When a ransomware attack brings a business to a standstill, the damage can spread quickly. Employees may lose access to essential files, customers may be left waiting, and executives must decide whether to risk paying criminals who promise to unlock their systems. In that moment, a cybersecurity company offering a way out without paying a ransom can sound like exactly the help a victim needs. Federal prosecutors now allege that Zohar Pinhasi, the owner of Florida-based ransomware recovery company MonsterCloud LLC, used that promise to charge customers millions of dollars while secretly paying the hackers himself.
Pinhasi, 50, also known as Zack Silver and Zack Green, was indicted by a federal grand jury in New York on September 23, 2026, and arraigned in Brooklyn on October 7. The indictment charges him with two counts of wire fraud and one count of conspiracy to commit wire fraud. The allegations concern a business that prosecutors say presented itself as an alternative to ransomware payments while relying on those same payments to recover customers’ files. Pinhasi is presumed innocent unless and until prosecutors prove the charges in court.
According to the U.S. Department of Justice, the alleged scheme ran from approximately June 2018 through June 2023. During that period, MonsterCloud marketed its ability to restore data using proprietary tools and advanced decryption techniques. Its public messaging discouraged businesses from paying ransom demands and promoted the company as a way to recover encrypted information without giving in to cybercriminals. That distinction mattered. Customers were not simply hiring a technician to negotiate with a hacker; prosecutors say they were being sold a service on the representation that MonsterCloud could do what the attackers demanded money for without paying them.
The indictment alleges that the reality was different. Rather than independently decrypting the affected files using the special technology it claimed to possess, Pinhasi allegedly contacted the criminals responsible for the attacks and paid them for decryption keys. MonsterCloud employees then used those keys in attempts to restore clients’ data. Prosecutors say clients were charged substantially more than the ransom amounts paid behind the scenes, without being told that the company had relied on the attackers to obtain access to their files.
The figures outlined by prosecutors are substantial. The government alleges that Pinhasi charged MonsterCloud clients more than $19 million over the course of the scheme and paid more than $8 million to ransomware operators. Those figures describe the prosecution’s allegations, not a final judicial determination of the company’s revenue, Pinhasi’s personal gains or the total damages suffered by customers. The difference between the two headline amounts is more than $11 million, but it would be premature to describe that entire difference as proven personal profit without a court-established accounting of expenses, transfers and other costs.
One example cited by the Justice Department illustrates the alleged pricing disparity. In August 2023, Pinhasi reportedly paid a cybercriminal approximately $8,200 for a decryption key while charging the affected customer around $150,000. The customer’s bill was therefore roughly 18 times the reported ransom payment. The indictment also describes an October 2021 incident in which Pinhasi allegedly paid approximately $236,000 in ransom and charged a client about $380,000. These examples raise a central question in the case: whether customers knowingly purchased a recovery service that included ransom negotiation or were misled into believing they were paying for a technical capability that avoided ransom payments altogether.
A particularly significant allegation concerns what Pinhasi reportedly told a paid spokesperson in May 2019. According to the indictment, the spokesperson asked whether MonsterCloud actually possessed proprietary software capable of decrypting ransomware-encrypted data. Pinhasi allegedly responded in writing: “MonsterCloud doesn’t hold any proprietary technology [to] decrypt the ransomware data.” Prosecutors cite that exchange as evidence that the company’s public claims about its technical capabilities did not reflect its actual methods. The statement is an allegation documented in the indictment; its meaning and context remain matters for the legal process.
The case also has a history that predates the current prosecution. In May 2019, investigative reporting by ProPublica examined ransomware recovery firms that advertised advanced technical solutions but appeared to rely on paying attackers. Its reporting included MonsterCloud and described experiments by cybersecurity researcher Fabian Wosar, who posed as a ransomware victim to test companies’ claims. ProPublica reported that MonsterCloud’s chief executive, Pinhasi, maintained that the company’s recovery methods were trade secrets and that it did not mislead customers. He also explained that the company did not respond to one test inquiry because it did not serve individual consumers. The reporting was not a criminal conviction or a judicial finding of fraud, but it established that questions about transparency in the ransomware recovery business were being raised publicly years before the indictment.
That earlier reporting also makes an important distinction: paying a ransom is not, by itself, proof of fraud. In some circumstances, organizations and recovery specialists decide that paying is the only practical way to restore critical files, particularly when reliable backups or free decryption tools are unavailable. The ethical and legal issue becomes whether the customer understands what is being done, has authorized the payment arrangement, and receives an accurate account of the service. ProPublica’s reporting included industry voices arguing that there is no inherent shame in facilitating a ransom payment when the practice is transparent. The current federal case turns on the alleged misrepresentations, not simply on the fact that money may have reached cybercriminals.
Federal authorities say the allegations are serious enough to warrant a major criminal prosecution. The Justice Department announced the case jointly with the U.S. Attorney’s Office for the Eastern District of New York and the FBI. Prosecutors allege that the conduct harmed people and businesses that had already been victimized by ransomware attackers, effectively exposing them to a second financial hit. Pinhasi faces a potential maximum sentence of up to 20 years on each of the three counts if convicted, although statutory maximums do not predict the sentence a court would impose. The charges do not establish that he has been convicted, and the available announcement does not report a final judgment, restitution order or court-determined loss figure.
The indictment also refers to other individuals, including MonsterCloud employees and contractors, as alleged co-conspirators whose identities were known or unknown to the grand jury. That language signals that investigators believe others may have assisted with aspects of the alleged scheme. It does not mean every employee or contractor has been charged, nor does it establish criminal responsibility for any person beyond the defendant named in the indictment. The public charging documents identify MonsterCloud LLC as the company at the center of the allegations and Pinhasi as its owner and chief executive, responsible for pricing, employee management and communications with cybercriminals.
For customers considering a ransomware recovery firm, the case offers a practical warning. Businesses should ask providers to explain precisely how data will be recovered, whether ransom negotiations or payments may be involved, who authorizes any payment, and how costs are calculated. They should also request written disclosure of any third-party payments and verify technical claims independently where possible. The FBI and the Cybersecurity and Infrastructure Security Agency have warned that paying a ransom does not guarantee that data will be restored, that systems will be secure, or that stolen information will not be exposed.
————-
Disclaimer:
Some content on Reportingscams.com is published under our guest post program and is provided by third-party contributors. Reporting scams does not create, verify, or take responsibility for the views, accuracy, or claims expressed in such content.
