MonsterCloud Owner Accused of Billing Over $19M While Secretly Paying Ransoms to Decrypt Data

Zohar Pinhasi

Zohar Pinhasi, also known by aliases Zack Silver and Zack Green, is the central figure in this case, accused by the U.S. Department of Justice of orchestrating a fraudulent scheme. Pinhasi, a dual U.S. and Israeli national, allegedly operated MonsterCloud, a company that purported to offer advanced solutions for ransomware recovery. The charges, including wire fraud and conspiracy, stem from his alleged practice of misrepresenting his company's capabilities to desperate clients.

Instead of employing the 'proprietary tools' and 'advanced decryption techniques' advertised on MonsterCloud's website, Pinhasi is accused of directly negotiating with and paying cybercriminals to obtain the necessary decryptors. This clandestine operation allowed him to present a facade of successful data recovery while secretly engaging with the very entities his clients were trying to combat. The DOJ's indictment paints a picture of a calculated deception designed to maximize personal profit at the expense of victims already in distress.

MonsterCloud

MonserCloud, the Florida-based company owned by Pinhasi, is at the heart of the alleged fraud. The company's public-facing materials, including its website, promoted a strong stance against paying ransoms, advising clients that doing so "only serves to encourage and reward their illegal behavior." It also claimed to possess "extensive experience working with ransomware perpetrators" and sometimes resorting to "other means to resolve the ransomware incident for our clients," with terms disclosed in service contracts.

However, the reality, as alleged by prosecutors, was starkly different. The company's claims of specialized decryption tools were reportedly false. Instead, Pinhasi allegedly acted as an intermediary, paying ransoms himself and then marking up the cost substantially before billing the clients. This created a profitable business model where the client's crisis directly fueled Pinhasi's income, with the company's purported ethical stance serving as a cover for its illicit activities.

$19 Million in Alleged Fraud

The scale of the alleged financial misconduct is substantial, with Pinhasi accused of charging clients over $19 million in total fees. Against this, he is said to have paid out more than $8 million in ransom payments to cybercriminals. The disparity between the amounts billed and the amounts paid to attackers represents the alleged profit margin Pinhasi secured through his deceptive practices.

Specific examples cited by the Department of Justice illustrate the magnitude of the alleged overcharging. In one instance in August 2023, a ransom payment of approximately $8,200 was allegedly billed to a client for around $150,000. Another case from October 2021 involved a ransom payment of roughly $236,000, with the client being charged approximately $380,000. These figures underscore the significant markups and the extent to which Pinhasi allegedly exploited his clients' vulnerability for personal gain.