In short
- U.S. Department of Justice stated that in August 2023, Pinhasi paid approximately $8,200 in ransom and charged the client approximately $150,000.
- U.S. Department of Justice noted that since 2020, CCIPS has secured the conviction of over 180 cyber and IP criminals and court orders for the return of over $350 million in victim funds.
What happened
Zohar Pinhasi, owner of MonsterCloud, was arraigned in the Eastern District of New York on wire fraud charges for allegedly misrepresenting his ability to decrypt ransomware without paying cybercriminals. He is accused of charging clients substantially higher fees than the ransom payments he secretly made to attackers.
According to the indictment, Pinhasi claimed to use proprietary tools and advanced decryption techniques, but instead paid cybercriminals for decryption keys. Over the course of the scheme, he allegedly charged clients more than $19 million and paid more than $8 million in ransom payments.
MonsterCloud’s website cautioned clients not to pay the ransom and claimed that his team specialized in helping businesses recover their data without succumbing to ransom demands.
In numbers
- $19 million Total charged to clients
- $8 million Total ransom payments made
- over $350 million Victim funds returned since 2020
What compliance teams should check
- Review MonsterCloud client lists for exposure to fraudulent remediation practices.
- Cross-check ransom payment records from August 2023 for amounts of approximately $8,200 and client charges of approximately $150,000.
- Monitor CCIPS conviction and court order lists since 2020 for cyber and IP crime related to ransomware remediation.
Why it matters
This case highlights the risk of fraudulent actors exploiting ransomware victims by misrepresenting their remediation capabilities and secretly paying cybercriminals. Compliance officers must scrutinize third-party cybersecurity vendors and their claims, as such schemes can undermine anti-ransomware guidance and facilitate further criminal activity. The indictment also underscores the importance of following FBI and CISA guidance, which advises against paying ransoms, as payments do not guarantee data recovery or security and may perpetuate criminal networks.
Catch stories like these on your own customers.
complead screens your customers against adverse media, sanctions and PEP lists, and re-checks them every day. When a name you hold turns up in the news, it lands in your case queue with the evidence attached.