The Column – Cyber Security Week
Imagine coming home and finding that someone has changed all the locks. You can’t enter, but the thief left you a note: if you want to get the keys back you have to pay. Decide not to give in to blackmail and call a locksmith who promises to open the door thanks to his revolutionary technology. The professional comes, collects a considerable sum and solves the problem and you are satisfied. Too bad that, according to a possible reconstruction of the facts, the locksmith simply bought the keys from the thief, making you pay twenty times their price. A fairly surreal story, at least until we move into the world of cybersecurity.
On October 7, Zohar Pinhasi, owner and CEO of the American company MonsterCloud, appeared before a federal court in Brooklyn. The accusation is of having organized a system to defraud companies that are victims of ransomware, those criminal programs that make data inaccessible by asking for a ransom to return them. Pinhasi has pleaded not guilty and the charges will have to be proven in court. However, the reconstruction of the American Department of Justice deserves attention because it tells a story in which technology, marketing and crime found a decidedly original form of collaboration.
MonsterCloud promised customers it would recover data without funding criminals. To achieve this, it claimed to use proprietary tools and advanced decryption techniques. According to investigators, however, the procedure was much less sophisticated. The company allegedly contacted the same criminals responsible for the attack, paid the ransom, and used the received key to return the files to the unsuspecting customer. What made the mechanism particularly ingenious was the preliminary demonstration of technical capabilities. MonsterCloud would ask for some encrypted files, send them to criminals who would decrypt them for free to prove they had the key, and then present them to the customer as proof of the effectiveness of their technology. Essentially, according to the prosecution, the criminals also worked for free for the commercial department.
The numbers make the story even more interesting. In August 2023, MonsterCloud allegedly paid a ransom of approximately $8,200, invoicing the customer $150,000. Overall, according to prosecutors, hundreds of American and Canadian companies paid over 19 million dollars, while more than 8 million ended up in the pockets of criminals. Of course, paying a ransom does not automatically equate to committing fraud, to the point that there are operators who openly negotiate with extortionists on behalf of victims. Here the question would be different: selling a service by declaring that it does exactly the opposite of what it does.
The story also presents a curious precedent. In 2019 ProPublica published an investigation into companies that promised technological solutions against ransomware, only to then resort to payments. MonsterCloud appeared among these. An IT consultant had already expressed suspicion that the company could simply pay the criminal with a generous difference, and seven years later the federal prosecutor contests this very model. A journalistic suspicion does not constitute judicial evidence, but it demonstrates how useful it can be to ask simple questions even when we are offered technologically complicated answers.
The story, however, suggests a broader reflection. Ransomware has created two markets. The first is the criminal one, made up of extortionists who seize information. The second is perfectly legitimate and includes specialists, insurers, consultants and companies that help victims recover. There is nothing strange: where a problem exists, someone inevitably arises willing to solve it, for a fee. Risk appears when the boundaries between the two markets become so thin that someone can profit from the problem and the solution at the same time.
If the accusations are confirmed, MonsterCloud will represent an almost perfect example of a circular economy. The criminal creates the problem, the problem generates the customer, the customer pays the person who promises the solution and part of the money goes back to the criminal, financing new attacks. A sustainable model, at least from the point of view of its beneficiaries, although I doubt it will find space in the next ESG balance sheets.
One consideration remains. In the digital society we are used to measuring the reliability of a service by the result it produces, forgetting to ask ourselves how it is obtained. When we buy security, however, the method matters at least as much as the result, otherwise we risk discovering that whoever returns the house keys to us is simply a “colleague” of whoever stole them.
