The owner of a Florida company that marketed itself as a way for ransomware victims to recover their data without paying is charged with secretly paying the attackers. On October 7, 2026, the Justice Department announced that Zohar Pinhasi, 50, owner of the ransomware remediation firm MonsterCloud, had been arraigned in the Eastern District of New York on wire fraud charges. Prosecutors allege that the company paid ransomware operators for decryption keys, then billed victims far more than the ransoms cost while claiming to have its own decryption technology.

The Justice Department describes Pinhasi as a US and Israeli national also known as "Zack Silver" and "Zack Green." Help Net Security reported that he lives in Hollywood, Florida. BleepingComputer reported that a federal grand jury in the Eastern District of New York (EDNY) returned the indictment on September 23, and that Pinhasi surrendered, was arraigned in federal court in Brooklyn, pleaded not guilty, and was released on a $2 million bond. He is charged with two counts of wire fraud and one count of wire fraud conspiracy, each carrying a maximum of 20 years in prison.

The charges are allegations. Under the Justice Department's standard language, an indictment is merely an allegation and defendants are presumed innocent until proven guilty beyond a reasonable doubt. BleepingComputer said it had contacted Pinhasi's attorneys, Christopher Clark and Rodney Villazor, for comment.

What prosecutors allege

According to BleepingComputer's account of the indictment, the scheme ran from June 2018 to June 2023. The Justice Department says MonsterCloud's website cautioned clients not to pay the ransom and claimed the company specialized in helping businesses recover data without giving in to ransom demands, and that Pinhasi represented that he had access to "proprietary tools" and "advanced decryption techniques."

Prosecutors allege he had no special technology. Instead, according to the Justice Department, he contacted and paid the criminals who had attacked a client in exchange for a decryption key, which MonsterCloud employees then used to try to decrypt the client's files. Over the course of the scheme, the department alleges, he charged clients more than $19 million and paid more than $8 million in ransoms. BleepingComputer reported that the clients were hundreds of companies in the United States and Canada.

Two examples illustrate the alleged markup:

  • August 2023: Pinhasi allegedly paid about $8,200 to a cybercriminal and charged the client about $150,000, according to the Justice Department.
  • Undated case: He allegedly paid about $236,000 and charged about $380,000, according to BleepingComputer.

BleepingComputer also reported that some MonsterCloud contracts disclosed the company might communicate with or pay attackers, but said it would do so only if it could not decrypt files by other means. Prosecutors allege that dealing with the attackers was usually the company's first step, not a last resort. The indictment also alleges MonsterCloud showed victims sample files as "recovery proofs" that had in fact been decrypted by the ransomware operators.

The company's own words

Help Net Security reported that in May 2019, a paid promoter asked Pinhasi whether MonsterCloud had any proprietary decryption software, and that Pinhasi allegedly replied: "Monstercloud doesn't hold any Proprietary technology [to] decrypt the ransomware data." The same report says some testimonials on MonsterCloud's website came from people who were paid to promote the company.

The allegations echo questions raised years earlier. BleepingComputer noted a 2019 ProPublica investigation in which researcher Fabian Wosar and a colleague created their own ransomware, posed as victims, and traced offers to pay the ransom back to recovery firms, including MonsterCloud. Pinhasi told ProPublica at the time that his recovery methods were a "trade secret" and denied misleading customers.

Who brought the case

The FBI investigated the case. Senior Trial Attorneys from the Justice Department's Computer Crime and Intellectual Property Section (CCIPS) and Assistant US Attorneys for EDNY are prosecuting it.

In the Justice Department's press release, Assistant Attorney General A. Tysen Duva of the Criminal Division said: "The defendant is charged with offering an alternative to ransom payments, but instead is alleged to have victimized the victim again and committed additional fraud, harming the victim again." US Attorney Joseph Nocella Jr. said in the same release that "by falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself." FBI Assistant Director James C. Barnacle Jr. said Pinhasi "turned the victim's crisis into his own profit center," adding: "This deception is unacceptable."

Why the alleged conduct matters

A firm that says it can decrypt data without paying the attackers is selling two things: recovery, and a way to avoid funding criminals. Victims may pick such a firm precisely because they do not want to pay, whether for ethical, legal or insurance reasons. The Justice Department's release repeats joint FBI and CISA guidance against paying ransoms, noting that payment does not ensure data is decrypted, that systems will no longer be compromised, or that data will not be leaked.

If the allegations are proven, MonsterCloud's clients paid the attackers anyway, through a middleman, plus a markup they did not know about. In the August 2023 example, the bill was more than 18 times the alleged ransom. Those clients also made disclosure and insurance decisions without knowing a payment had gone to the group that attacked them.

What It Means for Defenders

The case involves no software vulnerability or indicators of compromise. The exposure is in how incident response vendors are chosen and governed:

  • Vet recovery vendors before an incident. Check references you can contact directly instead of relying on testimonials on the vendor's own site.
  • Put attacker contact and payment under contract control. Require written disclosure of whether the vendor negotiates with or pays threat actors, and require your prior written approval, with amounts disclosed, before any contact or payment.
  • Demand technical specifics and itemized billing. Ask how the vendor would recover data from the specific ransomware family involved, and require invoices that separate labor, tooling and third-party payments.
  • Keep payment decisions with counsel and your insurer. Contacting or paying an attacker has legal and insurance consequences that belong inside your own incident governance.
  • Revisit past engagements. If a recovery vendor told you data was restored without a ransom payment, have counsel review the invoices and correspondence from that engagement.

Sources