MonsterCloud Owner Charged in Alleged Ransomware Fraud

Federal prosecutors charged Zohar Pinhasi, owner of ransomware recovery company MonsterCloud, with allegedly defrauding clients by secretly paying attackers for decryption keys while billing victims substantially more. The allegations concern a scheme prosecutors say ran from June 2018 through June 2023; the charges are not findings of guilt. An indictment returned by a federal grand jury in the Eastern District of New York charges Pinhasi with two counts of wire fraud and one count of conspiracy to commit wire fraud. Prosecutors allege he represented that MonsterCloud could restore encrypted files with proprietary technology, while instead contacting ransomware operators and paying for keys to unlock clients’ data. According to prosecutors, Pinhasi and associates charged clients more than $19 million for recovery services while facilitating more than $8 million in ransom payments. In one example from August 2023, Pinhasi allegedly paid about $8,200 for a decryption key and billed a client about $150,000. The indictment also cites an alleged transaction in which about $236,000 was paid to attackers and the client was charged roughly $380,000.