Ransomware recovery firm boss charged with secretly paying attackers and overcharging victims
MonsterCloud owner Zohar Pinhasi charged with wire fraud for secretly paying ransomware gangs over $8M while billing victims over $19M.
Zohar Pinhasi (aka Zack Silver and Zack Green), a 50-year-old US-Israeli national from Hollywood, Florida, was charged with two counts of wire fraud and one count of wire fraud conspiracy, each carrying up to 20 years in prison. Prosecutors allege he charged MonsterCloud clients more than $19 million while secretly paying over $8 million to ransomware gangs; in August 2023 he paid roughly $8,200 for a decryptor and billed the client about $150,000. DOJ says MonsterCloud had no proprietary decryption technology despite its marketing claims, and paid testimonials came from paid spokespersons.
- Pinhasi allegedly paid over $8M in ransoms while billing clients over $19M
- Charged with two wire fraud counts plus conspiracy, up to 20 years each
- August 2023: paid ~$8,200 ransom, billed client ~$150,000
- MonsterCloud claimed proprietary decryption tools prosecutors say never existed
Full article368 words · extracted from helpnetsecurity.com · click to collapse
The owner of Florida-based ransomware remediation company MonsterCloud has been charged with fraud for allegedly paying ransomware gangs behind his clients’ backs and billing them far more than the ransom.
Zohar Pinhasi (aka “Zack Silver” and “Zack Green”), a 50-year-old US and Israeli national from Hollywood, Florida, allegedly charged MonsterCloud clients more than $19 million while paying more than $8 million to the ransomware gangs that attacked them.
According to the indictment, Pinhasi told prospective clients that MonsterCloud offered a principled alternative to paying ransomware attackers.
The company’s website advised victims not to pay the ransom, saying “our team specializes in helping businesses recover their data without succumbing to ransom demands” with the help of “advanced decryption techniques and cutting-edge technology.” Some of the testimonials on the site came from paid spokespersons.
Prosecutors allege Pinhasi had no special technology to decrypt data. He would contact the cybercriminals who had attacked a client and pay them for a decryption key, which MonsterCloud employees then used in an attempt to decrypt the client’s files.
“Pinhasi typically charged MonsterCloud’s clients a fee that was substantially higher than the ransom that MonsterCloud secretly paid. For example, in August 2023, Pinhasi made a ransom payment of approximately $8,200 to a cybercriminal and charged the client approximately $150,000 ,” according to a DoJ press release.
In May 2019, a paid spokesperson asked Pinhasi whether MonsterCloud truly had proprietary decryption software. “Monstercloud doesn’t hold any Proprietary technology [to] decrypt the ransomware data,” he allegedly replied.
US Attorney Joseph Nocella, Jr. said that by falsely claiming to decrypt ransomware without paying the attackers, Pinhasi “re-victimized his clients while extracting a hefty profit for himself.”
FBI Assistant Director in Charge James C. Barnacle, Jr. stated that Pinhasi claimed to fix ransomware while never remediating the underlying threat, and “turned the victim’s crisis into his own profit center.”
“This deception is unacceptable, and the FBI is committed to ensuring accountability for those who choose to victimize the very people who trusted them for help,” Barnacle added.
Pinhasi is charged with two counts of wire fraud and one count of wire fraud conspiracy. If convicted, he could get up to 20 years in prison on each count.