Key facts
- Prosecutors allege Pinhasi and co-conspirators charged hundreds of US and Canadian companies more than $19 million while facilitating more than $8 million in ransom payments.
- Pinhasi is 50, a US and Israeli national from Hollywood, Florida, and is also known as Zack Silver and Zack Green.
- Prosecutors allege the scheme ran from June 2018 to June 2023.
- In another case, around October 2021, he allegedly paid about $236,000 in ransom and charged about $380,000.
Zohar Pinhasi, owner of the ransomware recovery firm MonsterCloud, pleaded not guilty in Brooklyn federal court on Wednesday, Oct. 7, to charges that he secretly paid attackers while telling clients the firm decrypted their data with its own technology. He was released on a $2 million bond, according to BleepingComputer. The allegations are unproven, and Pinhasi is presumed innocent.
Pinhasi, 50, is a US and Israeli national from Hollywood, Florida, and is also known as Zack Silver and Zack Green. A federal grand jury in the Eastern District of New York returned the indictment on Sept. 23, according to BleepingComputer and ISMG’s reporting. The charges are wire fraud, a federal offense involving the use of electronic communications to carry out a scheme to defraud.
He faces two wire fraud counts plus a separate count of conspiring to commit it, and each count carries up to 20 years in prison.
What prosecutors allege
Prosecutors allege the scheme ran from June 2018 to June 2023. In that period, they say, Pinhasi and co-conspirators charged hundreds of US and Canadian companies more than $19 million while facilitating more than $8 million in ransom payments.
MonsterCloud marketed itself as an alternative to paying ransoms, claiming proprietary tools and advanced decryption techniques. Prosecutors say it had no such technology. They allege the firm instead paid the attackers for decryption keys, the digital codes that unlock scrambled files, and staff then used those keys on client files.
The indictment, as reported by ISMG, says several clients hired MonsterCloud because they did not want to pay cybercriminals. The same report says Pinhasi typically did not disclose the ransom payments or the gap between the firm’s fees and those payments.
The markups
Prosecutors cite specific cases. In August 2023, Pinhasi allegedly paid about $8,200 in ransom and billed the client about $150,000. Around October 2021, he allegedly paid about $236,000 and charged about $380,000.
Prosecutors describe a two-phase pricing model. An analysis phase cost $2,500 to $10,000 and used free decrypted sample files from the attackers as proof of recovery. A full recovery phase was typically quoted at up to two times or more the negotiated ransom.
re-victimized his clients while extracting a hefty profit for himself
Joseph Nocella Jr., US Attorney, BleepingComputer
The contracts are a contested point. Some MonsterCloud agreements disclosed that the firm might contact or pay attackers, but only after other decryption means were exhausted. Prosecutors say contacting the attackers was typically the first step.
Some website testimonials allegedly came from paid spokespeople. In May 2019, one asked whether MonsterCloud had proprietary decryption software, and Pinhasi allegedly said it did not.
turned the victim's crisis into his own profit center
James C. Barnacle Jr., FBI Assistant Director in Charge, Help Net Security
Earlier warnings
A 2019 ProPublica investigation raised similar concerns about MonsterCloud. Researcher Fabian Wosar ran a sting with a fake ransomware gang that drew payment offers traced to recovery firms including MonsterCloud and Proven Data, according to BleepingComputer and The Record. Pinhasi denied misleading customers and called his methods a trade secret.
The Record, citing ProPublica, reports that former FBI deputy director John Pistole was paid as a MonsterCloud spokesperson and said in 2019 that paying ransoms was the business model. The sources reviewed do not allege wrongdoing by Pistole.
Why it matters
The FBI and CISA advise against paying ransoms because payment does not guarantee data recovery, as The Record and Security Affairs note. Analysis: firms like MonsterCloud emerged as an option for victims willing to pay for restoration without handling the payment themselves. If the allegations hold, a recovery fee may have funded attackers while carrying a heavy markup.
The Record describes the case as the latest Justice Department action against the ransomware recovery and negotiation industry. It reports that two ransomware negotiators received four-year sentences in May for running covert attacks and coordinating with gangs.
Analysis: obtaining a decryptor, the tool that restores locked files, does not fix the intrusion that delivered the ransomware. A victim who gets files back still has to find and close the way in. For organizations hiring incident-response help, the practical step is to ask in writing whether the vendor will contact or pay the group, and how its fees relate to any payment.
What to watch
ISMG reports that prosecution and defense told the court on Oct. 7 that they are discussing a plea deal. No other outlet in the reporting reviewed confirms that detail, so it should be read with caution.
Join the discussion