Federal Indictment Reveals Ransomware Recovery Fraud Scheme
Authorities have indicted Zohar Pinhasi, the dual U.S.-Israeli owner of MonsterCloud, on charges of wire fraud and conspiracy for allegedly deceiving hundreds of ransomware victims into paying inflated fees under false pretenses. Prosecutors allege that Pinhasi claimed his company possessed proprietary tools capable of decrypting ransomware-encrypted data without paying cybercriminals — a claim the Justice Department says was entirely fabricated.
Instead of using any legitimate recovery methods, Pinhasi allegedly funneled client payments to cybercriminals to obtain decryption keys, then billed clients for full recovery services while concealing that ransom payments had been made on their behalf. This dual deception allowed him to profit twice: once from charging victims for fake recovery services and again from retaining the difference between what clients paid and what was actually paid to attackers.
Scale of the Scheme: Millions in Illicit Gains Over Five Years
According to the indictment, Pinhasi’s scheme operated from approximately 2018 through 2023, during which time he charged hundreds of clients more than $19 million in total. Of that amount, prosecutors allege he paid over $8 million in ransom payments to cybercriminals to recover encrypted data — meaning he retained more than $11 million as profit through deceit.
One specific example cited in the indictment involves an August 2023 transaction where Pinhasi charged a client approximately $150,000 for recovery services while allegedly making a ransom payment of only about $8,200 to the attackers, pocketing the difference.
Deceptive Tactics: Fake Analysis and Fabricated Proof
The fraud began with an initial "analysis phase" where Pinhasi or his employees charged clients between $2,500 and $10,000 to examine ransom notes and encrypted file samples. During this phase, he would allegedly provide victims with decrypted samples as proof of MonsterCloud’s capabilities — but in many cases, these samples were obtained by sharing the encrypted files directly with cybercriminals, who then returned decrypted versions without the victim’s knowledge.
This fabricated proof was used to convince clients to upgrade to full recovery services, which cost up to two or more times the actual ransom amount. Despite MonsterCloud’s public claims that it would only contact cybercriminals as a last resort, prosecutors allege that engaging attackers was often Pinhasi’s first step in accessing encrypted data.
Legal Proceedings and Potential Penalties
Pinhasi pleaded not guilty to two counts of wire fraud and one count of wire fraud conspiracy during his initial appearance in a federal court in Brooklyn, New York. He was released on a $2 million bond and faces up to 60 years in prison if convicted on all counts.
A federal judge has granted a one-month delay to the trial proceedings to allow time for plea negotiations. Pinhasi’s legal team has not yet responded to requests for comment.
Industry-Wide Implications and Prior Warnings
The case underscores a growing trend in the ransomware economy where individuals and companies exploit victims’ desperation for profit. Earlier this year, three former ransomware negotiators were sentenced to prison for similarly deceiving clients and colluding with ransomware affiliates to extort organizations — effectively victimizing them twice.
As far back as 2019, a ProPublica exposé detailed how MonsterCloud claimed to use proprietary recovery methods while secretly paying ransoms without informing victims, including law enforcement agencies. FBI officials have since condemned the conduct, stating that such actions turn victims’ crises into profit centers and violate the trust placed in incident responders.
James C. Barnacle Jr., assistant director of the FBI, emphasized that the bureau remains committed to holding accountable those who "choose to victimize the very people who trusted them for help."
Despite the indictment, MonsterCloud’s website remains active, featuring testimonials from law enforcement and a former FBI official, and continues to accept inquiries through a contact form.
Source: CyberScoop