MonsterCloud CEO Indicted for Secretly Paying Hackers While Billing Victims $19 Million

A federal grand jury in the Eastern District of New York indicted Zohar Pinhasi, 50, owner of ransomware recovery firm MonsterCloud, on Sept. 23, 2026. He faces a count of conspiracy to commit wire fraud alongside two separate wire fraud charges tied to how he billed clients. Pinhasi was arraigned in Brooklyn federal court, pleaded not guilty and was released on a $2 million bond.

Prosecutors say Pinhasi also went by the aliases Zack Silver and Zack Green. The indictment covers conduct from June 2018 to June 2023, a five-year run in which MonsterCloud marketed itself as a company with proprietary tools and advanced techniques to unlock ransomware-encrypted files without paying the attackers who encrypted them.

How the scheme allegedly worked

There was no proprietary technology, according to prosecutors. MonsterCloud instead paid ransomware operators directly for the decryption keys, then handed clients a bill that had nothing to do with what the company actually spent. Some contracts did disclose that MonsterCloud might contact or pay attackers, but only framed that as a last resort after other recovery methods failed.

Prosecutors say paying the attackers was the standard practice, not the exception. In one case from August 2023, Pinhasi allegedly paid a ransomware gang about $8,200 to get a client’s data back, then charged that client roughly $150,000. In another, from October 2021, he allegedly paid about $236,000 in ransom and billed the customer approximately $380,000.

Prosecutors tally the full scheme at roughly $8 million funneled to attackers across hundreds of cases, set against client invoices topping $19 million for the same work. The gap between those two numbers is the alleged fraud: companies paying for a service pitched as ransom-free when, according to the indictment, it rarely was.

MonsterCloud also allegedly staged proof of its supposed decryption skill. When ransomware gangs decrypted a handful of sample files as a standard negotiation tactic to show a key works, prosecutors say MonsterCloud used those decrypted samples to convince prospective clients the company could break the encryption on its own. The company typically charged an upfront analysis fee ranging from $2,500 to $10,000 before quoting a follow-on fee for full data recovery that could run to twice the ransom it had already quietly negotiated.

Each wire fraud count carries a maximum of 20 years in prison if Pinhasi is convicted. U.S. Attorney Joseph Nocella Jr. said the scheme caused real harm to companies already dealing with a cyberattack, describing Pinhasi as having compounded their losses to enrich himself.

FBI Assistant Director James C. Barnacle Jr. offered a similar assessment, saying Pinhasi claimed to fix ransomware infections without ever addressing the underlying intrusion, and that he built a business around victims’ worst days.

This isn't the first time MonsterCloud got caught

A 2019 ProPublica investigation already flagged this exact behavior. Security researcher Fabian Wosar built fake ransomware, posed as a victim, and watched recovery firms including MonsterCloud and Proven Data quietly reach out to the attacker-controlled email address to negotiate a ransom payment behind the client’s back. At the time, Pinhasi denied MonsterCloud promised decryption in advance and called the company’s methods a trade secret.

According to the Justice Department, a May 2019 message exchange tells a different story. A paid MonsterCloud promoter asked Pinhasi directly whether the company actually held proprietary decryption technology. Prosecutors say Pinhasi answered that it did not.

Former FBI deputy director John Pistole was paid to serve as a MonsterCloud spokesperson around that time. He told ProPublica in 2019 that paying ransoms amounted to the company’s actual approach to doing business.

That’s a seven-year gap between the first public warning signs and a federal indictment. Earlier in 2026, former ransomware negotiators were separately sentenced to prison for deceiving the clients of their employers and conspiring with ransomware affiliates to extort the same victims they were supposedly protecting. Reports differ on exactly how many negotiators were sentenced, but the pattern is the same: people hired to stand between victims and attackers instead worked both sides.

Why this keeps happening

Ransomware recovery is not a licensed profession. There’s no regulator checking whether a firm’s proprietary decryption tools actually exist before it signs a contract with a hospital, a school district or a manufacturer that just got locked out of its own systems. Victims under pressure, often facing operational shutdowns and looming deadlines from attackers, have little ability to verify a vendor’s claims at the moment.

The FBI and the Cybersecurity and Infrastructure Security Agency have repeatedly advised organizations never to pay ransoms, partly because payment funds further criminal activity and doesn’t guarantee usable data back. MonsterCloud’s alleged model undermined that guidance twice over: it paid ransoms anyway, then hid that fact from the very clients who thought they’d avoided doing so. Prosecutors announced the indictment with MonsterCloud’s website still live, soliciting new clients and featuring testimonials, including one from a former FBI official.

Court filings indicate prosecutors and defense attorneys have been in plea negotiations, and a judge granted a one-month delay in the case. A 2017 company biography described MonsterCloud as having about 70 employees and 7,000 clients worldwide, with Pinhasi, an Israeli military veteran with a background in security intelligence, publicly warning against paying ransoms years before the alleged scheme is said to have run.

What oversight could look like

Nothing in federal law currently requires a ransomware recovery firm to disclose whether it pays attackers, to prove it holds the decryption capability it advertises, or to cap fees relative to actual costs. The MonsterCloud and negotiator cases both suggest prosecutors fill the gap after the fact, through wire fraud charges, rather than any standard that prevents the harm up front. Disclosure requirements, licensing, or a baseline duty to tell clients exactly how recovery happened would close that gap before more companies get billed for a service that never existed as advertised.

How to protect yourself

If your organization gets hit by ransomware, ask any recovery firm to show its method before you pay a cent, not after. Get in writing whether the firm intends to contact or pay the attackers, and under what circumstances. Compare any quoted recovery cost against publicly reported ransom averages for your sector, and be skeptical of a company that can’t explain its decryption process without citing a trade secret. Report the incident to the FBI’s Internet Crime Complaint Center regardless of which recovery path you choose, since that report feeds the investigations that eventually catch firms like this one.