Ransomware recovery firm claimed it could decrypt files, but may have just paid hackers and pocketed the difference

Law enforcement agencies have long cautioned against paying ransomware gangs, pointing out their propensity to demand more money, refuse to provide decryption keys, or identify victims as potential payers. However, this caution now extends to companies offering to resolve such incidents. The US Department of Justice has indicted Zohar Pinhasi, known as Zack Silver and Zack Green, for fraud.

Pinhasi ran a Florida-based company, MonsterCloud, which allegedly offered decryption services for a fee, despite not possessing proprietary tools or advanced decryption techniques. Instead, it's alleged that MonsterCloud used part of the clients' fees to pay ransomware attackers and retained the rest, often with a significant markup.

For instance, Pinhasi reportedly charged a client $150,000 to decrypt their system, paid the hackers $8,200, and kept the remainder. Another case involved paying hackers around $236,000 and charging the customer $380,000. The indictment further alleges that MonsterCloud presented decrypted sample files as proof of its abilities, which were allegedly obtained directly from the ransomware operators themselves.

While the indictment paints a damning picture of the company's practices, Pinhasi claims he has pleaded not guilty and was released on a $2 million bond. A ProPublica investigation in 2019 found that companies like MonsterCloud typically just paid ransom and charged victims extra. At the time, Pinhasi denied any claims of misleading customers or promising a decryption service.