Ransomware Remediation Firm Owner Accused of Paying Extortion Demands
Zohar Pinhasi faces wire fraud charges for allegedly paying cybercriminals while charging clients higher fees for data recovery services.
Key points
- Zohar Pinhasi was arraigned in New York on wire fraud charges related to his company MonsterCloud.
- Prosecutors allege Pinhasi paid ransoms to attackers instead of using technical decryption methods.
- Clients were charged fees substantially higher than the actual ransom payments made to criminals.
Zohar Pinhasi was arraigned in New York on wire fraud charges on Tuesday, according to reports from CSO Online and Computerworld. The owner of the ransomware remediation company MonsterCloud faces accusations that he defrauded clients by paying cybercriminals while claiming to decrypt data through proprietary technical means.
District Attorney Joseph Nocella stated that Pinhasi re-victimized clients while extracting significant profits for himself. The indictment alleges that Pinhasi, also known as “Zack Silver” and “Zack Green,” misled businesses about how their encrypted files were recovered. Instead of utilizing the decryption techniques advertised on the MonsterCloud website, Pinhasi allegedly paid ransoms to attackers.
Allegations of Fraudulent Practices
MonsterCloud’s website claimed that its team specialized in helping businesses recover data without succumbing to ransom demands. According to the indictment, this claim was false. Pinhasi allegedly paid cybercriminals in exchange for decryption keys, which MonsterCloud employees then used to attempt unlocking client files. This practice contradicted the company’s stated value proposition of avoiding ransom payments entirely.
The prosecution argues that Pinhasi charged clients fees that were substantially higher than the ransom amounts he paid. In one specific instance from 2023, Pinhasi paid $8,200 to a cybercriminal. He then charged a client a significantly larger fee for the recovery service. This markup generated a hefty profit for Pinhasi while exploiting businesses that were already victims of ransomware attacks.
Impact on Clients and Industry
The allegations target the integrity of the incident response and remediation sector. Clients who hired MonsterCloud believed they were engaging a technical service provider capable of bypassing attacker demands. Instead, they were effectively funding the ransom payments through inflated service fees. This deception undermines trust in third-party remediation vendors and complicates the financial recovery process for victimized organizations.
Pinhasi’s use of aliases, including “Zack Silver” and “Zack Green,” suggests an attempt to obscure his identity or past activities. The wire fraud charges stem from these interstate communications and financial transactions involving the fraudulent billing and ransom payments. The case highlights the risks organizations face when outsourcing critical incident response tasks to unverified or unethical vendors.
What should you do?
Organizations should verify the technical capabilities and legal standing of any third-party incident response vendor before engaging their services. Security teams must conduct due diligence to ensure that remediation providers do not engage in illicit activities such as paying ransoms. Contracts should clearly define the scope of services and prohibit unauthorized payments to threat actors.
What to do and how to stay safe: MonsterCloud
- Vet incident response vendors thoroughly to confirm they possess legitimate technical decryption capabilities rather than relying on ransom payments.
- Review service agreements to ensure they explicitly forbid paying ransoms or engaging with cybercriminals on behalf of the client.
- Monitor financial transactions related to incident response to detect any discrepancies between service fees and actual costs incurred.
- Consult legal counsel before hiring remediation firms to ensure compliance with local and federal laws regarding ransom payments and fraud.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who is accused of defrauding ransomware victims?
Zohar Pinhasi, the owner of MonsterCloud and also known as “Zack Silver” and “Zack Green,” is facing wire fraud charges.
How did Pinhasi allegedly deceive his clients?
He claimed to decrypt data using technical methods without paying ransoms, but allegedly paid attackers instead and charged clients higher fees.
What was the specific financial example cited in the allegations?
In 2023, Pinhasi allegedly paid $8,200 to a cybercriminal while charging a client a substantially higher fee for the service.
