A Florida cybersecurity expert who claimed his company could recover data locked by ransomware without paying hackers has been charged with fraud in the United States.
uncertain
company → claim → States
Federal prosecutors allege that Zohar Pinhasi, 50, secretly paid cybercriminals to obtain decryption keys while charging his clients much higher fees.
asserted
Pinhasi → allege → fees
According to the US Department of Justice, his company collected more than $19 million from clients and paid over $8 million in ransom payments.
uncertain
company → accord → payments
Pinhasi, who also used the names “Zack Silver” and “Zack Green,” owns MonsterCloud LLC, a Florida-based ransomware remediation company.
asserted
who → use → LLC
He was arraigned on wire fraud charges in a federal court in Brooklyn on Wednesday after a grand jury in the Eastern District of New York indicted him on September 23.
asserted
jury → arraign → September
The allegations concern businesses that had already suffered ransomware attacks and approached MonsterCloud for help.
asserted
that → concern → help
Ransomware is a type of cyberattack in which criminals encrypt files, making them inaccessible, and demand payment to provide a decryption key.
asserted
them → encrypt → key
MonsterCloud presented itself as a company that could recover such files without giving money to the attackers.
uncertain
that → present → attackers
However, prosecutors allege that Pinhasi did not have the special technology he advertised.
asserted
he → allege → technology
Instead, he contacted the same cybercriminals who had attacked his clients, paid them for decryption keys and charged the businesses substantially more than the ransom amounts.
asserted
who → contact → amounts
MonsterCloud claimed to recover encrypted data
According to the indictment, MonsterCloud promoted its services as an alternative to paying ransomware attackers.
uncertain
MonsterCloud → claim → attackers
Its website warned businesses against paying ransom and claimed that its team could help recover encrypted information through specialised technology.
uncertain
team → warn → technology
The company said it used “proprietary tools” and “advanced decryption techniques” to restore access to affected files.
asserted
it → say → files
These claims were particularly relevant to businesses whose data had become inaccessible following cyberattacks.
uncertain
data → become → cyberattacks
MonsterCloud's website also stated that “our team specializes in helping businesses recover their data without succumbing to ransom demands.”
asserted
businesses → state → demands
Federal investigators, however, allege that the company did not possess the technology it claimed to use.
asserted
it → allege → technology
Instead of independently decrypting the files, Pinhasi allegedly negotiated with the attackers and paid them to obtain decryption keys.
uncertain
Pinhasi → decrypt → keys
MonsterCloud employees then used those keys in an attempt to restore the clients' encrypted files.
asserted
employees → use → files
Prosecutors say the clients were not told that their payments were being used to pay the criminals responsible for the original attacks.
asserted
payments → say → attacks
$150,000 for an $8,200 ransom
One transaction highlighted by prosecutors took place in August 2023.
asserted
transaction → highlight → August
According to the Justice Department, Pinhasi paid approximately $8,200 to a cybercriminal to obtain a decryption key.
uncertain
Pinhasi → accord → key
However, he allegedly charged the affected client approximately $150,000 for the service, significantly more than the ransom payment.
uncertain
he → charge → payment
Investigators say this was part of a broader scheme in which MonsterCloud collected large fees while secretly paying ransomware attackers.
asserted
MonsterCloud → say → attackers
Over the course of the alleged scheme, prosecutors say Pinhasi charged clients more than $19 million and sent over $8 million to cybercriminals.
asserted
Pinhasi → allege → cybercriminals
The indictment also raises questions about the company's advertising.
asserted
indictment → raise → advertising
MonsterCloud's website featured testimonials, including some from paid spokespersons.
asserted
website → feature → spokespersons
According to prosecutors, one such spokesperson contacted Pinhasi in May 2019 to ask whether MonsterCloud actually possessed proprietary software capable of decrypting ransomware-affected data.
uncertain
MonsterCloud → accord → data
Pinhasi allegedly responded, “Monstercloud doesn’t hold any Proprietary technology [to] decrypt the ransomware data.”
uncertain
Monstercloud → respond → data
What US prosecutors said
US Attorney Joseph Nocella Jr. for the Eastern District of New York accused Pinhasi of taking advantage of businesses that were already victims of cybercrime.
asserted
that → say → cybercrime
“As alleged in the indictment, by falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself,” Nocella said.
asserted
Nocella → allege → himself
FBI Assistant Director in Charge James C. Barnacle Jr. also alleged that Pinhasi failed to address the underlying cybersecurity threat while profiting from clients seeking assistance.
“As alleged, Zohar Pinhasi claimed to fix ransomware while never remediating the underlying threat.
asserted
Pinhasi → allege → threat
Instead, he turned the victim's crisis into his own profit center,” Barnacle said.
asserted
Barnacle → turn → center
What charges does Pinhasi face?
asserted
Pinhasi → face → charges
Pinhasi, a US and Israeli national from Hollywood, Florida, faces two counts of wire fraud and one count of wire fraud conspiracy.
asserted
Pinhasi → face → conspiracy
If convicted, he faces a maximum prison sentence of 20 years on each count.
asserted
he → convict → count
The case is being prosecuted by the US Attorney's Office for the Eastern District of New York and the Justice Department's Computer Crime and Intellectual Property Section.
asserted
case → prosecute → York
The Justice Department also referred to joint guidance from the FBI and the Cybersecurity and Infrastructure Security Agency (CISA), which advises ransomware victims against paying attackers.
asserted
which → refer → attackers
The agencies warn that paying a ransom does not guarantee that encrypted data will be recovered, compromised systems will become secure or stolen information will not be leaked.
asserted
information → warn → ransom
The Aporia
