MonsterCloud Owner Accused of Paying Ransoms While Claiming Technical Decryption
Zohar Pinhasi faces wire fraud charges for allegedly paying cybercriminals to unlock client data while charging inflated fees.
Key points
- Zohar Pinhasi, owner of MonsterCloud, was arraigned in New York on wire fraud charges.
- The indictment alleges Pinhasi paid ransoms to criminals instead of using technical decryption methods.
- Clients were charged fees substantially higher than the actual ransom payments made to attackers.
Zohar Pinhasi, also known as Zack Silver and Zack Green, is facing trial in New York for allegedly defrauding clients of his ransomware remediation company, MonsterCloud. According to district attorney Joseph Nocella, Pinhasi falsely claimed he could recover encrypted documents without paying ransom demands. The charges stem from allegations that he re-victimized clients while extracting significant profits for himself during the recovery process.
The risk
MonsterCloud marketed itself as an alternative to paying cybercriminals, stating on its website that its team specialized in helping businesses recover data without succumbing to ransom demands. However, the indictment alleges that Pinhasi did not use any proprietary decryption technology. Instead, he reportedly paid the cybercriminals directly in exchange for decryption keys, which MonsterCloud employees then used to attempt to unlock the clients’ files.
Who is exposed
The fraud targeted businesses that hired MonsterCloud for ransomware remediation services. According to CSO Online, Pinhasi arraigned on wire fraud charges for allegedly deceiving these clients about the nature of the recovery service. The victims were small and medium-sized enterprises that believed they were receiving a technical solution rather than facilitating a direct payment to the attackers through a third party.
Cost and compliance
The financial disparity between the ransom paid and the fee charged to clients was substantial. Computerworld reports that in one 2023 instance, Pinhasi paid $8,200 to a cybercriminal while charging the client a significantly higher amount. District Attorney Joseph Nocella stated that the defendant extracted a hefty profit by re-victimizing clients. This practice violates wire fraud statutes by misrepresenting the service provided and inflating costs beyond the actual ransom requirement.
What to watch
Small-business owners should scrutinize the technical claims of any third-party incident response provider. Verify whether a firm possesses legitimate decryption tools or simply acts as a payment intermediary. Legal proceedings in New York will provide further details on the scope of the fraud and the number of affected clients.
What to do and how to stay safe: MonsterCloud
- Verify the technical capabilities of incident response vendors before hiring them for ransomware recovery.
- Request documentation of decryption methods to ensure they do not involve direct ransom payments.
- Monitor legal updates regarding MonsterCloud to determine if your organization may have been affected.
- Review contracts with remediation firms for clauses that guarantee technical decryption rather than negotiation services.
Step-by-step guide: Ransomware Backups: Definition, Purpose, and Recovery Strategy
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is Zohar Pinhasi accused of doing?
He is accused of paying ransoms to cybercriminals while falsely claiming he could decrypt data technically.
How much did Pinhasi charge clients compared to the ransom?
He typically charged clients fees substantially higher than the ransom payment, such as charging more than the $8,200 he paid in 2023.
What charges is he facing?
Pinhasi has been arraigned in New York on wire fraud charges for allegedly defrauding his clients.
