MonsterCloud owner Zohar Pinhasi allegedly paid ransomware demands behind clients’ backs, then charged them millions for the supposed recovery.
Zohar Pinhasi, the owner of Florida-based MonsterCloud, was charged this week with wire fraud. Federal prosecutors say his clients were scammed twice during the same ransomware crisis.
Pinhasi (50) also used the names “Zack Silver” and “Zack Green,” which is a surprising number of aliases for someone running a legitimate ransomware recovery business. MonsterCloud ’s website told clients not to pay ransoms and promised that its team could recover encrypted data without dealing with cybercriminals. Prosecutors say the company was doing the exact opposite.
According to the indictment, Pinhasi claimed to have proprietary tools and advanced decryption techniques that let him crack ransomware without negotiating with attackers. He allegedly had none of that. Instead, he contacted the same cybercriminals who’d hit his client, paid them for a decryption key, then had MonsterCloud staff use that key and present the recovery as the product of his own technology.
“Pinhasi typically charged MonsterCloud’s clients a fee that was substantially higher than the ransom that MonsterCloud secretly paid.” reads the press release published by DoJ.
The math is where it gets ugly. Prosecutors cite one case from August 2023 where Pinhasi paid a ransom of roughly $8,200, then billed the client about $150,000 for the “service.” Across the whole scheme, he allegedly collected more than $19 million from clients while quietly paying out over $8 million in ransom money himself, pocketing the difference while selling the opposite of what he was actually doing.
“The defendant is charged with offering an alternative to ransom payments, but instead is alleged to have victimized the victim again and committed additional fraud, harming the victim again,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “This prosecution underscores the Department’s commitment to protecting ransomware victims, regardless of how these cyber ransoms occur.”
That phrase captures the real damage here. Ransomware victims are already dealing with locked files, operational chaos, and the gut punch of being extorted. Finding out afterward that your “ethical” recovery firm secretly paid your attacker and marked up the bill nearly twentyfold isn’t a service failure, it’s exploitation dressed up as rescue.
The FBI and CISA have clear guidance on ransomware payments: they do not recommend paying because it does not guarantee that the data will be decrypted, that the attackers will leave the network, or that stolen data will not be leaked.
Pinhasi faces two wire fraud charges and one conspiracy charge. Each charge carries a possible sentence of up to 20 years if he is convicted, but the charges are only allegations at this stage.
For anyone choosing a ransomware recovery company, claims about “proprietary decryption tools” should be a reason to ask more questions, not simply trust the vendor.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, MonsterCloud)
