Ransomware recovery firm boss charged with secretly paying attackers and overcharging victims
The owner of Florida-based ransomware remediation company MonsterCloud has been charged with fraud for allegedly paying ransomware gangs behind his clients’ backs and billing them far more than the ransom.
Zohar Pinhasi (aka “Zack Silver” and “Zack Green”), a 50-year-old US and Israeli national from Hollywood, Florida, allegedly billed MonsterCloud clients more than $19 million while paying more than $8 million to the ransomware gangs that attacked them.
According to the indictment, Pinhasi told prospective clients that MonsterCloud offered a principled alternative to paying ransomware attackers.
The company’s website advised victims not to pay the ransom, saying “our team specializes in helping businesses recover their data without succumbing to ransom demands.” MonsterCloud claimed it did this using “advanced decryption techniques and cutting-edge technology.”
Prosecutors allege Pinhasi had no special technology to decrypt data. He would contact the cybercriminals who had attacked a client and pay them for a decryption key, which MonsterCloud employees then used in an attempt to decrypt the client’s files.
“Pinhasi typically charged MonsterCloud’s clients a fee that was substantially higher than the ransom that MonsterCloud secretly paid. For example, in August 2023, Pinhasi made a ransom payment of approximately $8,200 to a cybercriminal and charged the client approximately $150,000,” according to a DoJ press release.
Some of the testimonials on MonsterCloud’s website came from people who were paid to promote it. In May 2019, one of them asked Pinhasi whether MonsterCloud truly had any proprietary software to decrypt encrypted data.
“Monstercloud doesn’t hold any Proprietary technology [to] decrypt the ransomware data,” Pinhasi allegedly replied.
US Attorney Joseph Nocella, Jr. said that by falsely claiming to decrypt ransomware without paying the attackers, Pinhasi “re-victimized his clients while extracting a hefty profit for himself.”
FBI Assistant Director in Charge James C. Barnacle, Jr. stated that Pinhasi claimed to fix ransomware while never remediating the underlying threat, and “turned the victim’s crisis into his own profit center.”
“This deception is unacceptable, and the FBI is committed to ensuring accountability for those who choose to victimize the very people who trusted them for help,” Barnacle added.
Pinhasi is charged with two counts of wire fraud and one count of wire fraud conspiracy. If convicted, he could get up to 20 years in prison on each count.
