Key points
- Zohar Pinhasi, owner of MonsterCloud, was arraigned on wire fraud charges in New York.
- Prosecutors allege he paid ransom demands to cybercriminals instead of using decryption technology.
- Clients were charged fees substantially higher than the actual ransom payments made by Pinhasi.
The short version
- Zohar Pinhasi, also known as Zack Silver and Zack Green, owns the ransomware remediation firm MonsterCloud.
- He faces wire fraud charges in New York for allegedly deceiving clients about his data recovery methods.
- The indictment claims he paid ransoms to criminals while billing clients for technical decryption services.
The details
Zohar Pinhasi, who operates under the aliases Zack Silver and Zack Green, has been arraigned in New York on wire fraud charges related to his company, MonsterCloud. According to district attorney Joseph Nocella, Pinhasi allegedly defrauded clients by falsely claiming he could recover encrypted documents without paying ransom demands. Nocella stated that the defendant re-victimized clients while extracting a hefty profit for himself during these incidents.
MonsterCloud’s website claimed that its team specialized in helping businesses recover data without succumbing to ransom demands through specific decryption techniques. However, the indictment alleges that Pinhasi did not use any technology to decrypt files. Instead, he reportedly paid cybercriminals directly in exchange for decryption keys, which MonsterCloud employees then used to unlock client files.
The prosecution alleges that Pinhasi typically charged clients a fee that was substantially higher than the ransom payment he made to the attackers. In one specific example from 2023, Pinhasi made a payment of $8,200 to a cybercriminal. He then charged a client a significantly higher amount for the service, keeping the difference as profit.
The context
This case highlights the risks associated with third-party vendors offering emergency incident response services. While legitimate firms use technical analysis to bypass encryption, the indictment suggests Pinhasi engaged in a simple arbitrage scheme. He purchased decryption keys from criminals at a lower cost and sold the recovery service to panicked businesses at a premium.
The charges center on the deception involved in the transaction. Clients believed they were paying for a technical solution that avoided funding criminal enterprises. By secretly paying the ransom, Pinhasi violated that trust and the terms of service implied by MonsterCloud’s public marketing. The New York district attorney’s office is pursuing these charges to address the financial harm done to businesses already suffering from ransomware attacks.
What to watch
The legal proceedings against Pinhasi will provide details on the scope of the alleged fraud. Observers should watch for the number of victims identified in the indictment and the total amount of money involved. The outcome of this trial may influence how regulatory bodies view the claims made by ransomware remediation companies. It may also lead to increased scrutiny of contracts between businesses and incident response vendors.
Background: Encryption
Encryption is the process of converting plain text into ciphertext using an algorithm and a key. It prevents unauthorized access to data at rest and in transit. Without the correct decryption key, the information remains unintelligible, protecting privacy and integrity against interception or theft.
Read the full guide: What Is Encryption: Meaning, Definition, and How It Works
What to do and how to stay safe: MonsterCloud
- Verify the credentials and reputation of any incident response vendor before signing a contract during a crisis.
- Review service level agreements to understand exactly what technical methods a vendor will use to recover data.
- Maintain offline backups of critical data to reduce reliance on third-party decryption services during ransomware attacks.
- Consult with legal counsel to ensure that any emergency response services comply with local laws regarding ransom payments.
Step-by-step guide: Offline Backups Explained: How to Keep Data Safe From Ransomware
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What company is involved in this fraud case?
The case involves MonsterCloud, a ransomware remediation company owned by Zohar Pinhasi.
What are the specific charges against Zohar Pinhasi?
Pinhasi has been arraigned on wire fraud charges in New York for allegedly defrauding clients.
Did MonsterCloud actually decrypt the data technically?
No, the indictment alleges Pinhasi paid cybercriminals for decryption keys instead of using technology.
