ransom?," it states, "Paying a ransom to cybercriminals does not guarantee a positive outcome. In fact, it only serves to encourage and reward their illegal behavior." In a Q&A published on its site, MonsterCloud also addressed the question "Do you pay ransoms on behalf of your clients to recover data?," stating, "While we strongly advocate not paying ransoms yourselves, we have extensive experience working with ransomware perpetrators and sometimes resort to other means to resolve the ransomware incident for our clients. All terms are disclosed in our service contract." Contrary to its claims, there were no specialized tools to decrypt the data. Instead, Pinhasi approached the cybercriminals and paid them in exchange for obtaining a decryptor to recover the information. Pinhasi is said to have charged MonsterCloud's clients a fee that was "substantially higher" than the ransom that was secretly paid to the criminals. In one case in August 2023, the defendant made a ransom payment of approximately $8,200 to a threat actor and billed the client approximately $150,000. In another incident in or around October 2021, Pinhasi made a ransom payment of approximately $236,000 and charged the customer about $380,000. In all, Pinhasi is accused of charging clients more than $19 million and paying more than $8 million in ransom payments. "As alleged, Zohar Pinhasi claimed to fix ransomware while never remediating the underlying threat," said Assistant Director James C. Barnacle Jr. of the U.S. Federal Bureau of Investigation (FBI). "Instead, he turned the victim's crisis into his own profit center. This deception is unacceptable."

The United States Department of Justice has charged a man with fraud after he allegedly told clients he could decrypt files locked up by ransomware but actually paid ransoms – and seemingly got away with it for years. The Feds allege that Zohar Pinhasi – aka “Zack Silver” and “Zack Green” – ran a Florida company called “MonsterCloud” that advised ransomware victims not to pay because it had a way to recover encrypted data. “The charges relate to Pinhasi’s claimed ability to decrypt ransomware without paying cybercriminals, purportedly using ‘proprietary tools’ and ‘advanced decryption techniques' on behalf of distressed business owners who came to his company,” according to a DoJ press release. “In fact, Pinhasi allegedly used a portion of his clients’ fees to pay off the ransomware attackers, and then kept the rest, often extracting a substantial markup.” In one case, Pinhasi allegedly charged his client $150,000, paid the $8,200 ransom, and pocketed the rest – but didn’t admit he had paid the ransom. That scheme allegedly worked so well that Pinhasi charged clients more than $19 million and paid more than $8 million in ransom payments. The DOJ’s indictment [PDF] says MonsterCloud’s website mentions its use of “advanced decryption techniques and cutting-edge technology” – the same language found on this monstercloud.com page. The site also contains this claim: “At MonsterCloud, we are not a team of IT Experts. We are the most sophisticated Counter Cyber Terrorism team in the world.” The indictment suggests MonsterCloud was nothing of the sort, and that its claims rang hollow for years. “MonsterCloud's website included ‘testimonials’ and other promotional content, including from at least one compensated spokesperson,” the indictment states. “In May 2019, one such spokesperson – an individual who had provided a paid testimonial for the MonsterCloud website – contacted the defendant Zohar Pinhasi with questions about Pinhasi’s business practices and truthfulness.” “Among other things, the spokesperson asked Pinhasi whether MonsterCloud actually had any proprietary software that would allow MonsterCloud to decrypt encrypted data. Pinhasi responded: ‘MonsterCloud doesn't hold any proprietary technology [to] decrypt the ransomware data.’” Pinhasi faces two counts of wire fraud, and one of wire fraud conspiracy. He could do twenty years on each count, if convicted. The FBI is investigating this case, and it appears further charges could follow as the indictment states Pinhasi had “multiple co-conspirators, individuals whose identities are both known and unknown to the Grand Jury, including MonsterCloud employees and contractors.” ®

The owner of ransomware remediation company MonsterCloud has been charged with allegedly defrauding ransomware victims by secretly paying their attackers for decryptors while claiming to use proprietary technology to recover encrypted data. [...]