MonsterCloud CEO charged over alleged secret ransomware payments

Zohar Pinhasi, owner of ransomware recovery company MonsterCloud, has been charged with conspiracy to commit wire fraud and two counts of wire fraud. Prosecutors allege the company secretly paid ransomware operators for decryption keys while telling customers it used proprietary technology to recover encrypted data.

A federal grand jury in the Eastern District of New York indicted Pinhasi on September 23. He pleaded not guilty and was released on a $2 million bond, according to the U.S. Attorney’s Office. The alleged scheme ran from June 2018 to June 2023.

The indictment says MonsterCloud advertised ways to recover files without paying attackers, but prosecutors allege it usually contacted ransomware operators first. Some contracts disclosed that the company might communicate with or pay attackers if it could not decrypt files by other means.

In one case cited by prosecutors, Pinhasi allegedly paid a ransomware gang about $8,200 and charged a customer approximately $150,000. In another, he allegedly paid approximately $236,000 and charged about $380,000. Prosecutors say the alleged scheme facilitated more than $8 million in ransom payments and brought in more than $19 million in fees from companies in the United States and Canada.

Pinhasi faces up to 20 years in prison if convicted. BleepingComputer said it contacted his attorneys for comment. The allegations have not been proven in court.