DOJ charges ransomware recovery CEO for secretly paying hackers

What happened

DOJ charges ransomware (software that locks up files and demands payment) recovery CEO for secretly paying hackers, according to The Record. The owner of a ransomware recovery firm was hit with wire fraud charges for allegedly making secret ransom payments while overcharging the victims of attacks. and Israeli national Zohar Pinhasi was the owner of a company called MonsterCloud that purported to provide incident response to help victims of ransomware attacks.

The Florida-based company said it could help organizations recover their encrypted data without paying ransomware gangs, claiming to have “proprietary tools” and “advanced decryption techniques.” In court documents, prosecutors said Pinhasi simply paid ransoms and charged victims a fee that was significantly more than the original ransom demand.

After paying the ransomware gangs, he would get a decryption key and MonsterCloud employees would try to decrypt the organization’s files. said Pinhasi “re-victimized his clients while extracting a hefty profit for himself.”

In total, he charged clients $19 million and paid about $8 million in ransom payments to cybercriminals. In one 2023 incident cited in the indictment, Pinhasi allegedly paid a $8,200 ransom and charged the client $150,000. MonsterCloud did not respond to requests for comment.