Cybersecurity
MonsterCloud owner charged over alleged ransom scheme
Federal prosecutors in New York accused MonsterCloud owner Zohar Pinhasi of paying ransomware gangs for decryption keys, using them to restore customer files and billing victims more than the ransom amounts.
- Zohar Pinhasi was indicted on 23 September by a federal grand jury in the Eastern District of New York and was arraigned in Brooklyn on Wednesday.
- He faced one count of conspiracy to commit wire fraud and two counts of wire fraud over conduct prosecutors said ran from June 2018 to June 2023.
- The indictment said MonsterCloud LLC advertised ransomware recovery without paying criminals, but prosecutors alleged the company instead paid operators for decryption keys and used them to restore files.
- The U.S. Attorney's Office said Pinhasi surrendered, pleaded not guilty and was released on a $2 million bond.
- Prosecutors said the alleged scheme involved more than $8 million in ransom payments and more than $19 million in charges to customers.
Zohar Pinhasi, also known as Zack Silver and Zack Green, was indicted by a federal grand jury in the Eastern District of New York on 23 September. He was arraigned in federal court in Brooklyn on Wednesday and charged with one count of conspiracy to commit wire fraud and two counts of wire fraud.
According to the indictment, Pinhasi owned and ran MonsterCloud LLC, a Florida company that marketed ransomware recovery and decryption services. Prosecutors alleged that the company did not have the proprietary decryption technology it advertised and instead paid ransomware operators for keys.
The indictment said some contracts warned that MonsterCloud might communicate with, or pay, attackers, but only if it could not restore files by other means. Prosecutors said dealing with the criminals was often the first step, and Joseph Nocella Jr. said the defendant had re-victimised clients while making a profit.
The indictment said MonsterCloud charged customers far more than it paid the ransomware gangs, citing one case in which it allegedly paid about $8,200 and billed about $150,000, and another in which it paid about $236,000 and billed about $380,000. It also said the company used decrypted sample files as recovery proof, and noted that ProPublica reported similar concerns in 2019.
Named in this story
People
- Zohar Pinhasi
- was indicted and later arraigned over the alleged scheme
- Joseph Nocella Jr.
- was the U.S. Attorney who commented on the case
- Christopher Clark
- was one of Pinhasi's defence lawyers
- Rodney Villazor
- was one of Pinhasi's defence lawyers
- Fabian Wosar
- was a security researcher quoted in the 2019 investigation
Companies
- MonsterCloud LLC
- was the ransomware remediation company Pinhasi owned and operated
Organisations
- ProPublica
- published a 2019 investigation that raised similar concerns
Governments and agencies
- U.S. Attorney's Office
- said Pinhasi surrendered, pleaded not guilty and was released on bond
- Eastern District of New York
- was the federal district where the grand jury returned the indictment
Places
- Brooklyn
- was the place where Pinhasi was arraigned in federal court
How the source tells it
The article was a largely straight legal report, though it used prosecutorial condemnation and large money figures to underline the alleged scale of the conduct.
- moral censure a prosecutor’s quoted condemnation that cast the conduct as re-victimising clients for profit