Cybersecurity CEO Indicted for Allegedly Scamming Millions From Ransomware Victims - ProPublica

The indictment mirrors findings from ProPublica's 2019 investigation "The Trade Secret," which revealed how MonsterCloud victims were harmed twice: first by hackers who locked their files, then by the firm that misled them about not paying ransoms. Pinhasi, who also used the alias Zack Green, allegedly charged clients more than $19 million while paying over $8 million in ransom payments to hackers.

Double Victimization

By falsely claiming to decrypt ransomware without paying off the ransomers, Pinhasi re-victimized his clients while extracting hefty profits, according to U.S. Attorney Joseph Nocella. The scheme particularly targeted local law enforcement agencies, who are reluctant to engage with or pay criminal hackers. Several agencies chose MonsterCloud specifically because they believed the firm would never pay ransoms.

FBI Connection

The Justice Department did not address ProPublica's 2019 finding that John Pistole, a former deputy FBI director under Robert Mueller, was prominently featured in MonsterCloud's promotional materials. Pistole, who also headed the Transportation Security Administration under President Obama, was listed as the only member of MonsterCloud's "Cyber Security Advisory Council." He was paid indirectly through a speaker's bureau after the company reached out to him.

In a 2019 interview, Pistole acknowledged that in most cases, including MonsterCloud's, the only way to decrypt data locked by ransomware is to pay the hackers. "That's the business model as I understood it," he told ProPublica. "Based on my experience and knowledge, ransom is paid and they facilitate the best practices moving forward." Pistole was not mentioned in the Pinhasi indictment.

Growing Threat

When ProPublica published its story in 2019, ransomware was already one of the world's most pervasive cyberthreats. Hackers locked data of governments, schools and businesses, demanding ransom payments typically in bitcoin and other difficult-to-trace cryptocurrencies. The threat has since grown as hackers linked to hostile foreign governments are believed to use ransomware as cover for espionage, while AI tools make it easier for attackers to spread ransomware.

In one example highlighted by investigators, Pinhasi made a ransom payment of about $8,200 but charged the client approximately $150,000. If convicted, he faces up to 20 years in prison. An FBI official stated that Pinhasi had "turned the victim's crisis into his own profit center," adding that "this deception is unacceptable." Pinhasi has pleaded not guilty to the charges.