MonsterCloud owner charged over secret ransomware payments

The owner of ransomware remediation company MonsterCloud has been indicted by a federal grand jury in the Eastern District of New York for allegedly defrauding ransomware victims, BleepingComputer reported. Zohar Pinhasi, 50, who also used the aliases Zack Silver and Zack Green, was charged with secretly paying attackers for decryptors while telling clients that his company used proprietary technology to restore encrypted data. [1]

According to BleepingComputer, Pinhasi was indicted on September 23 and was arraigned on Wednesday. Prosecutors allege that MonsterCloud promised victims a technical solution to recover their locked files, but instead secretly negotiated and paid the extortion demands directly to the ransomware operators. [1]

Ransomware is malware that encrypts files or exfiltrates private data, holding it hostage until a ransom is paid. Cybercriminals usually demand payment in cryptocurrency to make tracking difficult. Victims can sometimes restore files without paying if the ransomware contains coding errors, if cryptographic keys leak, or if the malware fails to apply encryption properly. [2]

Ransomware attacks date back to 1989 with the AIDS Trojan, which requested mail-in payments. Modern ransomware operators often use ransomware as a service models to distribute malware and engage in double extortion, stealing sensitive data before encrypting systems to threaten public disclosure. [3]