MonsterCloud's owner is charged with passing off purchased ransomware keys as proprietary decryption

Zohar Pinhasi, owner of ransomware remediation company MonsterCloud, has been charged with allegedly defrauding ransomware victims by secretly paying their attackers for decryptors while claiming to use proprietary technology to recover encrypted data.

Pinhasi is charged with one count of conspiracy to commit wire fraud and two counts of wire fraud in connection with an alleged ransomware decryption scheme that prosecutors say ran from June 2018 to June 2023.

The U.S. Attorney's Office told BleepingComputer that Pinhasi surrendered Wednesday, pleaded not guilty, and was released on a $2 million bond.

Prosecutors claim that dealing with cybercriminals was usually MonsterCloud's first step in obtaining decryption keys and recovering files.

In one incident cited in the indictment, Pinhasi allegedly paid a ransomware gang about $8,200 and charged the victim approximately $150,000.

Zohar Pinhasi, 50, also known as 'Zack Silver' and 'Zack Green,' was indicted by a federal grand jury in the Eastern District of New York on September 23 and arraigned Wednesday in federal court in Brooklyn.

In another incident, prosecutors say Pinhasi paid approximately $236,000 and charged the customer about $380,000.

The indictment alleges MonsterCloud used decrypted sample files as 'recovery proofs' to convince victims it could restore their data, even though those decrypted samples came from the ransomware operations.

Prosecutors say Pinhasi and his co-conspirators facilitated more than $8 million in ransom payments while charging hundreds of companies in the United States and Canada more than $19 million for recovery and remediation services.

A 2019 ProPublica investigation reported that MonsterCloud sometimes paid ransomware operators while claiming to offer a solution other than paying the attackers.

Security researcher Fabian Wosar told ProPublica that he and another researcher created their own ransomware and approached recovery companies posing as victims, with ransom notes containing email addresses they controlled; those accounts received anonymous offers to pay the ransom, which Wosar traced to data recovery firms including MonsterCloud and Proven Data.

"As alleged in the indictment, by falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself," U.S. Attorney Joseph Nocella Jr. said.

Pinhasi disputed that MonsterCloud had promised in advance it could decrypt the files, denied misleading customers, and told ProPublica that MonsterCloud's recovery methods varied by case, declining to disclose them.

If convicted, Pinhasi faces up to 20 years in prison.

BleepingComputer contacted Pinhasi's attorneys, Christopher Clark and Rodney Villazor, for comment and said it would update its story if it received a response.

"Our Office will vigorously prosecute ransomware attackers who prey on Americans from across the world and those who cynically profit from their criminal activity," Nocella said.

The alleged scheme continued for four years after the 2019 ProPublica reporting.

In the first cited case, the amount billed was roughly 18 times the ransom paid.

In the second cited case, the amount billed exceeded the ransom paid by $144,000.

On the indictment's headline figures, victims paid about $2.40 for every dollar of ransom that reached the gangs; both inputs are stated as lower bounds.