What happened
The owner of ransomware remediation company MonsterCloud has been charged with defrauding ransomware victims by secretly paying their attackers for decryption keys while claiming to use proprietary technology to recover encrypted data. Zohar Pinhasi, 50, who also used the names "Zack Silver" and "Zack Green," was indicted by a federal grand jury in the Eastern District of New York on September 23 and arraigned on Wednesday in federal court in Brooklyn.
He faces one count of conspiracy to commit wire fraud and two counts of wire fraud. Prosecutors say the alleged scheme ran from June 2018 to June 2023. The US Attorney's Office told BleepingComputer that Pinhasi surrendered, pleaded not guilty and was released on a $2 million bond.
According to the indictment, Pinhasi owned and operated MonsterCloud LLC, a Florida based company that advertised tools for recovering encrypted data without paying cybercriminals. Prosecutors allege it had no such technology and instead contacted ransomware operators, paid for keys, and used those keys to restore customer files. Some contracts disclosed that the company might pay cybercriminals, the indictment says, but those contracts stated it would do so only if files could not be decrypted by other means, while dealing with attackers was usually the first step taken.
Customers were allegedly charged far more than the ransoms paid. One recovery cited in the indictment involved about $236,000 paid to a gang and roughly $380,000 charged to the victim. Prosecutors also say decrypted sample files were presented as "recovery proofs." In total, the scheme is alleged to have facilitated more than $8 million in ransom payments while charging hundreds of companies in the United States and Canada over $19 million. If convicted, Pinhasi faces up to 20 years in prison. A 2019 ProPublica investigation raised similar concerns, which he disputed at the time.
Why this is a GRC story
Vendor claims are a control environment question. Incident response is bought in a hurry, often without the diligence applied to any other critical supplier. When a provider's core selling point is a capability nobody can verify, the buyer is relying on marketing. Contract terms that describe a method, a decision point and who authorizes a payment are more useful than a promise of recovery.
Ransom payment governance is not optional. Sanctions exposure, disclosure duty and stakeholder trust all attach to the decision to pay, and that decision belongs with named executives under a documented process. The allegation here is that payments happened without the victim knowing.
Incident response needs its own evidence trail. A recovery engagement should produce a timeline, a description of the method used, and a record of what was paid, to whom and on whose authority.
What to watch
Watch whether the case prompts clearer disclosure expectations for incident response providers, since this is a fraud matter rather than a security failure. Watch also for how insurers respond, because a case built on secret payments gives them a reason to tighten verification of pre-approval.
The practical takeaway is short. Know who you would call during a ransomware event before you need to, ask how they recover data and whether any payment is involved, and put the authorization path in writing.
Attribution: Analysis based on BleepingComputer and related public reporting. This article is original commentary, not a repost of the source material.