Prosecutors: Zohar Pinhasi Swindled Victims by Secretly Paying Ransomware Demands

The Department of Justice has charged Zohar Pinhasi, the owner of a ransomware recovery firm, with wire fraud. The indictment alleges that Pinhasi secretly paid ransom demands to cybercriminals while simultaneously overcharging the victims of those attacks. According to The Record, the charges stem from allegations that the executive made clandestine payments to hackers while billing clients for services designed to help them avoid such payments.

In plain English

Ransomware recovery firms typically position themselves as alternatives to paying hackers. They promise to help organizations restore data and systems without handing over money to criminal groups. The DOJ alleges that Pinhasi’s company violated this trust. According to CyberScoop, Pinhasi deceived clients by disguising a payment scheme as a specialized service.

Instead of negotiating or restoring systems independently, the firm allegedly paid the hackers directly. Clients, believing they were hiring a service to avoid ransom payments, were reportedly overcharged for these efforts. The scheme allowed Pinhasi to pocket millions while the underlying criminal transactions occurred behind the scenes.

The background

The charges highlight the complexities and risks within the ransomware recovery industry. Victims of cyberattacks often face immense pressure to restore operations quickly. This desperation can make them vulnerable to fraudulent schemes that promise quick fixes. By alleging that Pinhasi engaged in wire fraud, the DOJ is targeting the financial mechanisms that support these illicit activities. The Record reports that the core of the case involves the secret nature of the ransom payments. CyberScoop adds that the indictment centers on the deception used to convince clients that they were engaging in a legitimate recovery process rather than facilitating ransom payments.

What changes now

With the indictment filed, Pinhasi faces criminal prosecution for the alleged fraud. This case may prompt increased scrutiny of ransomware recovery firms and their operational practices. Organizations seeking assistance after an attack may need to vet recovery partners more rigorously to ensure they are not inadvertently participating in illegal payment schemes. The legal action underscores the government’s focus on disrupting the financial flows that sustain ransomware operations, even when those flows are hidden behind third-party service providers.

Background: Ransomware

Ransomware is malicious software that encrypts your files, making them unreadable until you pay a fee. It often arrives via email attachments or malicious downloads. You can prevent it by keeping backups offline, updating software, and verifying links before clicking.

Read the full guide: Ransomware Explained: How File Locking Works and What to Do

What to do and how to stay safe: Zohar Pinhasi

• Vet ransomware recovery providers thoroughly to ensure they do not engage in direct payments to attackers.
• Review contracts with third-party incident response firms for clauses that might facilitate unauthorized ransom payments.
• Monitor financial transactions related to incident response for discrepancies or unexplained fees.
• Consult legal counsel to understand the liability implications of hiring recovery services that may violate federal law.

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who is being charged in this case?

Zohar Pinhasi, the owner of a ransomware recovery firm, is facing wire fraud charges.

What is the main allegation against Pinhasi?

He is accused of secretly paying ransom demands to hackers while overcharging victims for recovery services.

Did the victims know they were paying ransoms?

No, the indictment alleges that clients were deceived into believing they were paying for services that would help them avoid ransom payments.