Estimated reading time: 4 minutes
Federal prosecutors have charged the owner of MonsterCloud with wire fraud. The Florida ransomware recovery firm sold victims an alternative to paying criminals. Prosecutors say it paid the criminals and billed clients far more. ProPublica flagged the practice in 2019.
A ransomware recovery firm told victims they would not have to pay. It paid anyway and charged them more, federal prosecutors say.
Zohar Pinhasi, owner of Florida-based MonsterCloud LLC, appeared for arraignment on wire fraud charges in Brooklyn on 7 October. The US Attorney’s Office for the Eastern District of New York announced the case. A grand jury indicted him on 23 September.
Pinhasi, 50, lives in Hollywood, Florida. He also used the names “Zack Silver” and “Zack Green,” prosecutors said.
What The Ransomware Recovery Firm Promised
MonsterCloud marketed itself as a principled alternative to paying attackers, according to the indictment. Its website warned victims not to pay. It claimed to recover data with “advanced decryption techniques and cutting-edge technology.”
Prosecutors say Pinhasi had no such technology. He contacted the attackers and paid them for a decryption key, they allege. He then charged clients a much larger fee.
In one example, from August 2023, Pinhasi allegedly paid a ransom of about $8,200. He charged the client about $150,000.
Over the course of the scheme, he charged clients more than $19 million, prosecutors say. He paid more than $8 million in ransoms.
US Attorney Joseph Nocella Jr. said Pinhasi “re-victimized his clients while extracting a hefty profit for himself,” as alleged in the indictment.
In May 2019, a paid MonsterCloud spokesperson asked Pinhasi whether the firm had proprietary decryption software, prosecutors say. “MonsterCloud doesn’t hold any Proprietary technology [to] decrypt the ransomware data,” he replied, according to the indictment.
A Ransomware Recovery Firm Flagged In 2019
That same month, ProPublica reported that MonsterCloud typically paid ransoms while promising other methods. It found the same at a second firm, Proven Data Recovery. ProPublica found MonsterCloud at times did not tell victims, including local law enforcement agencies. Pinhasi told ProPublica then that MonsterCloud’s methods were a trade secret.
The indictment’s example payment came in August 2023, more than four years after that report.
Our Podcast – Ransomware Response: Expert Negotiation and Cyber Insurance
Ransom Payments The Insurer Never Approved
The release does not say whether insurers paid any of MonsterCloud’s fees. If they did, insurers paid the alleged markup too.
Cyber policies typically require policyholders to seek the insurer’s consent before making extortion payments, Risk Management magazine has reported. A payment the client never knew about skips that step.
It also skips sanctions screening. The Treasury’s Office of Foreign Assets Control warned in 2021 that paying sanctioned actors can bring civil penalties. Liability is strict, so not knowing is no defense. The advisory names cyber insurance firms and incident response companies among those that facilitate payments. A victim that does not know a ransom was paid cannot check who received it.
Some public bodies cannot pay at all. Florida, where MonsterCloud is based, has barred state agencies, counties and municipalities from paying ransoms since 2022.
The case lands as fewer victims pay. GuidePoint’s negotiation team saw the share of its clients paying fall to just under 21% in the third quarter.
What Comes Next
The charges are allegations. Pinhasi is presumed innocent unless and until proven guilty. If convicted, he faces up to 20 years in prison.
FAQ – Ransomware Recovery Firm
Who has been charged?
Zohar Pinhasi, owner of Florida-based MonsterCloud LLC, also known as Zack Silver and Zack Green. He was indicted on wire fraud charges in the Eastern District of New York.
What does the indictment allege?
That MonsterCloud claimed to decrypt ransomware without paying attackers but instead paid them for decryption keys, then charged clients far more than the ransom.
How much money is involved?
Prosecutors say Pinhasi charged clients more than 19 million dollars and paid more than 8 million dollars in ransoms. In one 2023 case, a ransom of about 8,200 dollars led to a fee of about 150,000 dollars.
Was this practice reported before?
Yes. ProPublica reported in May 2019 that MonsterCloud typically paid ransoms while promising other recovery methods.
Why does this matter to cyber insurers?
Cyber policies typically require insurer consent before extortion payments. Concealed payments also skip sanctions screening, which OFAC warns carries strict liability risk.
What penalty does Pinhasi face?
Up to 20 years in prison if convicted. The charges are allegations, and he is presumed innocent.
Related Cyber Insurance Posts
- When Your AI Calls The Insurer’s AI, Who Owns The Mistake?
- SEC Hits Firms with Millions in Fines for Inadequate Cyber Disclosures; Sparks Dissent on Commission(Opens in a new browser tab)
- Cyber Insurance Pays Back Only App. 60% of Ransomware Costs & Then Rates Go Up(Opens in a new browser tab)
- Everybody Using its Risk Solution Avoided Paying Ransoms in 2022: Resilience(Opens in a new browser tab)
- Should Ransomware Payments Be Banned?(Opens in a new browser tab)