CEO of Ransomware Recovery Firm Indicted on Allegations of Defrauding Victims

According to ProPublica’s 2019 investigation and announcements by ProPublica and the Justice Department, MonsterCloud CEO Zohar Pinhasi (also known as “Zack Green,” among other aliases) told customers he could decrypt encrypted data without paying hackers, while in reality he paid ransoms and then charged customers large fees. A federal grand jury has indicted Pinhasi in the matter (sources: Justice Department, ProPublica).

Federal investigators say Pinhasi billed customers a total of more than $19 million, and that over $8 million of those funds were used to pay ransoms, with specific amounts cited. Reporting cites an example in which a roughly $8,200 ransom payment was followed by a bill to the customer of about $150,000. Pinhasi is reported to be denying the charges.

As background, ProPublica’s 2019 reporting highlighted how data recovery firms and insurers can encourage or enable ransom payments, contributing to repeat victimization in ransomware incidents. MonsterCloud reportedly provided services to local police and public agencies, and some customers chose the company because it promised to handle recovery without the customer dealing directly with external parties.

Reports also note MonsterCloud’s use of prominent figures in its advertising, including a former FBI deputy director; that individual’s name does not appear in the indictment, but past promotions and testimony have drawn attention. The Justice Department and the FBI say the defendant profited from victims’ crises, and describe the indictment as part of broader investigations and prosecutions targeting firms that exploit ransomware victims.