MonsterCloud CEO Accused of Ransomware Payments to Cybercriminals

Post Views: 10

MonsterCloud CEO Zohar Pinhasi faces criminal charges for allegedly orchestrating secret payments to ransomware groups, according to federal authorities.

Indictment Details

Zohar Pinhasi, owner of MonsterCloud LLC, was indicted by a federal grand jury in the Eastern District of New York on September 23. He appeared in Brooklyn federal court, entered a not guilty plea, and was released on a $2 million bond.

Alleged Scheme

Prosecutors allege that MonsterCloud misrepresented its capabilities by claiming to offer decryption services without engaging with cybercriminals. Instead, the company allegedly contacted ransomware operators directly, paid for decryption keys, and used those keys to restore data for clients.

Timeline of the Scheme

The scheme reportedly spanned from June 2018 to June 2023. Pinhasi faces one count of conspiracy to commit wire fraud and two counts of wire fraud.

Financial Misconduct

Customers were reportedly charged significantly higher fees than the amounts paid to ransomware groups. For example, in one instance, Pinhasi paid approximately $8,200 to a ransomware collective while billing a victim $150,000 for recovery services.

Recovery Proofs

Prosecutors claim that MonsterCloud provided decrypted sample files as evidence of its ability to restore data, but these files were allegedly obtained using keys acquired from ransomware groups.

Previous Investigations

A 2019 ProPublica report highlighted claims that MonsterCloud sometimes paid ransomware operators while marketing itself as an alternative to direct negotiations with attackers. Pinhasi denied allegations at the time, stating his company did not guarantee decryption and that its methods varied per case.

Financial Impact

Pinhasi and his associates are accused of facilitating over $8 million in ransom payments while charging businesses in the U.S. and Canada more than $19 million for remediation services.

Legal Consequences

If convicted, Pinhasi could face up to 20 years in prison. Authorities emphasize that the allegations are not yet proven in court.

“The case underscores ongoing scrutiny of companies that claim to mitigate ransomware threats while allegedly collaborating with attackers.”

Conclusion

The charges against Zohar Pinhasi highlight the complexities of cybersecurity firms operating in a gray area between legitimate data recovery and potential collusion with cybercriminals.