MonsterCloud CEO Pinhasi Accused of Buying Ransomware Decryption Keys to Resell to Victims
Federal prosecutors accuse Zohar Pinhasi of secretly buying decryption keys from ransomware gangs while charging victims full ransom amounts.
Key points
- The Department of Justice accuses MonsterCloud CEO Zohar Pinhasi of paying ransomware groups for decryption keys.
- Prosecutors allege Pinhasi simultaneously charged victims full ransom prices for those keys.
- The charges highlight a scheme where the intermediary profited from both sides of the attack.
The Department of Justice has formally accused Zohar Pinhasi, the chief executive officer of MonsterCloud, of engaging in a fraudulent scheme involving ransomware victims. According to reports from Hackread, federal prosecutors allege that Pinhasi secretly paid ransomware gangs to obtain decryption keys. This action stands in direct contradiction to the service MonsterCloud purportedly offered to its clients during cyberattacks.
In plain English
MonsterCloud positioned itself as a negotiator between companies hit by ransomware and the criminal groups holding their data hostage. Typically, these intermediaries help victims pay ransoms in exchange for tools to unlock their systems. The DOJ alleges that Pinhasi manipulated this process by paying the hackers a fraction of the total ransom demand. He then charged the victimized companies the full amount, keeping the difference as profit.
The background
This accusation reveals a potential conflict of interest inherent in some ransomware negotiation services. If an intermediary pays the criminal group directly, they control the decryption keys. The charges suggest that Pinhasi exploited this control to defraud the very clients seeking help. According to Hackread, the DOJ’s complaint centers on this dual role of paying attackers while billing victims.
What changes now
The legal action against Pinhasi brings scrutiny to the broader ecosystem of ransomware negotiation firms. Security operations teams may need to re-evaluate their relationships with third-party intermediaries. The allegations indicate that not all negotiators act solely in the interest of the victim. Organizations must verify the transparency of any external partners involved in incident response.
Background: Ransomware
Ransomware is malicious software that encrypts your files, making them unreadable until you pay a fee. It often arrives via email attachments or malicious downloads. You can prevent it by keeping backups offline, updating software, and verifying links before clicking.
Read the full guide: Ransomware Explained: How File Locking Works and What to Do
What to do and how to stay safe: MonsterCloud
- Vet any third-party ransomware negotiation firms thoroughly to ensure they disclose all financial arrangements with attackers.
- Review incident response plans to include strict oversight of external consultants handling ransom payments or data recovery.
- Monitor official government advisories for updates on sanctioned entities or individuals involved in ransomware ecosystems.
- Ensure internal teams understand the legal risks associated with paying ransoms without verified, transparent intermediaries.
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who is Zohar Pinhasi?
He is the CEO of MonsterCloud, a company accused by the DOJ of defrauding ransomware victims.
What did the DOJ accuse Pinhasi of doing?
Prosecutors allege he secretly paid ransomware gangs for decryption keys while charging victims the full ransom amount.
Did MonsterCloud admit to these charges?
The source material reports the DOJ’s accusations but does not state that Pinhasi or MonsterCloud have admitted guilt.
