Cybersecurity CEO Indicted For Allegedly Scamming Millions From Ransomware Victims (propublica.org) 37
An anonymous reader quotes a report from ProPublica: A Florida man who was the subject of a 2019 investigation by ProPublica was indicted last month on federal charges that he defrauded clients of his ransomware data recovery firm. According to the Justice Department, the man, Zohar Pinhasi, told customers he could recover their encrypted files without having to pay hackers, when, in reality, he paid the ransom and charged victims a hefty fee on top. The indictment mirrors the findings from ProPublica's 2019 article "The Trade Secret," which centered on Pinhasi and his scheme.
The outlet found that the ransomware victims were being harmed twice: once by the hackers, who locked their targets' files and demanded ransom, and a second time by MonsterCloud, Pinhasi's Florida-based data recovery firm, which misled its clients about not paying ransoms. "By falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself," U.S. Attorney Joseph Nocella said in an Oct. 7 press release. "Our Office will vigorously prosecute ransomware attackers who prey on Americans from across the world and those who cynically profit from their criminal activity." [...] Pinhasi, who went by the alias Zack Green, told ProPublica in 2019 that MonsterCloud never promised clients that their data will be recovered by any particular method. "How we do it, it's our problem," he told ProPublica. "You will get your data back. Sit back, relax and enjoy the ride." He called MonsterCloud's data recovery methods a "trade secret."
[...] Federal investigators found that, over the course of the scheme, Pinhasi allegedly charged clients more than $19 million and paid more than $8 million in ransom payments. In one example, Pinhasi made a ransom payment of about $8,200 but charged the client about $150,000. If convicted, he faces up to 20 years in prison. [...] In 2019, Pinhasi touted MonsterCloud's ties to law enforcement as evidence of its integrity. Pistole, who also headed the Transportation Security Administration under President Barack Obama, was listed on MonsterCloud's website as the only member of its "Cyber Security Advisory Council."
The outlet found that the ransomware victims were being harmed twice: once by the hackers, who locked their targets' files and demanded ransom, and a second time by MonsterCloud, Pinhasi's Florida-based data recovery firm, which misled its clients about not paying ransoms. "By falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself," U.S. Attorney Joseph Nocella said in an Oct. 7 press release. "Our Office will vigorously prosecute ransomware attackers who prey on Americans from across the world and those who cynically profit from their criminal activity." [...] Pinhasi, who went by the alias Zack Green, told ProPublica in 2019 that MonsterCloud never promised clients that their data will be recovered by any particular method. "How we do it, it's our problem," he told ProPublica. "You will get your data back. Sit back, relax and enjoy the ride." He called MonsterCloud's data recovery methods a "trade secret."
[...] Federal investigators found that, over the course of the scheme, Pinhasi allegedly charged clients more than $19 million and paid more than $8 million in ransom payments. In one example, Pinhasi made a ransom payment of about $8,200 but charged the client about $150,000. If convicted, he faces up to 20 years in prison. [...] In 2019, Pinhasi touted MonsterCloud's ties to law enforcement as evidence of its integrity. Pistole, who also headed the Transportation Security Administration under President Barack Obama, was listed on MonsterCloud's website as the only member of its "Cyber Security Advisory Council."
Re: Unethical but was it illegal? (Score:5, Informative)
It's not illegal unless you tell him you're going to get him the best price and then knowingly don't. That's fraud.
Re: (Score:1)
If you use that as an absolute standard, wouldn't it put a lot of other businesses in the crosshairs too?
When three businesses all have a sign in the window that says "Best price on Rugs!", should two of them be prosecuted for fraud?
Re: Unethical but was it illegal? (Score:2)
I think they should, yes, but when advertising is employed I'm that way hyperbole seems allowed. Also they can claim they will match prices if you ask.
Re: (Score:2)
It's not illegal unless you tell him you're going to get him the best price and then knowingly don't. That's fraud.
There is no definition of "best price." In fact, the process you describe above is exactly what car dealers do all day every day. Walk in to a Toyota dealer, tell them you want a new Rav4 (with specific specs, color, etc.), and will agree to pay $45,000. If the dealer doesn't already have one, they look around other dealers or with Toyota and find one to deliver to you. It might cost them $40,000, or $35,000, but if they are unlucky or made a bad deal it might also cost them $48,000. The fact that they may
Re: Unethical but was it illegal? (Score:5, Insightful)
Re: Unethical but was it illegal? (Score:2)
It's not illegal to pay off a ransom for your data. It should be, but it isn't.
Re: (Score:2)
It's not illegal to pay off a ransom for your data. It should be, but it isn't.
It depends.
It is illegal if the ransom is being paid to an entity that is sanctioned or in a sanctioned country such as Russia, Iran, North Korea, etc.
It does not matter that the payer didn't know the ransom is coming from a sanctioned country, the payer is breaking the law.
Here's a source for checkng present sanctions. https://ofac.treasury.gov/ [treasury.gov]
"The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced that paying ransom to cybercriminals is now illegal. In an official a
Re: Unethical but was it illegal? (Score:5, Informative)
Re: (Score:1)
Re: (Score:1)
Right or wrong isn't at issue here.
Someone is being charged with a crime, so we're discussing matters around what constitutes legal versus illegal.
Please do try to keep up.
that is an jury question with an lot of contract l (Score:2)
that is an jury question with an lot of contract law to go over.
Re: Unethical but was it illegal? (Score:2)
Success rate? (Score:2)
I'd be curious to know how often he was able to successfully get the files decrypted after paying the ransom. Did the hackers decrypt the files 100% of the time after the ransom was paid?
Re: (Score:3)
Re:Success rate? (Score:4, Insightful)
The thing about ransomware is that if paying the ransom does not actually result in decrypted files no one will ever pay a ransom again.
Many of your victims won't be able to say anything even if the files aren't decrypted -- this case is a good example, since the company in question couldn't admit publicly that they were paying ransoms.
A little searching shows that scams (beyond the base "pay to decrypt") are very common. You're dealing with criminals. If you pay a ransom, they now know that you have money that you're willing to pay, and they're going to do whatever they can to get more of it.
Re: (Score:2)
You're speculating wildly about things you could simply look up and know.
Guess the country (Score:2, Interesting)
https://www.propublica.org/art... [propublica.org]
"Pinhasi, who described himself to ProPublica as a former IT security intelligence officer for the Israeli military, said in 2019 that MonsterCloud handled up to 30 calls a day and had about 20 employees in South Florida as well as extensive global contacts."
But of course, when Israeli intelligence is absorbed into positions of power at amazon, google, meta, etc., it's somehow considered a good thing.
vote against AIPAC (Score:3)
Re: (Score:2)
Zei is right 95% of the time, and horseshoe theory is the sword on which the politically illiterate continue to proudly impale themselves
Re: (Score:2)
Re: (Score:2)
Now, if he had any smarts, he'd let it be known that a "failure to deliver decrypted files" would be met by the same Mossad group that knocked on Gerald Bull's door. Forget about repairing file systems. This is a well demonstrated skill set.
Wire Fraud (Score:5, Informative)
For those unable to chase links; he's been charged with Wire Fraud.
https://www.justice.gov/usao-e... [justice.gov]
Don't understand (Score:2)
Re: (Score:2)
I would assume places felt unsure they'd really get their data back by paying the scammers who locked their files down in the first place.
There are plenty of stories about people who paid the ransoms and never got their data unlocked afterwards.
If someone came along, pretending to be the good guy who could break the lock for you or your business? Wouldn't you prefer to pay THEM, rather than rewarding the criminal who created the problem in the first place?
Re: (Score:2)
I would assume places felt unsure they'd really get their data back by paying the scammers who locked their files down in the first place.
There are plenty of stories about people who paid the ransoms and never got their data unlocked afterwards.
From TFS:
By falsely claiming to decrypt ransomware without paying off the ransomers,
Sounds like Pinhasi was just playing negotiator between the ransomers and the victim. And may not have had a data recovery capability himself. So the end result would have been the same: No data recovered. Ransomers take the (smaller) money and run. Does Pinhasi warrant his service? Get your data or your money back?
There ARE legit services that will negotiate with ransomers. But the ransomers don't like working through them. To the point that they will do checks on people who present themselves as
Re: (Score:2)
I've done this before for some businesses that *don't want to know*.
A customer with a server we didn't manage and were not responsible for got crypto locked.
I looked into it, no viable backups, no way to recover the keys, etc. Only solution was to pay the ransomware or take the loss.
The customer was a law firm and I didn't realize this until after the fact but apparently paying ransoms can get you in legal issues. The customer basically said make it go away I don't care what it costs and I don't want to kno
Re: (Score:2)
One is a registered company with known people working there, and the other is entirely anonymous. If forced to choose to which of them I would hand the same amount of money, I'd pick the one I could later identify if things go south, wouldn't you?
Now, $8k versus $150k? I don't know. And what about other options? But if everything was otherwise equal and you had to pick between one of those two options, why would you pick the person who already wronged you?
No problem now (Score:1)
he paid the ransom and charged victims a hefty fee on top.
This is the kind of crime that gets pardoned in this administration for a price. Ironically though, he'll pay some friend/member of the President a huge sum only to later find out the President got a much smaller amount for the pardon. Of course, *that* person will then get jailed for "stealing" money from Trump. (And I wish I was joking about all this ...)
Something I don't understand yet (Score:2)
Re: (Score:2)
So the ransomware must have demanded a certain amount. But if he pays the ransom and keeps a hefty profit, that means the ransom amount is much smaller than what he charges. Why would the victim pay that amount?
Pinhasi pays the ransom out of his own pocket and gets the key.
He tells the victim he used his propriety technology to decrypt the files and sends a bill.
Pinhasi is telling a fib, which is OK in the US. That is, it's OK unless money changes hands, and then it's wrong, because that's how we roll here.
Re: (Score:2)
Pinhasi pays the ransom out of his own pocket and gets the key. He tells the victim he used his propriety technology to decrypt the files and sends a bill.
Yeah that part I understand. But the victim must have been aware of the ransom amount. Why would they wanna pay much higher than that?