Circuit Wire — a daily news update from the Circuit.
Federal prosecutors in Brooklyn charged Zohar Pinhasi, 50, owner of Florida firm MonsterCloud, with wire fraud on Wednesday, October 7, alleging he told ransomware victims not to pay attackers while secretly paying them himself, according to the Justice Department.
Pinhasi, also known as "Zack Silver" and "Zack Green," faces two counts of wire fraud and one count of wire fraud conspiracy. Each carries a maximum of 20 years. An indictment is an allegation, and he is presumed innocent.
Prosecutors say MonsterCloud marketed itself as an alternative to paying ransoms. Its website allegedly told clients the team could recover data without giving in to criminals, using "proprietary tools" and "advanced decryption techniques." The indictment alleges no such technology existed. Instead, the company allegedly bought decryption keys from the attackers and used them on client files, without telling clients.
The numbers are large. Prosecutors say the firm charged clients more than $19 million and paid more than $8 million in ransoms. In one case from August 2023, Pinhasi allegedly paid a criminal about $8,200 and billed the client about $150,000.
BleepingComputer reported that a grand jury indicted him on September 23, and that the charges cover June 2018 to June 2023. He pleaded not guilty at his arraignment in Brooklyn and was released on a $2 million bond. The outlet also reported that hundreds of companies in the U.S. and Canada were billed. In a second case it cited, about $236,000 went to attackers and the customer paid about $380,000.
The indictment also alleges MonsterCloud used decrypted sample files from the attackers as "recovery proofs" to win over victims. The Register reported that the document names unidentified co-conspirators, including employees and contractors, so more charges are possible. It also reported that in May 2019 a paid spokesperson asked Pinhasi whether the firm had decryption software, and he allegedly replied that it did not.
U.S. Attorney Joseph Nocella Jr. said the defendant "re-victimized his clients while extracting a hefty profit for himself." The FBI is investigating. A 2019 ProPublica investigation had raised similar questions about MonsterCloud, and Pinhasi disputed them at the time.
Want a weekly roundup of the major stories shaping the security industry? The On The Circuit newsletter is read by more than 12,000 protection professionals.
Spotted something we should cover? Send tips and feedback via circuit-magazine.com.