The Ransomware Rescuer Who Paid the Hackers | 2 Minute Drill with Drex DeFord

This transcription is provided by artificial intelligence. We believe in technology but understand that even the smartest robots can sometimes get speech recognition wrong.

The Ransomware Rescuer Who Paid the Hackers | 2 Minute Drill with Drex DeFord

[00:00:00] Drex: Hey everyone, I'm Drex, and this is the Two Minute Drill. Thanks to Zscaler Healthcare for sponsoring today's show. It's great to see everyone today. Here's some stuff you might want to know about. There's a storefront in Hollywood, Florida. The company inside the storefront was called MonsterCloud and its pitch was simple. It was printed right there in the marketing. Don't pay the ransom, guaranteed results, proprietary tools. If ransomware locks up your files, they get your data back and the criminals would get nothing. And if you're a small town or a police department or a business that just watched every screen on your network go dark, that might be one of the most beautiful proposals you've ever heard. The man running the place was named Zohar Pinhasi. By his own description, he was a former IT security intelligence officer in the Israeli military. In 2016, a security researcher named Fabian Wosar decided to test the pitch. So he wrote his own ransomware and he infected one of his own computers and then he played the victim. He emailed MonsterCloud and a handful of other recovery firms saying, I don't want to pay the hackers, can you help? And MonsterCloud said they could. So Fabian's test was on. Then Fabian checked the inbox he'd set up for the fake attackers and there they were. MonsterCloud had sent offers to pay the ransom from an anonymous email address that Fabian traced back to MonsterCloud. MonsterCloud had sent the email. The company that promised to beat the hackers was quietly paying them off in exchange for the ransomware encryption keys. In Fabian's summary, he said that the victims are being taken advantage of twice. ProPublica laid this all out in 2019. Pinhasi said he couldn't recall Fabian's case and he called his recovery method a trade secret. In his description of MonsterCloud, he said, we work in the shadows. You would have thought that would have been the end of MonsterCloud, but not so. Too good of an offer, too many gullible people. Prosecutors say the business ran for four more years. And here's how they say it worked. A victim called in a panic. MonsterCloud charged an analysis fee somewhere between $2,500 and $10,000. They could grab the ransom note, they could grab a few encrypted files, then prosecutors say Pinhasi sent those files to the criminals to get decrypted. He got the samples back, he showed them to the victims. All of that, he said, was proof of MonsterCloud's ability to do the job. The victims, relieved, signed up for the full recovery, often two times or more the actual ransom. In one case from August, 2023, prosecutors say Pinhasi paid a hacker about $8,200 for the keys. And then he billed the client about $150,000. Their totals from 2018 to 2023, more than $19 million billed to hundreds of companies in the US and Canada, and more than $8 million paid to cyber criminals. On October 7th, Pinhasi stood in federal court in Brooklyn, pleading not guilty to wire fraud. He's out on $2 million bond. These are all allegations, and of course he gets his day in court. The US Attorney's version, they say Pinhasi re-victimized his clients while extracting a hefty profit for himself. Now think about why people call a company like that. It's three o'clock in the morning, the EHR is encrypted, the ED is on diversion, the CEO wants to know when everything will be back up, and somebody on the phone says they can get it all back without paying the bad guys. That scenario happens over and over and over in healthcare. There's a second problem too, if someone pays a ransom in your name and that money lands with a sanctioned group, then the legal exposure may land on you whether you knew about it or not. So here's today's question, who's your incident response firm? You have one, right? On retainer, all cleared and coordinated and table topped with your cyber liability insurer. So everything's good, right? Or have you decided that you'll be shopping during one of those really, really bad days? Does your contract say in writing that nobody pays a ransom on your behalf without your sign off? I know it seems like you shouldn't have to say that in a contract, but here we are. And if a vendor tells you that they have a secret way to get your data back, what would it take for you to ask or outright demand that they show you how that magic works? That's it for today's two minute drill. Thanks again to Zscaler Healthcare for sponsoring today's podcast. Drop me a note. Let me know what you're working on. I'm always happy to hear from you. I'm Drex at 229project.com. Thanks for being here. Stay a little paranoid and I will see you around campus.