MonsterCloud CEO Indicted Over Alleged Ransomware Recovery Fraud

A federal grand jury indicted MonsterCloud CEO Zohar Pinhasi last month on charges alleging he defrauded clients of his ransomware data recovery business. According to the Justice Department, Pinhasi told customers he could recover encrypted files without paying hackers, while in reality he paid ransoms and charged victims large fees. The indictment mirrors findings from a 2019 ProPublica investigation into Pinhasi and MonsterCloud.

Alleged Scheme and Charges

Pinhasi, who used the alias Zack Green, described himself to ProPublica in 2019 as a former IT security intelligence officer for the Israeli military. He said MonsterCloud handled up to 30 calls a day, had about 20 employees in South Florida, and had extensive global contacts. He also called the firm's data recovery methods a 'trade secret.' Federal investigators found that over the course of the scheme Pinhasi allegedly charged clients more than $19 million and paid more than $8 million in ransom payments. In one example, he made a ransom payment of about $8,200 but charged the client about $150,000. If convicted, he faces up to 20 years in prison. A spokesperson for the U.S. Attorney's Office said Pinhasi pleaded not guilty. He hung up when reached on his cellphone this month, and messages left with a representative at MonsterCloud's office phone number and with his attorney were not returned. U.S. Attorney Joseph Nocella said in an Oct. 7 press release that by falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized clients while extracting a hefty profit for himself.

Client Trust and Law Enforcement Ties

ProPublica found that ransomware victims were harmed twice: first by hackers who locked files and demanded ransom, and second by MonsterCloud, which misled clients about not paying ransoms. MonsterCloud's services were particularly popular with local law enforcement agencies, which are loath to engage with or pay criminal hackers. Several clients interviewed at the time said they chose MonsterCloud because they believed the firm would never pay a ransom. In the Justice Department's October press release, an FBI official said Pinhasi turned the victim's crisis into his own profit center and that the FBI is committed to ensuring accountability. The Justice Department did not address ProPublica's 2019 finding that one of the FBI's own was among Pinhasi's associates at MonsterCloud. John Pistole, a former deputy director of the FBI under Robert Mueller and former head of the Transportation Security Administration under President Barack Obama, was prominently featured in a promotional video on MonsterCloud's homepage and listed as the only member of its Cyber Security Advisory Council. In a 2019 interview, he said he became acquainted with Pinhasi through a speaker's bureau, that MonsterCloud paid him indirectly through that group, and that Pinhasi scripted his testimonial. He said he knew that in most cases, including MonsterCloud's, decrypting ransomware-locked data requires paying hackers. Pistole did not respond to a request for comment for this story.

Ransomware Context

When ProPublica published its story in 2019, ransomware was growing into one of the world's most pervasive cyberthreats. Hackers locked the data of governments, schools and businesses and usually demanded ransom in bitcoin or other difficult-to-trace cryptocurrency. Ransomware remains a widespread threat today, and the threat to national security has grown as hackers linked to hostile foreign governments are believed to use ransomware as a cover for espionage. The prevalence of AI tools is also making it easier for attackers to spread ransomware.

Sources: propublica.org