CyberNew CyberNew
Ransomware & Malware SecurityWeek 1 week ago

Fake Decryption Tools Masked $11M Markup in Ransomware Recovery Scheme

CN
CyberNew Threat Research Desk
• Original Reporting: SecurityWeek
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Cloud & Distributed Infrastructure
Intelligence Sector
Ransomware & Malware

Analyst Takeaway

"The owner of a US company was charged with defrauding clients through a ransomware remediation scheme. Zohar Pinhasi, 50, the owner of MonsterCloud, a US and Israeli national also known as ‘Zack Silver’ and ‘Zack Green’, appeared in a New York court to face wire fraud charges. According to the indictment, Pinhasi claimed that MonsterCloud could help organizations that fell victim to ransomware to..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
Ransomware

The owner of a US company was charged with defrauding clients through a ransomware remediation scheme.

Zohar Pinhasi, 50, the owner of MonsterCloud, a US and Israeli national also known as ‘Zack Silver’ and ‘Zack Green’, appeared in a New York court to face wire fraud charges.

According to the indictment, Pinhasi claimed that MonsterCloud could help organizations that fell victim to ransomware to recover their data without paying the attackers.

While cautioning ransomware victims not to pay the attackers, Pinhasi allegedly falsely claimed his company could decrypt ransomware.

Pinhasi allegedly claimed that MonsterCloud was using proprietary tools and advanced decryption techniques to recover encrypted data without paying the attackers.

Instead, he contacted the ransomware groups that hacked his clients, paid ransoms to obtain the decryption keys, and then charged the victim organizations a fee when using the decryption key to restore the data.

Advertisement. Scroll to continue reading.

In one instance, he made a ransom payment of approximately $8,200 to a ransomware affiliate, and then charged the client approximately $150,000.

Written By Ionut Arghire

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from SecurityWeek.

Primary Advisory →