How Did MonsterCloud Owner Inflate Fees By Paying Ransoms Instead Of Decrypting?

Zohar Pinhasi, the owner of ransomware remediation firm MonsterCloud, has been arraigned in New York on wire fraud charges. According to district attorney Joseph Nocella, Pinhasi is accused of defrauding clients by falsely claiming he could recover encrypted data without paying ransom demands. The charges relate to operations conducted through MonsterCloud, which marketed itself as a technical alternative to extortion.

Root cause

The core allegation involves a deceptive business model rather than a software vulnerability. MonsterCloud’s website stated that its team specialized in helping businesses recover data without succumbing to ransom demands, implying the use of proprietary decryption techniques. However, the indictment alleges that Pinhasi did not use any technology to bypass encryption. Instead, he reportedly paid cybercriminals directly in exchange for decryption keys, which employees then used to unlock client files.

Attack path

Pinhasi allegedly exploited the urgency of ransomware victims who sought to avoid paying criminals. By marketing MonsterCloud as a service that could technically decrypt files, he attracted businesses facing data encryption attacks. The indictment claims he then contacted the ransomware operators, paid the ransom, and obtained the necessary decryption keys. He subsequently charged his clients a fee that was substantially higher than the amount paid to the cybercriminals, keeping the difference as profit.

Affected versions

The fraud targeted clients of MonsterCloud who sought data recovery services. Specific technical versions of ransomware or software are not cited in the charges, as the issue pertains to the service provider's conduct. District attorney Joseph Nocella stated that the defendant re-victimized his clients while extracting a hefty profit for himself. The scheme relied on the clients' belief that technical decryption was occurring, rather than a negotiated payment to attackers.

Mitigation

No technical patch exists for this fraud, as it involves criminal conduct by a service provider. Organizations seeking ransomware remediation should verify the legitimacy of third-party responders. The indictment highlights that Pinhasi operated under aliases, including “Zack Silver” and “Zack Green,” alongside his name Zohar Pinhasi. Due diligence in vetting incident response firms is essential to avoid engaging with entities that may facilitate ransom payments covertly.

What to do and how to stay safe: MonsterCloud

• Verify the credentials and legal standing of any third-party incident response or remediation firm before engaging their services.
• Request detailed technical documentation of decryption methods used by responders to ensure they are not simply paying ransoms.
• Monitor financial transactions closely during incident response to identify any unexpected payments to external parties or discrepancies in fees.
• Consult with legal counsel to understand the implications of paying ransoms or using unverified third parties for data recovery.

Step-by-step guide: Ransomware Incident Response: Stop the Spread and Recover Data

General security guidance from the CloudSec Press newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who is accused of paying ransoms while claiming to decrypt data?

Zohar Pinhasi, the owner of MonsterCloud, is accused of paying cybercriminals for decryption keys while charging clients higher fees.

What charges has Zohar Pinhasi faced?

Pinhasi has been arraigned in New York on wire fraud charges for allegedly defrauding clients of his ransomware remediation company.

Did MonsterCloud use technical methods to decrypt files?

No, the indictment alleges that Pinhasi did not use technology but instead paid ransoms to obtain decryption keys from cybercriminals.