Ransomware Recovery CEO Indicted After Allegedly Paying Hackers and Pocketing Millions

Ransomware Recovery CEO Charged With Defrauding Clients Out of $19 Million

Zohar Pinhasi, a 50-year-old dual U.S.-Israeli national and the owner of Florida-based ransomware remediation firm MonsterCloud, was arraigned in federal court in the Eastern District of New York on October 7, 2026, after a grand jury indicted him on charges of wire fraud and wire fraud conspiracy. Prosecutors allege Pinhasi spent years telling ransomware victims that MonsterCloud could recover their encrypted files using proprietary decryption technology — when in reality the company had no such tool and instead paid the same cybercriminals who deployed the ransomware, then billed clients several times what it secretly paid out. The U.S. Department of Justice says clients were charged more than $19 million over the scheme, while Pinhasi funneled over $8 million of that to ransomware operators between 2018 and 2023.

Incident Details

Attribute	Value
Defendant	Zohar Pinhasi, age 50, owner/operator of MonsterCloud
Aliases used	"Zack Silver" and "Zack Green"
Company	MonsterCloud, a Florida-based ransomware "remediation" company
Charges	Two counts of wire fraud, one count of wire fraud conspiracy
Maximum penalty	20 years per count (up to 60 years total)
Court	U.S. District Court, Eastern District of New York (Brooklyn)
Arraignment date	October 7, 2026
Bond	Released on $2 million bond; pleaded not guilty
Total billed to clients	More than $19 million
Total ransom payments made	More than $8 million (2018–2023)
Example case cited in indictment	Charged a client $150,000 after paying an $8,200 ransom (August 2023)
Prior scrutiny	Subject of a 2019 ProPublica investigation into ransom-paying "recovery" firms

How the Scheme Allegedly Worked

The Pitch

MonsterCloud marketed itself to hundreds of victim organizations across the United States and Canada as an incident-response specialist that could defeat ransomware without ever paying the attackers — a pitch reinforced by testimonials on the company's website, including from a former FBI official and various law enforcement contacts. Pinhasi told prospective clients the company possessed "proprietary tools" and "advanced decryption techniques" capable of unlocking encrypted files on its own, charging an initial exploratory fee ranging from roughly $2,500 to $10,000 just to assess a victim's environment.

The Hidden Ransom Payments

According to the indictment, no such proprietary decryption technology ever existed. Instead, prosecutors allege Pinhasi personally obtained ransom notes and samples of encrypted files from victims, then contacted the same cybercriminals responsible for the attack — using the aliases Zack Silver and Zack Green to mask his identity — to negotiate and pay for decryption keys. Hackers would decrypt a sample file to "prove" capability, which Pinhasi's team would present to clients as evidence of MonsterCloud's own technical prowess, concealing that an actual ransom negotiation and payment was underway.

The Markup

Once victims were convinced recovery was possible, MonsterCloud contracted for full recovery services priced at "two or more times the ransom" actually demanded — fees clients believed covered specialized engineering work rather than a disguised ransom payment plus profit margin. The indictment's headline example: in August 2023, Pinhasi allegedly paid a cybercriminal approximately $8,200 for a decryption key while charging the affected client roughly $150,000 — an 18x markup over the actual ransom. Across the full scheme, the roughly $19 million billed to clients dwarfed the more than $8 million that prosecutors say actually went to ransomware operators, with the difference representing Pinhasi's undisclosed profit.

Why It Mattered to Victims

Victims paying MonsterCloud believed they were avoiding the ethical, financial, and legal risks associated with directly funding ransomware gangs — including potential sanctions exposure for payments to certain threat actors. By allegedly paying ransoms covertly while marketing the opposite, prosecutors say Pinhasi deprived clients of the ability to make an informed decision about whether to negotiate with attackers directly, report the incident differently, or seek other recovery paths, all while profiting from the deception.

Impact Assessment

Impact Area	Description
Financial harm	Clients allegedly overpaid by tens of millions of dollars combined, with individual cases marked up many multiples over the real ransom cost
Victim trust	Ransomware victims already in crisis were allegedly misled a second time by a vendor marketed as a trustworthy alternative to paying criminals
Sanctions/compliance exposure	Clients may have unknowingly funded ransomware operators through an intermediary, without the compliance screening a direct, disclosed payment would typically involve
Industry reputation	Renews scrutiny of the ransomware "recovery" industry, where paying the ransom while charging a markup has been a known but under-prosecuted practice since at least ProPublica's 2019 reporting
Legal exposure	Pinhasi faces up to 60 years in prison across three federal counts; case is in early stages with plea negotiations reportedly underway
Law enforcement signal	DOJ and FBI have signaled increased appetite for prosecuting fraud within the incident-response and recovery ecosystem, not just ransomware operators themselves

Recommendations

For Organizations Evaluating Ransomware Recovery Vendors

Demand contractual transparency on methodology before signing: ask explicitly, in writing, whether the vendor intends to pay or negotiate with the threat actor, and require disclosure of any such payment before or immediately after it occurs.
Treat claims of "proprietary decryption technology" with skepticism absent independent, verifiable technical evidence — true cryptographic breaks of modern ransomware strains are rare and typically documented publicly by researchers (e.g., via Europol's No More Ransom project), not held as a vendor's private trade secret.
Separate the ransom-payment decision from the recovery vendor relationship. Engage outside counsel or a dedicated negotiation firm for any ransom contact, and use a distinct, vetted technical team for restoration — collapsing both functions into one undisclosed vendor removes a critical check.

For Security and Incident Response Teams

Build a vetted pre-incident vendor list that includes firms willing to disclose fee structures, negotiation practices, and OFAC/sanctions screening procedures before an incident occurs — not during the pressure of active response.
Preserve independent evidence of ransom notes, communications, and payment trails during any incident, even when a third party handles negotiation, to support later audits, insurance claims, or law enforcement referrals.
Report suspected recovery-vendor fraud to the FBI's Internet Crime Complaint Center (IC3) and consider notifying cyber insurance carriers, which increasingly maintain their own vetted vendor panels.

For Ransomware Victims Generally

Involve law enforcement (FBI field office or IC3) early in any ransomware incident — agencies can advise on negotiation risk and sanctions exposure even when an organization ultimately chooses to pay.
Request itemized billing that separates negotiation/payment costs from technical restoration labor, and be wary of any recovery firm that resists itemization or insists its methods are a trade secret.

Key Takeaways

Zohar Pinhasi, owner of ransomware remediation firm MonsterCloud, was indicted on two counts of wire fraud and one count of wire fraud conspiracy, facing up to 60 years in prison.
Prosecutors allege MonsterCloud had no proprietary decryption technology and instead secretly paid the same cybercriminals behind client attacks, using the aliases "Zack Silver" and "Zack Green."
Clients were allegedly billed more than $19 million in total, while actual ransom payments totaled over $8 million between 2018 and 2023 — with one cited case showing an $8,200 ransom billed out at $150,000.
The practice of recovery firms secretly paying ransoms and marking up the cost was first publicly exposed in a 2019 ProPublica investigation that specifically named MonsterCloud, underscoring years of prior scrutiny before criminal charges followed.
Pinhasi was arraigned October 7, 2026, in the Eastern District of New York, pleaded not guilty, and was released on a $2 million bond; a trial delay has reportedly been granted to allow plea negotiations.
Organizations should demand upfront transparency from ransomware recovery vendors about negotiation and payment practices, and should treat unverifiable "proprietary decryption" claims as a red flag.