A Florida cybersecurity company owner who allegedly told ransomware victims that his firm could recover encrypted data without paying hackers is now facing federal wire fraud charges.
uncertain
firm → tell → charges
According to the US Department of Justice (DOJ), Zohar Pinhasi, 50, owner of ransomware remediation company MonsterCloud, claimed to have proprietary tools and advanced techniques for decrypting files.
uncertain
Pinhasi → accord → files
Prosecutors allege that his company instead paid the cybercriminals behind the attacks and charged clients substantially more for the recovery.
asserted
company → allege → recovery
The DOJ said Pinhasi allegedly collected more than $19 million from clients while secretly paying over $8 million in ransom.
uncertain
Pinhasi → say → ransom
What prosecutors allege
Pinhasi, who is also known as “Zack Silver” and “Zack Green,” was arraigned in federal court in Brooklyn on October 7 after being indicted by a grand jury in the Eastern District of New York on September 23.
asserted
who → allege → September
He is accused of defrauding clients who turned to MonsterCloud after their businesses were hit by ransomware.
asserted
businesses → accuse → ransomware
Ransomware attacks typically lock or encrypt a victim's computer files and demand payment in exchange for restoring access.
asserted
attacks → lock → access
According to the indictment described by the DOJ, Pinhasi presented MonsterCloud as an alternative to paying those demands.
uncertain
Pinhasi → accord → demands
The company's website reportedly advised businesses not to pay ransomware attackers and said its team could recover data without giving in to ransom demands.
uncertain
team → advise → demands
Pinhasi allegedly told prospective clients that MonsterCloud used “proprietary tools” and “advanced decryption techniques” to recover encrypted information.
uncertain
MonsterCloud → tell → information
Prosecutors, however, allege that the company did not possess any special technology capable of decrypting the ransomware as represented.
asserted
company → allege → ransomware
Instead, Pinhasi allegedly contacted the cybercriminals who had attacked his clients and paid them for decryption keys.
uncertain
who → contact → keys
MonsterCloud employees then used those keys in attempts to restore the affected files, according to the DOJ.
uncertain
employees → use → DOJ
Pinhasi allegedly concealed the ransom payments from clients while charging them fees that were substantially higher than the amounts paid to the attackers.
uncertain
that → conceal → attackers
One example cited by prosecutors illustrates the alleged markup.
asserted
example → cite → markup
In August 2023, Pinhasi allegedly paid approximately $8,200 to a cybercriminal for a decryption key.
uncertain
Pinhasi → pay → key
The client whose files had been encrypted was reportedly charged approximately $150,000 by MonsterCloud.
uncertain
files → encrypt → MonsterCloud
The difference between the ransom payment and the amount billed to the client was part of what prosecutors say made the alleged scheme profitable.
asserted
scheme → bill → client
Overall, Pinhasi allegedly charged MonsterCloud clients more than $19 million during the scheme.
uncertain
Pinhasi → charge → scheme
More than $8 million of that money was allegedly used to make ransom payments to cybercriminals.
uncertain
million → use → cybercriminals
The allegations also raise questions about the representations made to customers about MonsterCloud's technology.
asserted
allegations → raise → technology
The DOJ said that in May 2019, a paid spokesperson for the company asked Pinhasi whether MonsterCloud actually had proprietary software capable of decrypting ransomware.
uncertain
MonsterCloud → say → ransomware
Pinhasi allegedly responded that the company did not have proprietary technology to decrypt ransomware data.
uncertain
company → respond → data
Charges and possible penalty
Pinhasi faces two counts of wire fraud and one count of wire fraud conspiracy.
asserted
Pinhasi → face → conspiracy
If convicted, each count carries a maximum penalty of up to 20 years in prison, according to the DOJ.
uncertain
count → convict → DOJ
The FBI is investigating the case, while prosecutors from the Justice Department's Computer Crime and Intellectual Property Section and the Eastern District of New York's National Security and Cybercrime Section are handling the prosecution.
asserted
prosecutors → investigate → prosecution
The case also comes against the backdrop of federal warnings about ransomware payments.
asserted
case → come → payments
The FBI and the Cybersecurity and Infrastructure Security Agency have said they do not recommend paying ransomware demands because payment does not guarantee that files will be decrypted, systems will be restored or stolen information will not be leaked.
asserted
information → say → demands
For businesses facing a ransomware attack, the allegations in this case highlight another risk beyond the original cyberattack: relying on a service provider that may misrepresent how it is recovering encrypted data.
uncertain
it → face → data
Prosecutors allege that instead of providing the promised alternative to ransom payments, Pinhasi's company secretly paid the attackers and passed the cost on to already distressed victims at a substantial markup.
asserted
company → allege → markup
Pinhasi has not been convicted.
asserted
Pinhasi → convict → ?
The charges are allegations, and he is presumed innocent unless and until proven guilty beyond a reasonable doubt.
asserted
he → presume → doubt
The Aporia
