MonsterCloud, a Florida ransomware-recovery company, promoted a way for businesses to recover files locked by attackers without paying them. In a federal indictment, prosecutors allege its owner did the opposite, secretly buying decryption keys from the attackers and charging clients substantially more for the service.
Zohar Pinhasi was arraigned Oct. 7 in Brooklyn on two counts of wire fraud and one count of conspiracy to commit wire fraud, the Justice Department said. Prosecutors allege MonsterCloud’s clients paid the firm more than $19 million as Pinhasi sent over $8 million in ransom payments to cybercriminals.
The company’s website cautioned against paying ransoms and advertised “advanced decryption techniques.” According to the indictment, Pinhasi lacked the proprietary technology he marketed. MonsterCloud employees allegedly used keys bought from the criminals to attempt recovery of clients’ data. Some clients had turned to the firm while ransomware was disrupting their operations.
How the recovery sales worked
The supposed decryption method was built into the sales process, prosecutors allege. MonsterCloud first charged customers about $2,500 to $10,000 for an analysis and provided decrypted sample files as “recovery proofs.” In many cases, those samples had been shared with the attackers, who supplied the decrypted versions. Clients were then apparently offered a more expensive recovery service.
Some contracts allowed for possible contact with or payment to attackers. Certain contracts said the attackers would be contacted only after other decryption methods had been exhausted. Prosecutors allege Pinhasi generally approached the attackers first. Multiple clients chose MonsterCloud specifically to avoid paying criminals and would not have authorized such payments, the indictment says.
Pinhasi also allegedly told staff to call a decryptor a “recovery tool” and presented his methods to clients as trade secrets. In a 2019 exchange cited in the indictment, a paid spokesperson who had provided a website testimonial asked whether MonsterCloud actually had proprietary decryption software. Pinhasi replied: “MonsterCloud doesn’t hold any Proprietary technology [to] decrypt the ransomware data.”
MonsterCloud’s recovery practices had also drawn scrutiny in 2019. A ProPublica investigation reported that the company sometimes paid attackers without informing clients. Pinhasi denied misleading customers at the time and said the firm’s recovery methods varied by case.
In one alleged transaction in August 2023, Pinhasi paid about $8,200 for a decryption key and charged the client roughly $150,000, nearly 20 times the ransom. In another from October 2021, the alleged ransom payment was $236,000 and the client bill was $380,000.
Clients and recovery outcomes
Prosecutors allege hundreds of companies across the United States and Canada paid MonsterCloud for recovery services. The indictment describes two alleged victims, a home-decor company and a display manufacturer in New York, without identifying them. The indictment does not establish how many clients recovered all their data or whether the underlying security problems were resolved.
Federal ransomware guidance from CISA, the FBI and other agencies warns that paying attackers does not guarantee data recovery or ensure that systems are no longer compromised.
Pinhasi faces up to 20 years in prison on each count if convicted. The charges remain allegations, and he is presumed innocent unless proven guilty.