A cybersecurity firm that promised firms it could decrypt ransomware was in fact just paying the hackers, running their key, then marking up the work at large margins.
That’s according to an eye-opening indictment this week.
Prosecutors allege that the company in question, MonsterCloud, never had the "proprietary tools" nor "advanced decryption techniques" it advertised.
Company boss Zohar Pinhasi, 50, a U.S. and Israeli national also known as "Zack Silver" and "Zack Green," was arraigned in the Eastern District of New York on October 7 on two counts of wire fraud and one count of wire fraud conspiracy.
The indictment says MonsterCloud's website told victims not to pay ransoms and promised to recover their data without doing so. Instead, Pinhasi allegedly ran a simple arbitrage play. He contacted the attackers, paid for a decryption key, effectively resold that as in-house technology and ran it against encrypted file.
The margins were wide. Prosecutors say that in August 2023, Pinhasi allegedly paid a cybercriminal about $8,200 and billed the client about $150,000; a markup of more than 18x. Across the scheme, he allegedly charged clients more than $19 million and paid more than $8 million in ransoms; a gross spread of roughly $11 million.
Assistant Attorney General A. Tysen Duva said that the defendant "victimized the victim again." FBI Assistant Director James C. Barnacle Jr. said in a Department of Justice release that Pinhasi turned "the victim's crisis into his own profit center."
The FBI and CISA advise against paying ransoms. Payment does not ensure data is decrypted, systems are clean and secure, nor that stolen data stays private.
Each count carries a maximum sentence of 20 years.
The FBI is investigating. Prosecutors from the Justice Department's Computer Crime and Intellectual Property Section and the Eastern District of New York are handling the case. Pinhasi is, of course, presumed innocent until proven guilty.
Another recent investigation by the FBI and Justice saw the arrest and successful prosecution of Cameron John Wagenius, 22, an Army soldier who has been sentenced to 70 months in prison for conspiring to hack into telecommunications companies’ databases, access sensitive records, and extort the companies by threatening to release the stolen data unless ransoms were paid.
