MonsterCloud owner charged over secret ransom payments

DOJ charged MonsterCloud owner Zohar Pinhasi with wire fraud for allegedly paying ransomware gangs while billing clients more than $19 million.

Federal prosecutors in the Eastern District of New York charged Zohar Pinhasi, 50, also known as Zack Silver and Zack Green, a U.S. and Israeli national from Hollywood, Florida, and owner of ransomware-recovery firm MonsterCloud, with two counts of wire fraud and one count of conspiracy to commit wire fraud. Prosecutors allege he told hundreds of U.S. and Canadian clients that MonsterCloud had proprietary decryption tools—and, according to Security Affairs, that it would not pay ransoms—though those tools never existed and decryptors were bought from attackers; BleepingComputer says staff paid the gangs and dates the scheme from June 2018 to June 2023, while several outlets cite an August 2023 payment after that end date and CyberScoop says five years ending in 2023. He allegedly paid more than $8 million in ransoms and billed more than $19 million; The Record instead says roughly $8 million and about $19 million, and SecurityWeek calls the difference about an $11 million markup. Reported examples include an August 2023 case of about $8,200 paid and about $150,000 billed, plus an October 2021 case reported only by The Hacker News of about $236,000 paid and about $380,000 billed. BleepingComputer and CyberScoop say he pleaded not guilty and was released on a $2 million bond, with CyberScoop placing the plea in federal court in Brooklyn and putting exposure at up to 60 years, while BleepingComputer and The Record say up to 20 years if convicted and The Register, The Hacker News, Help Net Security, and Security Affairs say each count carries up to 20 years. The Register says the FBI is investigating possible co-conspirators, Help Net Security says testimonials came from paid spokespersons, and The Record cites a 2019 ProPublica sting; DataBreaches.net’s available text does not name MonsterCloud or give loss figures.

• Zohar Pinhasi, 50, also known as Zack Silver and Zack Green, a U.S. and Israeli national from Hollywood, Florida, owns Florida ransomware-recovery firm MonsterCloud.
• He was charged in the Eastern District of New York with two counts of wire fraud and one count of conspiracy to commit wire fraud.
• Prosecutors allege he claimed proprietary decryption—and, per Security Affairs, that the firm would not pay ransoms—while secretly buying keys from attackers; BleepingComputer dates this from June 2018 to June 2023.
• He allegedly paid more than $8 million in ransoms and billed more than $19 million to hundreds of U.S. and Canadian clients; The Record says roughly $8 million and about $19 million, and SecurityWeek calls the gap about an $11 million…
• Cited examples: about $8,200 paid and about $150,000 billed in August 2023, and, only in The Hacker News, about $236,000 paid and about $380,000 billed in October 2021.
• BleepingComputer and CyberScoop say he pleaded not guilty and was released on a $2 million bond; exposure is disputed as up to 20 years, 20 years per count, or CyberScoop’s up to 60 years.
• The Register says the FBI is investigating possible co-conspirators; Help Net Security says testimonials came from paid spokespersons; The Record cites a 2019 ProPublica sting.