Ransomware recovery firm owner charged with secretly paying hackers, pocketing millions

A man whose company promised to help ransomware victims recover their data without paying hackers allegedly secretly paid the attackers and charged clients substantially more than the ransom amounts, according to a federal indictment.

Zohar Pinhasi, 50, also known as “Zack Silver” and “Zack Green,” a U.S. and Israeli national, was arraigned in the Eastern District of New York on wire fraud charges, the Justice Department said in a news release. He is charged with two counts of wire fraud and one count of wire fraud conspiracy. If convicted, he faces a maximum penalty of 20 years in prison on each count.

According to the indictment, Pinhasi’s company, MonsterCloud, told distressed business owners who had been hit by cybercriminals that it offered an alternative to paying ransoms. The company’s website cautioned clients against paying and claimed its team specialized in recovering data without giving in to ransom demands. Pinhasi allegedly said he had access to “proprietary tools” and “advanced decryption techniques.”

Prosecutors allege he had no special technology to decrypt the data. Instead, he contacted the cybercriminals who had attacked the client and paid them for a decryption key, which MonsterCloud employees then used in an attempt to unlock the client’s files, according to the indictment.

Pinhasi typically charged clients a fee substantially higher than the ransom MonsterCloud secretly paid, prosecutors said. In one instance, around August 2023, he allegedly paid a cybercriminal about $8,200 and charged the client about $150,000. Over the course of the scheme, he allegedly charged clients more than $19 million and paid more than $8 million in ransoms.

“The defendant is charged with offering an alternative to ransom payments, but instead is alleged to have victimized the victim again and committed additional fraud, harming the victim again,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division.

U.S. Attorney Joseph Nocella Jr. of the Eastern District of New York said his office “will vigorously prosecute ransomware attackers who prey on Americans from across the world and those who cynically profit from their criminal activity.”

FBI Assistant Director James C. Barnacle Jr. said Pinhasi, as alleged, “turned the victim’s crisis into his own profit center.”

The FBI is investigating. Senior Trial Attorneys Brian Mund and Vasantha Rao of the Justice Department’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorneys Alexander Mindlin and Lindsey Oken of the Eastern District of New York are prosecuting the case.

In joint guidance, the FBI and the Cybersecurity and Infrastructure Security Agency advise against paying ransoms, saying payment does not ensure data will be decrypted, that systems or data will no longer be compromised, or that data will not be leaked.

The Justice Department said the Computer Crime and Intellectual Property Section has secured convictions of more than 180 cyber and intellectual property criminals since 2020, along with court orders for the return of more than $350 million in victim funds.

An indictment is merely an allegation, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law, the Justice Department said.