Fake Decryption Tools and an Eighteenfold Markup: The Ransomware Vendor That Paid the Attackers Twice

A US incident-response firm told ransomware victims it could recover their data without paying the attackers. The indictment says it paid them anyway, then marked the decryption keys up eighteen times.

Zohar Pinhasi, the 50-year-old owner of MonsterCloud, appeared in a New York court this week to face wire fraud and wire fraud conspiracy charges. He is a dual US and Israeli national, also known as Zack Silver and Zack Green. According to SecurityWeek’s October 8 reporting, his company sold nervous organizations on a service that supposedly used proprietary tools and advanced decryption techniques to break ransomware without paying anyone. In private, he did the opposite.

The mechanics were simple. Pinhasi contacted the ransomware groups that had just extorted his clients, paid them for the decryption keys, and then billed the victims for “remediation.” Over the life of the scheme, he paid more than $8 million in ransoms and charged clients more than $19 million.

The arithmetic of the markup

One transaction in the indictment makes the model plain. Pinhasi paid a ransomware affiliate roughly $8,200 for a decryption key, then invoiced the victim organization about $150,000. That is an 18x markup on a payment the client had been told never happened.

The Justice Department’s framing is blunter than mine. Assistant Attorney General A. Tysen Duva said the defendant offered an alternative to ransom payments but allegedly “victimized the victim again and committed additional fraud, harming the victim again.” A company that pays a ransom once is a victim of crime. A company that pays twice, and only finds out about the second payment from a federal indictment two years later, has been robbed by the people it hired for help.

Why the pitch worked

Here is what bothers me about this story: the claim MonsterCloud made was just plausible enough to sell. A handful of ransomware families have shipped broken cryptography, and legitimate security firms have published real decryptors for them. So when a recovery vendor says “we can decrypt this without paying,” the buyer cannot easily tell a genuine capability from a con. Ransomware buyers are also not in a position to be skeptical. They are mid-outage, their backup restoration has failed, legal is asking about notification deadlines, and a vendor with confidence and a phone is the only life raft on the table.

Consider where the money went. Every ransom MonsterCloud quietly paid flowed back into the affiliate ecosystem, funding the next wave of attacks. Clients who believed they had found a way to pay less than the attackers demanded were in fact keeping that market liquid.

The African angle

Ransomware retainer contracts are now standard procurement at large South African companies, and I’m seeing the same pull in fintech and retail groups our size, where one outage can wipe a quarter. Under POPIA, a breach that hits personal information carries notification duties to the Information Regulator and to data subjects, regardless of which recovery vendor you hired. A fraudulent one doesn’t just cost you the markup. It means your attacker contact, your ransom history, and your weakest systems are all known to someone who answered to nobody but a marketing team.

MonsterCloud is a US case, but nothing about the con is US-specific. If your incident-response retainer sits in a drawer right now, this is the week to read it.

Vetting a recovery vendor, concretely

Ask which ransomware families they have actually recovered without payment, and for published evidence of it. Real capability shows up in technical write-ups and working decryptors on sites like ID Ransomware or the No More Ransom project. A vendor whose confidence outruns its citations is spending your money on marketing.

Require that the client controls all attacker communications. If a vendor insists on owning the negotiation channel exclusively, that is the MonsterCloud failure mode: the negotiation is where a secret ransom payment happens.

Get contractual disclosure on any payment to a third party, including affiliates and brokers. Then pay on proof. A legitimate vendor will let you verify a decryption key against a test sample, escrow the fee, and release it only after the sample comes back clean.

What eHawu takes from this

The expensive part of ransomware was never the key. It is the downtime and the recovery chain you hand to strangers after the fact. eHawu’s pitch runs the other direction: stop the encryption at the network layer before the recovery conversation ever starts. Continuous verification of every device and user on your infrastructure, microsegmented so a single compromised host cannot walk your datacenter, and evidence trails a regulator can read without a translation layer.

The charges in the MonsterCloud indictment are allegations, and nothing here is a conviction. The vendor-selection lesson holds regardless of how the case resolves.