Ransomware Recovery Firm’s Owner Charged With Quietly Paying Attackers While Billing Victims Millions
Federal prosecutors say the owner of MonsterCloud sold ransomware victims a no-ransom recovery service, then secretly bought decryption keys from the attackers and marked up the cost.
When ransomware locks a company’s files, the owner’s first call is often to a recovery firm promising to get the data back without paying criminals. Federal prosecutors now allege that one such firm was doing exactly what it told customers it wasn’t: paying the attackers and pocketing the difference.
The charges
Zohar Pinhasi, 50, owns MonsterCloud LLC, a Florida-based ransomware remediation company. He has also gone by the names “Zack Silver” and “Zack Green.” A federal grand jury in the Eastern District of New York indicted him on September 23 on one count of conspiracy to commit wire fraud and two counts of wire fraud. On Wednesday he surrendered, was arraigned in federal court in Brooklyn, pleaded not guilty and was released on a $2 million bond, according to the U.S. Attorney’s Office. If convicted, he faces up to 20 years in prison.
What prosecutors say happened
MonsterCloud marketed tools and decryption techniques that supposedly recovered encrypted data without anyone paying a ransom. The indictment says that technology didn’t exist. Instead, prosecutors allege, Pinhasi and his co-conspirators contacted the ransomware gangs, bought the decryption keys and used them to restore customers’ files. The alleged scheme ran from June 2018 to June 2023.
Some MonsterCloud contracts did mention that the company might talk to or pay cybercriminals, the indictment acknowledges. But those contracts reportedly said this would happen only if other decryption methods failed. Prosecutors say that in practice, contacting the criminals was usually the first move. The company also allegedly showed victims decrypted sample files as “recovery proofs,” when those samples had actually come from the ransomware operators.
The markup
The indictment cites two examples. In one, Pinhasi allegedly paid a ransomware gang about $8,200 and billed the victim roughly $150,000. In another, he allegedly paid about $236,000 and charged around $380,000. Across the whole period, prosecutors say the scheme moved more than $8 million in ransom payments while charging hundreds of companies in the United States and Canada more than $19 million for recovery and remediation work.
Not the first warning
The allegations echo a 2019 ProPublica investigation. In that reporting, security researcher Fabian Wosar said he and another researcher built their own ransomware, with ransom notes pointing to email addresses they controlled, and approached recovery companies while posing as victims. Anonymous offers to pay the ransom soon arrived at those addresses, and he traced them back to recovery firms including MonsterCloud. Pinhasi denied misleading customers at the time and called his methods a trade secret.
Lawrence Abrams has the full account of the indictment at BleepingComputer, which also reached out to Pinhasi’s attorneys for comment.
What this means for your company
- Vet recovery help before you need it. Choose an incident response partner during calm times, check references, and get in writing exactly how they recover data and whether they ever negotiate with attackers.
- Ask the hard question directly. If a firm promises decryption without paying, ask how. A vague “proprietary method” answer is a warning sign.
- Make backups your real recovery plan. Offline or immutable backups that are tested regularly mean you aren’t dependent on anyone’s promises, honest or not.
- Bring in counsel and your insurer early. Ransom payments carry legal and reporting considerations, and your cyber policy may require approved vendors.
Need help building a ransomware recovery plan you can actually trust? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
