MonsterCloud Owner Charged with Fraud in Ransomware Decryptor Scheme

The U.S. Department of Justice (DoJ) announced charges on Wednesday against Zohar Pinhasi, a 50-year-old U.S. and Israeli national and owner of the incident response firm MonsterCloud. According to the DoJ, Pinhasi orchestrated a scheme to defraud ransomware victims by secretly paying the threat actors behind the attacks to obtain decryptors, while claiming to victims that he was using proprietary tools and methods to recover their data.

The indictment alleges that Pinhasi billed victims for proprietary data recovery services under false pretenses, when in fact he was simply paying the ransomware attackers directly to receive the decryptors. The fraud is estimated to have caused over $19 million in losses. The charges include two counts of wire fraud and one count of wire fraud conspiracy.

The case underscores the need for organizations to thoroughly vet incident response firms and demand transparency during ransomware recovery. Victims may have paid for services that were, in effect, facilitating ransom payments — a practice that carries its own risks and ethical considerations. The DoJ’s action serves as a warning to both victims and service providers in the ransomware response ecosystem.