US Ransomware Recovery Boss Charged with Fraud for Secretly Paying Hackers and Billing Victims Far More

The US Justice Department has charged Zohar Pinhasi, owner of Florida-based MonsterCloud, with wire fraud and wire fraud conspiracy. Prosecutors allege the firm told ransomware victims it could recover their data without paying criminals, citing "proprietary tools" and "advanced decryption techniques". Instead, they say Pinhasi simply paid the ransom, obtained a decryption key, and had staff try to unlock the files, then billed the client a fee well above the original demand.

The figures cited are striking. Prosecutors say clients were charged $19 million in total while about $8 million went to cybercriminals. In one 2023 case in the indictment, a ransom of $8,200 was allegedly paid and the client was charged $150,000. Pinhasi faces up to 20 years in prison if convicted. MonsterCloud did not respond to requests for comment.

The company had been scrutinised before. A 2019 ProPublica investigation highlighted it, and a researcher's sting found that MonsterCloud claimed it could decrypt his files and then offered to pay the supposed attacker. Pinhasi denied lying to clients at the time, saying his methods were a trade secret. ProPublica reported that local governments and police departments were among those who sought help. A former FBI deputy director paid as the firm's spokesperson told ProPublica that paying ransoms "was the business model".