The owner of MonsterCloud, a Florida company that sold ransomware recovery services, has been charged with defrauding victims by quietly paying the hackers for decryption keys while claiming to restore files with his own technology, BleepingComputer reported Wednesday. Prosecutors say he then billed clients far more than the ransoms cost.

What Happened

Zohar Pinhasi, 50, was indicted by a federal grand jury in the Eastern District of New York on Sept. 23 and arraigned Wednesday in federal court in Brooklyn. He pleaded not guilty and was released on a $2 million bond. He faces one count of conspiracy to commit wire fraud and two counts of wire fraud, each carrying a maximum sentence of 20 years in prison.

According to prosecutors, the scheme ran from June 2018 to June 2023. During that time, Pinhasi allegedly told ransomware victims that MonsterCloud had proprietary technology that could decrypt their files. Instead, prosecutors say, negotiating with and paying the attackers was usually the company’s first step, even though its contracts presented contact with cybercriminals as a last resort.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

The indictment describes large markups. In one case, Pinhasi allegedly paid the attackers $8,200 and charged the victim $150,000. In another, he allegedly paid about $236,000 and billed the client about $380,000. Overall, prosecutors say, he facilitated more than $8 million in ransom payments while charging hundreds of companies in the U.S. and Canada more than $19 million.

Prosecutors also say Pinhasi used the aliases “Zack Silver” and “Zack Green.” U.S. Attorney Joseph Nocella Jr. said that by falsely claiming to decrypt files without paying the attackers, Pinhasi had victimized his clients a second time.

Why It Matters

Ransomware victims often turn to recovery firms under heavy time pressure, with operations down and little ability to check what the firm actually does. A claim that files can be restored without paying is especially attractive to organizations that do not want to fund criminals or to disclose a payment to boards, insurers or regulators.

If the allegations are proven, MonsterCloud’s clients were funding ransomware groups without knowing it. That matters beyond the money: an organization that does not know a ransom was paid on its behalf cannot weigh the legal risks of the payment, including the possibility that the recipient is a sanctioned group, or report it accurately.

The case also gives incident response buyers a reason to ask recovery providers how decryption is achieved, whether any payment is made and who receives it.

Context

Some ransomware recovery firms have long been suspected of quietly paying ransoms while marketing technical decryption. Pinhasi has not been convicted, and the charges are allegations.

The Register reported that the indictment refers to multiple co-conspirators, both known and unknown to the grand jury, including MonsterCloud employees and contractors. None were named. The FBI is investigating the case.

What to Watch

The case now moves forward in federal court in Brooklyn. The main questions are whether prosecutors bring charges against any of the co-conspirators described in the indictment and whether former MonsterCloud clients come forward or seek to recover what they paid.