Ransomware Recovery CEO Charged Over Alleged Secret Ransom Payments
Summary
MonsterCloud owner Zohar Pinhasi was charged with wire fraud and conspiracy. Prosecutors allege he secretly paid ransomware gangs for decryption keys while telling customers the company could recover files with its own technology.
Key points
- A federal grand jury charged Zohar Pinhasi with conspiracy to commit wire fraud and two counts of wire fraud; he pleaded not guilty and was released on bond.
- Prosecutors allege MonsterCloud paid ransomware operators for decryption keys while presenting the recovery as the result of proprietary technology.
- The indictment alleges that paying attackers was usually the company’s first step, despite contracts stating it would do so only if other recovery methods failed.
- Prosecutors say the company facilitated more than $8 million in ransom payments and charged hundreds of U.S. and Canadian companies more than $19 million.
- In examples cited by prosecutors, MonsterCloud allegedly charged customers substantially more than the ransom amounts it paid.
- The charges concern an alleged scheme from June 2018 to June 2023; Pinhasi faces up to 20 years in prison if convicted.
Article Details
- Event Type
- Federal indictment and arraignment over an alleged ransomware recovery wire-fraud scheme
- Impact
- Prosecutors allege that the scheme facilitated more than $8 million in ransom payments and charged hundreds of companies in the United States and Canada more than $19 million for recovery and remediation services.
People
Fabian WosarSecurity researcher who described a 2019 investigation in which researchers posed as ransomware victims to test recovery companies.Joseph Nocella Jr.U.S. Attorney who commented on the allegations in the indictment.Zohar PinhasiMonsterCloud owner indicted on wire-fraud charges concerning alleged secret ransom payments; also known as Zack Silver and Zack Green. He pleaded not guilty.
Vendors
MonsterCloud LLCAccording to the indictment, Pinhasi owned and operated MonsterCloud LLC, a Florida-based ransomware remediation company that advertised tools and decryption techniques for recovering encrypted data without payingProven Data"He traced the requests to the data recovery firms, including MonsterCloud and Proven Data."
Countries
Canadamore than $8 million in ransom payments while charging hundreds of companies in the United States and Canada more than $19 million for recovery and remediation services.United Statesfacilitated more than $8 million in ransom payments while charging hundreds of companies in the United States and Canada more than $19 million for recovery and remediation services.