US Prosecutors Allege Ransomware Recovery Firm Secretly Paid Attackers While Billing Clients Far More

The United States Department of Justice has charged Zohar Pinhasi, also known as "Zack Silver" and "Zack Green", with fraud. Prosecutors allege he ran a Florida company called MonsterCloud that told ransomware victims not to pay criminals because it could recover their data using "proprietary tools" and "advanced decryption techniques". According to the DoJ, the company instead used part of its clients' fees to pay the attackers and kept the rest, often at a substantial markup.

The figures cited are significant. In one case, Pinhasi allegedly charged a client $150,000, paid an $8,200 ransom, and pocketed the difference without telling the client a ransom had been paid. Overall, he allegedly charged clients more than $19 million and paid more than $8 million in ransoms. The indictment also says that in May 2019 a paid spokesperson asked whether MonsterCloud had any proprietary decryption software, and Pinhasi allegedly replied that it did not.

Pinhasi faces two counts of wire fraud and one count of wire fraud conspiracy, each carrying a maximum of twenty years if he is convicted. These are allegations, and the case has not been decided. For business owners, it is a reminder that a business in crisis can be vulnerable to a second kind of exploitation, from those who promise a quick fix.