Justice Department indicts Zohar Pinhasi over alleged ransomware recovery fraud

Federal case alleges more than $19 million in client charges

Federal prosecutors indicted Florida man Zohar Pinhasi last month on federal charges alleging that he defrauded clients of his Florida-based ransomware data recovery firm, MonsterCloud. The Justice Department says Pinhasi told customers he could restore encrypted files without paying hackers but instead paid ransom demands and charged victims additional fees. A U.S. Attorney’s Office spokesperson said Pinhasi pleaded not guilty.

The indictment closely matches findings in ProPublica’s 2019 article, “The Trade Secret,” which centered on Pinhasi and his business. ProPublica reported that ransomware clients were harmed twice: first by hackers who locked their files and demanded ransom, and again by MonsterCloud, which misled clients about whether the company paid hackers.

ProPublica interviewed MonsterCloud clients and ransomware experts for its investigation and found that the firm must have paid ransoms on behalf of clients in certain cases. Its services were particularly popular with local law enforcement agencies, which were reluctant to engage with or pay criminal hackers. Several clients interviewed at the time said they chose MonsterCloud because they believed the firm would never pay a ransom.

Federal investigators allege that Pinhasi charged clients more than $19 million and paid more than $8 million in ransom payments over the course of the scheme. In one example, Pinhasi made a ransom payment of about $8,200 and charged the client about $150,000. If convicted, Pinhasi faces up to 20 years in prison.

U.S. Attorney Joseph Nocella said in an Oct. 7 press release that his office would vigorously prosecute both ransomware attackers and those who profited from their criminal activity. Nocella said, “By falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself.” He added, “Our Office will vigorously prosecute ransomware attackers who prey on Americans from across the world and those who cynically profit from their criminal activity.”

An FBI official said in the Justice Department’s October press release that Pinhasi had “turned the victim’s crisis into his own profit center.” The official added, “This deception is unacceptable, and the FBI is committed to ensuring accountability for those who choose to victimize the very people who trusted them for help.”

In a 2019 interview, Pinhasi, who also went by the alias Zack Green, said MonsterCloud never promised clients that their data would be recovered by any particular method. “How we do it, it’s our problem,” he told ProPublica. “You will get your data back. Sit back, relax and enjoy the ride.” He called the company’s recovery methods a “trade secret.” ProPublica reported that Pinhasi hung up when reached on his cellphone this month and that messages left with a MonsterCloud representative and his attorney were not returned.

Pinhasi also described himself in 2019 as a former IT security intelligence officer for the Israeli military. He said MonsterCloud handled up to 30 calls a day and had about 20 employees in South Florida, as well as extensive global contacts.

When ProPublica published the 2019 investigation, ransomware was growing into one of the world’s most pervasive cyberthreats. Hackers locked data belonging to governments, schools and businesses and held the decryption key for a ransom payment, which they usually demanded in bitcoin and other types of difficult-to-trace cryptocurrency.

ProPublica’s reporting focused on how U.S. industries, from data recovery firms such as MonsterCloud to insurance companies that covered ransom payments, fueled the extortion economy. The outlet said ransomware remains a widespread threat today and that the threat to national security has grown as hackers linked to hostile foreign governments are believed to use ransomware as a cover for espionage. ProPublica also reported that the prevalence of AI tools is making it easier for attackers to spread ransomware.

The Justice Department did not address ProPublica’s 2019 finding that one FBI official was among Pinhasi’s associates at MonsterCloud. John Pistole, a former deputy director of the FBI under Robert Mueller, was prominently featured in a promotional video on MonsterCloud’s homepage. Pistole said in the video, “Police departments, government agencies, hospitals, small business and Fortune 500 firms trust MonsterCloud to help recover from attacks and protect against new ones.” He also said, “MonsterCloud’s proprietary technology and expertise protects their professional reputations and organizational integrity.”

In 2019, Pinhasi touted MonsterCloud’s law-enforcement ties as evidence of the company’s integrity. Pistole, who also headed the Transportation Security Administration under President Barack Obama, was listed on MonsterCloud’s website as the only member of its “Cyber Security Advisory Council.”

Pistole did not respond to a request for comment for this story. In a 2019 interview, he said he became acquainted with Pinhasi after MonsterCloud reached him through a speaker’s bureau and that MonsterCloud paid him indirectly through that group. He said Pinhasi scripted his testimonial and that he was well aware that, in most cases, including MonsterCloud’s, the only way to decrypt data locked by ransomware was to pay the hackers. “That’s the business model as I understood it,” Pistole told ProPublica at the time. He added, “Based on my experience and knowledge, ransom is paid and they facilitate the best practices moving forward.”

A U.S. Attorney’s Office spokesperson declined to comment on Pistole’s connection to MonsterCloud. Pistole was not mentioned by name in the Pinhasi indictment.