MonsterCloud CEO Indicted for Fraudulent Ransomware Recovery Scheme
Zohar Pinhasi, 50, the owner of Florida-based ransomware remediation company MonsterCloud LLC, was indicted by a federal grand jury in the Eastern District of New York on September 23, 2026, and arraigned Wednesday in federal court in Brooklyn. He faces one count of conspiracy to commit wire fraud and two counts of wire fraud in connection with an alleged scheme that operated from June 2018 to June 2023. Pinhasi, who also used the aliases "Zack Silver" and "Zack Green," surrendered to authorities, pleaded not guilty, and was released on a $2 million bond.
Allegations of Deceptive Recovery Practices
Prosecutors allege that Pinhasi and his co-conspirators falsely advertised MonsterCloud as possessing proprietary technology capable of decrypting ransomware-encrypted data without paying attackers. In reality, the company had no such decryption tools and instead routinely contacted ransomware operators, paid them for decryption keys, and used those keys to restore victims’ files.
Although some MonsterCloud contracts disclosed the possibility of communicating with or paying cybercriminals, prosecutors claim these agreements stated such actions would occur only if other decryption methods failed. The indictment alleges that dealing with cybercriminals was typically MonsterCloud’s first step in file recovery, contradicting its public claims.
Financial Profiteering and Victim Harm
The scheme involved significant markups on ransom payments. In one case cited in the indictment, Pinhasi allegedly paid approximately $8,200 to a ransomware gang but charged the victim around $150,000 for recovery services. In another incident, he paid about $236,000 in ransom and billed the customer roughly $380,000.
Over the five-year period of the alleged conspiracy, prosecutors say Pinhasi and his associates facilitated more than $8 million in ransom payments to cybercriminals while charging hundreds of companies across the United States and Canada over $19 million for purported recovery and remediation services.
Use of Decrypted Samples as Misleading Proof
To convince victims of their capabilities, MonsterCloud allegedly provided decrypted sample files as "recovery proofs." However, these samples were obtained directly from the ransomware gangs after payment, meaning the company demonstrated success using the very keys it had purchased clandestinely.
Prior Warnings and Industry Skepticism
Concerns about MonsterCloud’s practices were previously raised in a 2019 ProPublica investigation. Security researcher Fabian Wosar told the outlet that he and another researcher created fake ransomware and posed as victims to test recovery firms. They provided ransom notes with email addresses they controlled for the fictitious attacker group.
Wosar reported that email accounts set up for the imaginary ransomware gang soon received anonymous messages offering to pay the ransom, which he traced back to data recovery firms including MonsterCloud and Proven Data. ProPublica found that MonsterCloud claimed it could recover encrypted files without informing victims that it intended to pay the attacker.
Pinhasi disputed these allegations at the time, telling ProPublica that MonsterCloud never promised in advance it could decrypt files without payment and described its methods as trade secrets that varied by case.
Legal Consequences and Ongoing Case
The U.S. Attorney’s Office, represented by Joseph Nocella Jr., emphasized that the office will prosecute both ransomware attackers targeting Americans and those who profit from such criminal activity through deception. If convicted on all charges, Pinhasi faces a maximum sentence of 20 years in prison.
BleepingComputer contacted Pinhasi’s attorneys, Christopher Clark and Rodney Villazor, for comment on the indictment and will update the story if a response is received.
Source: BleepingComputer