MonsterCloud claimed to offer an alternative to paying the ransom. Its website said that, thanks to its decryption techniques, “our team specializes in helping businesses recover their data without succumbing to ransom demands.”
However, the indictment alleges that rather than using any technology, Pinhasi simply paid the cybercriminals in exchange for a decryption key with which MonsterCloud employees would then an attempt to unlock their clients’ files. It is alleged that Pinhasi typically charged clients a fee that was substantially higher than the ransom payment. For example, in 2023, he made a payment of $8,200 to a cybercriminal while charging a client $150,000.
There may be several reasons why clients chose to use MonsterCloud. US government advice (echoed by other governments) is not to pay ransoms as it may encourage more attacks, and victims may not get their data back. In addition, in some cases, if the attackers are from a country or group subject to trade sanctions, making a payment may actually be illegal, leaving the victim facing criminal charges.
