Ransomware recovery CEO charged over secret ransom payments

The owner of MonsterCloud, a Florida-based firm that claimed to recover data after ransomware attacks, has appeared in court on fraud charges. According to prosecutors, the company promised victims it could restore encrypted files using its own technology — while in reality simply paying the ransom to the very attackers who had locked the data.

Zohar Pinhasi, 50, also known as "Zack Silver" and "Zack Green," was indicted by a federal grand jury in the Eastern District of New York on September 23. He appeared in a Brooklyn federal court on Wednesday, pleaded not guilty, and was released on a $2 million bond. He faces one count of conspiracy to commit wire fraud and two counts of wire fraud; the scheme, investigators say, ran from June 2018 to June 2023.

Technology that didn't exist

MonsterCloud advertised tools and techniques capable of recovering data without striking deals with criminals. Prosecutors allege the company had no such proprietary technology: its staff contacted ransomware operators, bought decryption keys from them, and used those keys to restore clients' files.

Some contracts did formally allow contact with cybercriminals and payment to them — but only as a last resort, if the data could not be decrypted otherwise. In practice, the indictment claims, negotiating with the attackers was MonsterCloud's first step, not its last.

A steep markup

The company charged clients sums many times the ransom itself. In one case, Pinhasi allegedly paid attackers about $8,200 and billed the victim roughly $150,000. In another, he paid about $236,000 and invoiced the customer around $380,000.

As "recovery proof," clients were shown decrypted sample files — though, according to investigators, those samples came from the ransomware operations themselves. Over the life of the scheme, prosecutors believe Pinhasi and his co-conspirators facilitated more than $8 million in ransom payments while billing hundreds of companies in the U.S. and Canada over $19 million.

"By falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself," said U.S. Attorney Joseph Nocella Jr. If convicted, Pinhasi faces up to 20 years in prison.

Old suspicions

Similar concerns about MonsterCloud surfaced back in 2019 in a ProPublica investigation. Security researcher Fabian Wosar told the outlet that he and a colleague built their own ransomware and approached several recovery firms posing as victims. Before long, the attacker addresses they controlled began receiving anonymous offers to pay the ransom — traced back to those same firms, including MonsterCloud.

At the time, Pinhasi denied misleading customers, called the firm's recovery methods a "trade secret," and declined to disclose them.

Source: Bleeping Computer