MonsterCloud Owner Charged With Secretly Paying Ransom Demands To Attackers
Federal authorities accuse Zohar Pinhasi of defrauding clients by paying ransomware gangs while billing them exorbitant recovery fees.
Key points
- Zohar Pinhasi, owner of Florida-based MonsterCloud, faces fraud charges for alleged secret ransom payments.
- Indictment alleges Pinhasi billed clients over $19 million while paying gangs more than $8 million.
- The 50-year-old US and Israeli national used aliases including "Zack Silver" and "Zack Green."
Federal authorities have charged Zohar Pinhasi, the owner of the Florida-based ransomware remediation firm MonsterCloud, with fraud. The indictment accuses Pinhasi of secretly paying ransomware gangs on behalf of his clients while simultaneously billing those victims significantly more than the actual ransom amounts demanded by the attackers, according to Help Net Security.
The 50-year-old defendant, a dual citizen of the United States and Israel residing in Hollywood, Florida, allegedly operated under the aliases "Zack Silver" and "Zack Green." Prosecutors allege that Pinhasi engaged in a deceptive practice where he negotiated directly with criminal groups behind the backs of his clients. While the ransomware gangs demanded specific sums, Pinhasi reportedly presented inflated invoices to the victims, characterizing the charges as comprehensive recovery services rather than direct payments to criminals.
Financial Scope of Allegations
The financial disparity between what the gangs received and what clients were billed is central to the charges. According to the indictment cited by Help Net Security, Pinhasi billed MonsterCloud clients more than $19 million. In contrast, the total amount paid directly to the ransomware gangs was more than $8 million. This difference suggests that the remediation firm retained a substantial portion of the funds as profit or fees, rather than passing the costs directly to the attackers as a transparent service.
The allegations indicate a breach of trust inherent in the incident response industry. Clients hiring firms like MonsterCloud typically expect expert negotiation and technical remediation, often with the understanding that if a ransom is paid, it is done so transparently and in alignment with their financial constraints. By secretly engaging with the attackers and inflating the costs, Pinhasi allegedly exploited the urgent and distressing circumstances faced by victims of cyberattacks.
Who Is Affected
The victims in this case are the clients of MonsterCloud who engaged the firm for ransomware recovery services. These organizations suffered initial attacks by ransomware gangs and then sought professional help to mitigate the damage. The specific identities of these clients have not been disclosed in the provided source material, but the scale of the alleged billing—over $19 million—suggests that multiple significant enterprises were involved.
Security professionals and organizations using third-party incident response vendors may need to review their contracts and financial records for similar discrepancies. While this case involves one specific individual and firm, it highlights a potential risk in the broader cybersecurity services market: the lack of transparency in how remediation costs are calculated and paid.
What should you do?
Organizations that have recently hired ransomware recovery firms should audit their financial records to ensure that payments made to vendors align with actual ransom payments or service costs. Security teams should verify that any negotiations with attackers are conducted with full organizational oversight and approval. Additionally, incident response contracts should include clear clauses regarding financial transparency and the prohibition of unauthorized payments to third parties.
What to do and how to stay safe: MonsterCloud
- Review recent incident response invoices to ensure costs align with documented services and any actual ransom payments made.
- Require full transparency in contracts regarding how negotiations with threat actors are conducted and billed.
- Implement strict financial approval workflows for any payments related to cybersecurity incidents, ensuring they are audited by legal and finance departments.
- Vet third-party remediation vendors thoroughly, checking for any prior legal issues or regulatory actions before engagement.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who is Zohar Pinhasi?
Zohar Pinhasi is a 50-year-old US and Israeli national from Hollywood, Florida, and the owner of the ransomware remediation company MonsterCloud.
How much money is involved in the allegations?
Pinhasi allegedly billed clients more than $19 million while paying ransomware gangs more than $8 million.
What are the specific charges against Pinhasi?
He has been charged with fraud for allegedly paying ransomware gangs secretly and overcharging his clients for the recovery services.
