American company MonsterCloud promised businesses that it would restore files encrypted by hackers without paying a ransom. But, according to investigators, instead of using its own technology, it used keys that it itself bought from cybercriminals. In one case, the company allegedly paid hackers $8,200 and took $150,000 from a client.
American company MonsterCloud promised businesses that it would restore files encrypted by hackers without paying a ransom. But, according to investigators, instead of using its own technology, it used keys that it itself bought from cybercriminals. In one case, the company allegedly paid hackers $8,200 and took $150,000 from a client.
This was reported by BleepingComputer, citing the US Department of Justice.
MonsterCloud worked in two stages. First, customers were offered to test the possibility of data recovery for $2,500–10,000. To do this, the company took several encrypted files and handed them over to hackers. The company showed customers the decrypted samples it received from them as proof of its technology. After that, it offered to order a much more expensive recovery of the remaining data.
According to prosecutors, MonsterCloud owner Zohar Pinchasi and his accomplices operated under this scheme from 2018 to 2023. Over five years, the company organized the payment of more than $8 million in ransoms. And hundreds of companies in the US and Canada paid MonsterCloud more than $19 million for data recovery and other services.
MonsterCloud’s questionable methods were reported by journalists long before the current criminal proceedings. In 2019, ProPublica reported on an experiment by two cybersecurity researchers. They created their own ransomware and contacted several data recovery companies, posing as victims of the attack.
The researchers left the contacts of the fictional hackers, and then waited. Soon, anonymous emails began to arrive at these addresses with offers to pay the ransom. Among the companies that tried to negotiate with the “hackers” was MonsterCloud. At the time, Pinhasi denied that he had misled anyone, and called the details of the data recovery methods a trade secret.
Previously, dev.ua wrote that, according to Nova Digital, hackers demand an average of over $2 million in ransom from Ukrainian companies.
