DOJ Charges MonsterCloud Owner With Wire Fraud For Secretly Paying Ransoms
Federal prosecutors accuse the firm's founder of defrauding victims by paying attackers to decrypt data while claiming proprietary recovery methods.
Key points
- Zohar Pinhasi faces charges for allegedly billing victims millions while secretly paying ransomware groups.
- The DOJ accuses Pinhasi of using deceptive practices to obtain decryptors from attackers rather than using internal tools.
- Charges include two counts of wire fraud and one count of wire fraud conspiracy related to the scheme.
The U.S. Department of Justice announced charges on Wednesday against Zohar Pinhasi, the owner of MonsterCloud, for allegedly defrauding ransomware victims. Pinhasi, a 50-year-old dual national of the United States and Israel, is accused of billing clients for data recovery services while secretly paying ransom demands to cybercriminals to obtain decryption keys.
According to The Hacker News, the Justice Department alleges that Pinhasi, who also operates under the aliases Zack Silver and Zack Green, deceived victims regarding the method of data recovery. Instead of utilizing proprietary tools as claimed, the charges state that Pinhasi paid the attackers directly to decrypt the stolen data. The defendant has been charged with two counts of wire fraud and one count of wire fraud conspiracy in connection with these activities.
Allegations of Financial Fraud
The core of the federal case centers on the financial mechanism of the alleged fraud. Prosecutors assert that Pinhasi generated significant revenue by charging victims for recovery services that were actually funded by paying the ransomware operators. The DOJ announcement indicates that the scheme involved billing victims for over $19 million. This figure represents the amount accused of being collected from victims under the guise of legitimate recovery services, while the underlying action was a direct payment to the threat actors.
The charges highlight a specific modus operandi where a recovery service provider acts as an intermediary that facilitates the attackers' goals rather than neutralizing them. By claiming to use proprietary technology to restore access, Pinhasi allegedly created a false narrative that justified the fees charged to the victims. The wire fraud counts relate to the use of interstate communications to execute this deceptive business model.
Impact on Ransomware Victims
The victims of this alleged scheme are organizations or individuals who suffered ransomware attacks and engaged MonsterCloud for assistance. These victims were reportedly led to believe that their data was being recovered through technical means independent of the attackers. In reality, the decryption was achieved by satisfying the ransom demands of the cybercriminals.
This case underscores the risks associated with third-party incident response and data recovery services. Victims may unknowingly contribute to the profitability of ransomware groups by paying fees to intermediaries who then pass those funds to the attackers. The allegations suggest that the victims were not informed that their payments were effectively serving as ransom payments, violating the trust placed in the recovery service provider.
What should you do?
Security professionals and organizations should verify the operational procedures of any third-party data recovery or incident response vendors they engage. It is critical to understand how a vendor intends to restore access to encrypted data and whether their methods involve any interaction with threat actors. Organizations should maintain strict oversight of incident response activities to ensure that no unauthorized payments are made to ransomware groups. Additionally, companies should review their contracts with recovery services to ensure transparency regarding the methods used for data restoration.
What to do and how to stay safe: MonsterCloud
- Vet third-party incident response and data recovery vendors to confirm they do not facilitate ransom payments to attackers.
- Require transparency from recovery services regarding the specific technical methods used to decrypt or restore data.
- Monitor financial transactions related to incident response to ensure no funds are being diverted to threat actors.
- Establish clear internal policies that prohibit paying ransomware demands, including through intermediaries.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who is Zohar Pinhasi?
Zohar Pinhasi is the owner of MonsterCloud and a 50-year-old U.S. and Israeli national who has been charged by the DOJ with wire fraud.
What are the charges against Pinhasi?
Pinhasi faces two counts of wire fraud and one count of wire fraud conspiracy for allegedly defrauding ransomware victims.
How much money was involved in the alleged fraud?
The DOJ accuses Pinhasi of billing victims for over $19 million while secretly paying ransoms to decrypt their data.
