Ransomware fixer claimed he could decrypt files, allegedly defrauded clients instead

The United States Department of Justice has accused a man, Zohar Pinhasi, of fraud after allegedly deceiving clients into believing he could decrypt files locked by ransomware. Instead, prosecutors allege that Pinhasi paid the ransoms himself, reaping substantial profits from the scheme. Known online as "Zack Silver" and "Zack Green," Pinhasi ran a Florida company called MonsterCloud.

According to a DOJ press release, the charges stem from Pinhasi's claim to have proprietary tools and advanced decryption techniques to recover encrypted data without paying cybercriminals. In reality, the indictment suggests, Pinhasi used client fees to pay off ransomware attackers and retained the remainder for himself, often charging a significant markup.

In one instance, Pinhasi reportedly charged a client $150,000, paid an $8,200 ransom, and kept the rest, though he did not disclose the ransom payment. The indictment states that MonsterCloud's website promoted the company's use of advanced decryption techniques and a "cutting-edge technology" team, despite allegations that this was a hollow claim.

MonsterCloud allegedly featured testimonials from clients, including one paid spokesperson, who questioned Pinhasi about the company's ability to decrypt data. Pinhasi reportedly denied such capabilities, stating the company had no proprietary technology to decrypt ransomware data. He faces two counts of wire fraud and one of wire fraud conspiracy, with potential penalties of up to twenty years per count if convicted.

The FBI is investigating the case, and further charges may follow due to the involvement of multiple co-conspirators, including MonsterCloud employees and contractors.