美国司法部已对一名男子提起欺诈指控。据称，他向客户声称能够解密被勒索软件锁定的文件，但实际上却支付了赎金，并且这一行为似乎持续了多年。联邦调查人员指控，佐哈尔·皮纳西（Zohar Pinhasi），又名“扎克·西尔弗”（Zack Silver）和“扎克·格林”（Zack Green），经营着一家位于佛罗里达州的名为“MonsterCloud”的公司。
The United States Department of Justice has charged a man with fraud after he allegedly told clients he could decrypt files locked up by ransomware but actually paid ransoms – and seemingly got away with it for years. The Feds allege that Zohar Pinhasi – aka “Zack Silver” and “Zack Green” – ran a Florida company called “MonsterCloud” that advised ransomware victims not to pay because it had a way to recover encrypted data.
该公司建议勒索软件受害者不要支付赎金，声称其拥有恢复加密数据的方法。根据司法部新闻稿，“指控涉及皮纳西声称能够在不向网络犯罪分子支付赎金的情况下解密勒索软件，据称他利用‘专有工具’和‘高级解密技术’为那些前来寻求帮助的困境企业主提供服务。”“事实上，皮纳西据称利用客户费用的一部分向勒索软件攻击者支付了赎金，随后将剩余款项据为己有，通常还从中抽取了高额差价。”
“The charges relate to Pinhasi’s claimed ability to decrypt ransomware without paying cybercriminals, purportedly using ‘proprietary tools’ and ‘advanced decryption techniques' on behalf of distressed business owners who came to his company,” according to a DoJ press release. “In fact, Pinhasi allegedly used a portion of his clients’ fees to pay off the ransomware attackers, and then kept the rest, often extracting a substantial markup.”
在其中一个案例中，皮纳西据称向客户收取了15万美元，支付了8200美元的赎金，并将余款收入囊中，但他并未承认自己支付了赎金。据称，这一骗局运作得非常成功，皮纳西向客户收取了超过1900万美元的费用，并支付了超过800万美元的赎金。司法部起诉书（PDF）指出，MonsterCloud的网站提到了其使用“高级解密技术和尖端科技”——这与monstercloud.com页面上的措辞完全一致。
In one case, Pinhasi allegedly charged his client $150,000, paid the $8,200 ransom, and pocketed the rest – but didn’t admit he had paid the ransom. That scheme allegedly worked so well that Pinhasi charged clients more than $19 million and paid more than $8 million in ransom payments. The DOJ’s indictment [PDF] says MonsterCloud’s website mentions its use of “advanced decryption techniques and cutting-edge technology” – the same language found on this monstercloud.com page.
该网站还包含以下声明：“在MonsterCloud，我们并非IT专家团队。我们是世界上最精密的反网络恐怖主义团队。”
The site also contains this claim: “At MonsterCloud, we are not a team of IT Experts. We are the most sophisticated Counter Cyber Terrorism team in the world.”
起诉书暗示MonsterCloud并非如其所宣称的那样，其声明多年来一直空洞无物。起诉书称：“MonsterCloud的网站包含‘客户评价’和其他宣传内容，其中包括至少一名受酬代言人的内容。”
The indictment suggests MonsterCloud was nothing of the sort, and that its claims rang hollow for years. “MonsterCloud's website included ‘testimonials’ and other promotional content, including from at least one compensated spokesperson,” the indictment states.
2019年5月，其中一名发言人——此人曾为MonsterCloud网站提供付费评价——联系了被告Zohar Pinhasi，就Pinhasi的商业行为和真实性提出了疑问。“除其他问题外，该发言人还询问Pinhasi，MonsterCloud是否确实拥有任何专有软件，能够解密加密数据。Pinhasi回应道：‘MonsterCloud并不掌握任何用于解密勒索软件数据的专有技术。’”
“In May 2019, one such spokesperson – an individual who had provided a paid testimonial for the MonsterCloud website – contacted the defendant Zohar Pinhasi with questions about Pinhasi’s business practices and truthfulness.”“Among other things, the spokesperson asked Pinhasi whether MonsterCloud actually had any proprietary software that would allow MonsterCloud to decrypt encrypted data. Pinhasi responded: ‘MonsterCloud doesn't hold any proprietary technology [to] decrypt the ransomware data.’”
Pinhasi面临两项电信欺诈指控和一项电信欺诈共谋指控。如果罪名成立，他每项指控都可能被判二十年监禁。美国联邦调查局（FBI）正在调查此案，而且根据起诉书所述，Pinhasi有“多名共谋者，包括身份为联邦大陪审团已知和未知的人员，其中既有MonsterCloud的员工，也有承包商”，因此未来可能还会有更多指控。®
Pinhasi faces two counts of wire fraud, and one of wire fraud conspiracy. He could do twenty years on each count, if convicted. The FBI is investigating this case, and it appears further charges could follow as the indictment states Pinhasi had “multiple co-conspirators, individuals whose identities are both known and unknown to the Grand Jury, including MonsterCloud employees and contractors.” ®