A joint US-Israeli national who took advantage of ransomware victims to extract millions of dollars under false pretences has made his first appearance in a New York court.
Zohar Pinhasi, aka Zack Silver and Zack Green, aged 50, stands accused of multiple charges relating to a scheme in which he allegedly claimed he could decrypt ransomware on the victim’s behalf so that they could avoid paying off the cyber criminals.
To do this, Pinhasi operated a company called MonsterCloud, offering a ‘principled’ alternative to giving in to extortion. He made representations to distraught business owners who had been victimised by ransomware gangs, claiming he had access to ‘proprietary tools’ and ‘advanced decryption techniques’ that could help them out of a pickle.
The court alleges that in reality, Pinhasi had access to no such technology. All the time he was actually charging MonsterCloud clients a recovery fee that was significantly higher than the original ransom demand, and then secretly paying the ransom himself.
In one case, the court heard how in August 2023 Pinhasi made a ransom payment of $8,200 while charging the client $150,000. It is thought that over the years, he charged clients over $19m and paid out $8m to cyber criminals, equating to a profit of approximately $11m.
“The defendant is charged with offering an alternative to ransom payments, but instead is alleged to have victimised the victim again and committed additional fraud, harming the victim again,” said assistant attorney general A Tysen Duva of the Criminal Division of the US Department of Justice (DoJ).
“This prosecution underscores the Department’s commitment to protecting ransomware victims, regardless of how these cyber ransoms occur.”
“As alleged in the indictment, by falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself,” said US attorney Joseph Nocella, Jr. of the Eastern District of New York.
“Our Office will vigorously prosecute ransomware attackers who prey on Americans from across the world and those who cynically profit from their criminal activity.”
“As alleged, Zohar Pinhasi claimed to fix ransomware while never remediating the underlying threat. Instead, he turned the victim’s crisis into his own profit centre,” added assistant director James Barnacle Jr. of the FBI. “This deception is unacceptable, and the FBI is committed to ensuring accountability for those who choose to victimise the very people who trusted them for help.”
Pinhasi, who was the subject of a ProPublica investigation in 2019, has been charged with two counts of wire fraud and one of wire fraud conspiracy, and faces a maximum penalty of 20 years in prison for each offence, should he be convicted.
Official guidance from the US authorities recommends that ransomware victims do not pay off their attackers as this does not ensure the data will be decrypted and not leaked. The UK’s National Cyber Security Centre (NCSC) takes the same position, saying that to pay ransoms also heightens the probability that victims may be targeted again in the future.
