US Prosecutors Indict Ransom Recovery Executive For Secret Payments

The Department of Justice has filed wire fraud charges against Zohar Pinhasi, the owner of a ransomware recovery firm, according to reports by The Record. Prosecutors allege that Pinhasi engaged in a scheme that involved secretly paying ransom demands to cybercriminals while simultaneously charging victims for services purportedly designed to help them avoid those payments entirely. This legal action targets the operational integrity of the recovery sector and the trust placed in intermediaries during cyber incidents.

Root cause

The alleged misconduct stems from a fundamental breach of the service agreement between Pinhasi’s firm and its clients. According to CyberScoop, Pinhasi deceived clients into a payment scheme that was disguised as a specialized service. The root of the fraud lies in the contradiction between the promised outcome—avoiding ransom payments—and the actual execution, which involved direct financial settlements with the attackers. This deception allowed the executive to charge fees under false pretences.

Attack path

The attack path described in the indictment involves a financial manipulation rather than a technical exploit. Pinhasi allegedly accepted funds from victims who were seeking assistance to recover from ransomware attacks without paying the criminals. Instead of negotiating or restoring systems without payment, the executive allegedly directed those funds to the hackers. This created a scenario where victims paid for recovery services while the ransom was still being fulfilled, effectively defrauding the clients of the service they believed they were purchasing.

Affected versions

The charges apply to the business model operated by Pinhasi’s firm during the period leading up to the indictment. The deception targeted clients who engaged the firm’s recovery services. The scope of the alleged fraud involves multiple victims who were overcharged as part of the scheme. There is no software version involved; the vulnerability exploited was the trust clients placed in the recovery provider’s ethical operations and technical claims.

Mitigation

• Verify the ethical track record and legal standing of any third-party recovery firm before engaging their services.
• Demand transparency in all financial transactions related to incident response, ensuring no funds are directed to attackers.
• Establish clear contractual terms that explicitly prohibit direct payments to cybercriminals by the recovery provider.

What to do and how to stay safe: Zohar Pinhasi

• Conduct due diligence on incident response providers, checking for legal actions or regulatory warnings against them.
• Require detailed reporting on all negotiations and financial movements during a ransomware incident.
• Implement internal policies that forbid staff from authorising direct payments to attackers without executive oversight.
• Monitor industry news for legal actions against recovery firms to identify potential risks in the supply chain.

Step-by-step guide: Phishing vs Vishing: How Audio Bypasses Your Defences

General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who is Zohar Pinhasi?

Zohar Pinhasi is the owner of a ransomware recovery firm who has been indicted by the US Department of Justice for wire fraud.

What are the charges against him?

He is charged with wire fraud for allegedly making secret ransom payments to hackers while overcharging victims for services meant to avoid such payments.

Did the firm actually help victims avoid paying ransoms?

According to the indictment, no; Pinhasi allegedly deceived clients by secretly paying the ransom demands while charging them for services that promised to avoid those payments.