Florida Man Indicted for Defrauding Clients Over Ransomware Recovery

A man from Florida, Zohar Pinhasi, was indicted last month on federal charges for fraud related to his ransomware data recovery firm. This case stems from a 2019 ProPublica investigation that first uncovered Pinhasi’s deceptive practices.

The Justice Department states that Pinhasi assured clients he could retrieve their encrypted files without paying the ransom demands. In reality, he paid the ransom and then overcharged clients significantly. This indictment aligns with findings from ProPublica’s 2019 article titled “The Trade Secret,” which had focused on Pinhasi’s fraudulent activities.

The investigation revealed how victims of ransomware were doubly harmed. Initially, hackers encrypted their files and demanded payment. Subsequently, MonsterCloud, Pinhasi’s company based in Florida, misled these victims by falsely claiming they did not pay ransoms. “By falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself,” stated U.S. Attorney Joseph Nocella in an October statement.

Ransomware attacks continued their surge when ProPublica released this story in 2019. Cybercriminals targeted various sectors, including governments, schools, and businesses, demanding ransom usually in hard-to-track cryptocurrencies like bitcoin. ProPublica reported on how data recovery firms like MonsterCloud and insurance companies contributed to the extortion economy.

Ransomware remains a significant threat with increasing ties to national security concerns. Hackers connected to hostile governments are suspected of using ransomware for espionage. Additionally, advancements in AI tools are making it easier for these attackers to distribute ransomware effectively.

Pinhasi, utilizing the alias Zack Green, told ProPublica in 2019 that MonsterCloud never guaranteed a specific method for data recovery. He described their practices as a “trade secret.” Attempts to contact Pinhasi this month were unsuccessful, with neither he nor his attorney responding.

In the 2019 probe, ProPublica interviewed several of MonsterCloud’s clients and ransomware experts. The investigation concluded that in multiple instances, the firm had indeed paid ransoms on behalf of its clients. MonsterCloud was especially popular with local law enforcement agencies, which are reluctant to engage with criminal hackers directly.

Pinhasi, claiming to be a former IT security officer for the Israeli military, said that MonsterCloud received up to 30 calls daily and employed around 20 people in South Florida. Federal investigators estimated that Pinhasi defrauded clients of over $19 million, using more than $8 million for ransom payments. In one case, he paid approximately $8,200 in ransom but charged the client nearly $150,000.

If convicted, Pinhasi could face up to 20 years in prison. An FBI official condemned his actions, saying, “He turned the victim’s crisis into his own profit center. This deception is unacceptable, and the FBI is committed to ensuring accountability for those who choose to victimize the very people who trusted them for help.”

The ProPublica report from 2019 pointed out a connection between MonsterCloud and the FBI, noting that John Pistole, a former deputy FBI director, featured in a promotional video for MonsterCloud. In the video, Pistole endorsed the company’s services, highlighting how police, governmental organizations, and businesses trusted MonsterCloud. However, the indictment against Pinhasi does not mention Pistole.

ProPublica’s 2019 findings noted Pinhasi’s emphasis on MonsterCloud’s law enforcement connections as a mark of integrity. Pistole, who also led the Transportation Security Administration, was cited as the sole member of MonsterCloud’s “Cyber Security Advisory Council.” Interviews with both ProPublica and Pistole in 2019 reflected his awareness that ransom payments were a common method to unlock ransomware-encrypted data.

A spokesperson for the U.S. Attorney’s Office abstained from commenting on Pistole’s association with MonsterCloud.