MonsterCloud Owner Pleads Not Guilty to Wire Fraud Charges Over Alleged Undisclosed Ransom Payments

A federal grand jury in the Eastern District of New York returned an indictment on Sept. 23 charging Zohar Pinhasi, owner of the Florida-based ransomware remediation firm MonsterCloud, with wire fraud offenses. Pinhasi has pleaded not guilty and has not been convicted. Everything below is an allegation by federal prosecutors, as relayed in press reports.

The indictment charges one count of wire fraud conspiracy and two counts of wire fraud, according to BleepingComputer, CyberScoop and The Hacker News. Pinhasi, described as a 50-year-old U.S. and Israeli national, was arraigned in federal court in Brooklyn on Oct. 7. He pleaded not guilty and was released on a $2 million bond.

What prosecutors allege

Prosecutors allege MonsterCloud advertised proprietary tools and advanced decryption techniques that could recover data without paying criminals, but had no such technology. Instead, they say, the firm contacted ransomware operators, paid for decryption keys (the codes that unlock scrambled files) and used them to restore data, typically without telling clients.

The alleged scheme ran from June 2018 to June 2023 and involved hundreds of companies in the United States and Canada. Prosecutors say Pinhasi and co-conspirators facilitated more than $8 million in ransom payments while charging clients more than $19 million for recovery services.

The billing allegedly ran in two steps. Clients first paid an analysis fee of $2,500 to $10,000, and the firm allegedly obtained decrypted sample files from the attackers and presented them as proof it could recover data. Full recovery was then quoted at up to two times the ransom or more.

Two incidents cited in the indictment show the alleged gap. In August 2023, about $8,200 was paid in ransom and the client was billed about $150,000. Around October 2021, a ransom of about $236,000 led to a bill of about $380,000.

the defendant re-victimized his clients while extracting a hefty profit for himself

Joseph Nocella Jr., U.S. Attorney, Eastern District of New York, BleepingComputer

The disclosure question

Some MonsterCloud contracts disclosed that the firm might contact or pay cybercriminals, but only after other decryption means were exhausted. Prosecutors say contacting the attackers was typically the first step. They also allege multiple clients hired the firm specifically because they did not want to pay criminals.

The FBI and CISA advise victims not to pay ransoms. For a company in the middle of an outage, a vendor’s description of its methods may be the only information it has about how files come back.

Instead, he turned the victim's crisis into his own profit center.

James C. Barnacle Jr., FBI Assistant Director, The Hacker News

Earlier reporting on the firm

A 2019 ProPublica investigation, summarized by The Record and BleepingComputer, reported that MonsterCloud paid ransoms while implying it had another solution. Researchers posing as victims saw payment offers sent to fake attacker accounts. Pinhasi denied misleading clients and called his methods a trade secret.

CyberScoop reported that MonsterCloud’s website still carries testimonials from law enforcement and a former FBI official. The Record reported that John Pistole, a former FBI deputy director, was paid as a spokesperson.

Why it matters for response vendors

The case points to legal risk for incident response and recovery vendors that pay ransoms without telling clients or that misdescribe how they restore data. Vendors that facilitate ransom payments also face disclosure and sanctions questions. None of the reports say Pinhasi was charged with sanctions violations, so that exposure is context, not part of this indictment.

Treasury has sanctioned ransomware-supporting infrastructure providers, including Zservers in February 2025 and Media Land on Nov. 19, 2025. Those actions targeted hosting services, not recovery firms, but they show the agency’s focus on the ransomware supply chain.

Buyers have a practical step. Hot for Security noted that a decryption key does not by itself mean the intrusion has been investigated or remediated. Companies that hired recovery vendors can check whether their contracts say when the vendor will contact or pay attackers, and whether it must tell them first.

It baffles me that companies fall for this

Jon DiMaggio, Arkem Cyber, CyberScoop

What to watch

CyberScoop reported that at the arraignment, prosecution and defense said they were discussing a plea deal, and a judge reportedly granted a one-month delay in trial proceedings.

Reports differ on the possible penalty: The Record, BleepingComputer and The Hacker News cite up to 20 years, while CyberScoop cites up to 60. No primary Justice Department document was available for this article, so the maximum is not stated here.