MonsterCloud ransomware-recovery fraud: owner Zohar Pinhasi charged in EDNY with secretly paying the hackers

Executive Summary

On October 7, 2026, Zohar Pinhasi — the owner and chief executive of the Florida ransomware-remediation company MonsterCloud LLC — was arraigned in federal court in Brooklyn on wire fraud charges, surrendered to authorities, pleaded not guilty, and was released on a $2 million bond.¹² A grand jury in the Eastern District of New York had returned the indictment two weeks earlier, on September 23, 2026, under docket number 26-CR-271 before United States District Judge Ramon E. Reyes, Jr.³ Pinhasi, 50, a dual national of the United States and Israel who used the aliases "Zack Silver" and "Zack Green," is charged with one count of conspiracy to commit wire fraud and two counts of wire fraud, each carrying a statutory maximum of 20 years in prison.¹³

The charged scheme ran from approximately June 1, 2018 to June 30, 2023.³ According to the indictment, MonsterCloud marketed itself as a principled, technical alternative to paying cybercriminals: its website told victims not to pay ransoms and claimed the company could recover encrypted data using "advanced decryption techniques and cutting-edge technology" and "proprietary tools."¹³ In fact, prosecutors allege, Pinhasi had no such technology. He secretly contacted and paid the very ransomware operators who had attacked each client, obtained a decryption key, had MonsterCloud employees run it, and then billed the client a fee that was often many times larger than the ransom he had quietly paid. In one cited transaction he paid an $8,200 ransom and charged the client roughly $150,000 — nearly twenty times the ransom; in another he paid about $236,000 and charged roughly $380,000.¹³ Across the scheme, the indictment alleges, hundreds of companies in the United States and Canada collectively paid MonsterCloud more than $19 million while Pinhasi paid more than $8 million in ransoms, often without informing or consulting the clients before doing so.³

The strongest evidence described in the charging document is Pinhasi's own words. In May 2019 a paid testimonial spokesperson asked Pinhasi whether MonsterCloud actually had proprietary decryption software; he answered in writing, "MonsterCloud doesn't hold any Proprietary technology [to] decrypt the ransomware data," offering to "explain further in [] phone conversations."¹³ The case is built not on unmasking an anonymous hacker but on a lawful company's own paper trail — its marketing copy, its client contracts, its internal euphemisms, its bank records and that 2019 admission. Those same concerns were documented publicly more than three years before the federal investigation file opened: ProPublica's May 2019 investigation "The Trade Secret" reported that MonsterCloud and similar firms almost always just paid the hackers, a finding Pinhasi disputed at the time.⁴

The matter also illustrates how a derived number hardens into a reported fact. SecurityWeek headlined its coverage "Fake Decryption Tools Masked $11M Markup," but the indictment never states an "$11 million markup"; the figure is the arithmetic gap between "more than $19 million" charged and "more than $8 million" paid, both qualified as "over," and it conflates markup with profit.⁵³ The charges are allegations, and Pinhasi is presumed innocent unless and until proven guilty.¹

Verification of Claims

1. Claim: Pinhasi was indicted in EDNY on one count of conspiracy to commit wire fraud and two counts of wire fraud. → Verified → The indictment (26-CR-271, filed September 23, 2026) charges Count One (conspiracy to commit wire fraud, 18 U.S.C. § 1349) and Counts Two and Three (wire fraud, 18 U.S.C. § 1343); the DOJ press release and BleepingComputer report the same structure.¹³²

2. Claim: Pinhasi pleaded not guilty and was released on a $2 million bond. → Verified → The DOJ press release states he was arraigned on October 7, 2026 before Magistrate Judge Peggy Cross-Goldenberg but does not give the plea or bond.¹ BleepingComputer reports that he surrendered, pleaded not guilty, and was released on a $2 million bond.²

3. Claim: The scheme produced an "$11 million markup." → Unverified (as a stated figure) → No primary source states $11 million. It is the difference between two "over" figures — "more than $19 million" charged and "more than $8 million" in ransoms — appearing only in SecurityWeek's headline, not its body or the indictment.³⁵

4. Claim: Pinhasi secretly paid ransomware operators and billed clients a large markup while claiming proprietary decryption technology. → Partially verified → This is the core allegation of the indictment, supported by Pinhasi's quoted May 2019 admission and specific transaction examples.¹³ It remains an allegation; no trial or conviction has occurred, and Pinhasi previously disputed the equivalent 2019 reporting.⁴

5. Claim: ProPublica reported the same conduct in 2019. → Verified → ProPublica's May 15, 2019 investigation "The Trade Secret" named MonsterCloud and reported it paid ransoms while professing proprietary recovery; researcher Fabian Wosar's sting traced ransom-payment offers back to the firm.⁴

Timeline

Operation Anatomy

The indictment describes a two-stage commercial process layered on top of a simple deception: MonsterCloud bought decryption keys from the attackers and resold the result as the product of its own technology.

Intake and the "no-ransom" pitch

Prospective clients were businesses already in crisis — their files encrypted by ransomware (the operators' use of Data Encrypted for Impact, T1486) and often unable to operate.³ Many found MonsterCloud through its website, which discouraged paying ransoms — warning that payment would not guarantee recovery, might encourage further attacks, and "rewarded illegal behavior" — and claimed MonsterCloud could "recover their data without succumbing to ransom demands" using "advanced decryption techniques and cutting-edge technology."¹³ The Register noted the site also billed MonsterCloud as "the most sophisticated Counter Cyber Terrorism team in the world."⁶ Multiple clients engaged the company specifically because they did not want to pay a criminal and would not have authorized any such payment.³

The analysis phase and "recovery proofs"

A MonsterCloud "Controller" (identified in the indictment as Employee-1) handled intake and, at Pinhasi's direction, quoted an "analysis" fee of roughly $2,500 to $10,000, backed by a money-back guarantee.³ MonsterCloud obtained the attacker's ransom note and a sample of encrypted files (usually two) from the client, then returned decrypted samples as "recovery proofs" — presented as evidence that MonsterCloud's technology could recover the data. In many instances, prosecutors allege, Pinhasi had simply forwarded the sample files to the cybercriminal and received the decrypted samples back, without disclosing that no proprietary technology was involved.³

Upsell to "full" recovery

The analysis "success" was the hook. It induced clients to contract for "full" ransomware recovery — a far more expensive service that the indictment says could cost up to two or more times the ransom.³ Pinhasi represented that MonsterCloud possessed specialized decryption methods it could not disclose because they were "trade secrets" involving "proprietary means and methods." It had no such methods.³

Paying the attacker, concealing the payment

To actually recover data, Pinhasi contacted and paid the ransomware operators in exchange for a decryption key (or keys), which MonsterCloud employees then ran against the client's files.³ He generally did not disclose that MonsterCloud paid the criminals, and directed employees and contractors to call the attacker's decryptor a "recovery tool" rather than a "decryptor."³ Some client contracts stated MonsterCloud would contact a cybercriminal "only once all possible means of directly decrypting Client's files have been exhausted"; in fact, dealing with the criminals was generally Pinhasi's first step and the standard way he obtained both "recovery proofs" and decryption keys.³

Billing the markup

MonsterCloud's fee was typically far higher than the ransom it had quietly paid, and the difference — plus the ransom — was passed to the client as the cost of "remediation," without disclosing the ransom payment or the spread.³ Over the scheme, the indictment alleges, Pinhasi facilitated dozens of ransom payments totaling more than $8 million, while hundreds of companies collectively paid MonsterCloud more than $19 million.³

Accused

Name: Zohar Pinhasi, 50, of Hollywood, Florida¹ Aliases: "Zack Silver" and "Zack Green"¹³ Nationality: Dual citizen of the United States and Israel¹³ Role: Owner and Chief Executive Officer of MonsterCloud LLC; per the indictment he managed employees, set client prices, and personally communicated with cybercriminals on behalf of the company³ Status: Charged, not convicted. Arraigned October 7, 2026; surrendered, pleaded not guilty, released on $2 million bond. Presumed innocent unless and until proven guilty.¹²

Charges: Count One — conspiracy to commit wire fraud (18 U.S.C. § 1349); Counts Two and Three — wire fraud (18 U.S.C. § 1343, and § 2). Each count carries a statutory maximum of 20 years' imprisonment; the DOJ release frames the exposure as "up to 20 years," while The Register notes each of the three counts carries up to twenty years.¹³⁶ The indictment also carries a criminal forfeiture allegation under 18 U.S.C. § 981(a)(1)(C), 28 U.S.C. § 2461(c) and 21 U.S.C. § 853(p).³

Co-conspirators: The indictment refers to "multiple co-conspirators" whose identities are "both known and unknown to the Grand Jury," including MonsterCloud employees and contractors; none is charged in this indictment, and the record does not state whether any is cooperating.³

Attribution and naming basis: Named because charged by a federal grand jury and publicly identified by the Department of Justice. This is the accused in a fraud prosecution, not a "threat actor" in the intrusion sense; the ransomware operators MonsterCloud paid are unidentified in the record.

MITRE ATT&CK: No ATT&CK table is forced here. ATT&CK is an adversary-behaviour framework for intrusions, and the charged conduct is a white-collar wire-fraud scheme rather than a technical compromise carried out by the accused. The only ATT&CK-relevant element is the ransomware the clients had already suffered — Data Encrypted for Impact (T1486) — which is context for the victims' predicament, not a technique attributable to Pinhasi.

Technical Indicators

# This is a wire-fraud prosecution, not an intrusion. No file hashes,
# malware samples, C2 domains or network IOCs were disclosed in the
# indictment or the press release. What follows are the behavioural and
# documentary markers of the charged scheme, useful for recognising a
# ransomware-remediation firm operating this way.
marketing_red_flags:
  - "'recover their data without succumbing to ransom demands'"
  - "'advanced decryption techniques and cutting-edge technology'"
  - "'proprietary tools' / 'proprietary means and methods' described as 'trade secrets'"
  - "'the most sophisticated Counter Cyber Terrorism team in the world'"
  - "website testimonials, including from at least one compensated spokesperson"
internal_euphemism:
  - "attacker's decryptor relabelled a 'recovery tool' to avoid the word 'decryptor'"
contract_vs_conduct:
  - "contract: contact cybercriminal 'only once all possible means of directly decrypting Client's files have been exhausted'"
  - "conduct: contacting the cybercriminal was generally the first step"
documentary_admission:
  - "May 2019, Pinhasi in writing: 'MonsterCloud doesn't hold any Proprietary technology [to] decrypt the ransomware data'"
financial_pattern:
  - "ransom ~$8,200 billed ~$150,000 (August 2023)"
  - "ransom ~$236,000 billed ~$380,000 (October 2021)"
  - "Count Two: ~$175,000 wire from Victim 1 (EDNY) to Pinhasi's Florida bank account (April 26, 2021)"
aliases:
  - "Zack Silver"
  - "Zack Green"
file_hashes: none disclosed
network_iocs: none disclosed

Legal and Regulatory Response

Charges and court. United States v. Zohar Pinhasi, E.D.N.Y. Docket No. 26-CR-271 (RER), before United States District Judge Ramon E. Reyes, Jr. (Magistrate Judge Taryn A. Merkl on the indictment). The grand jury returned the indictment on September 23, 2026; it was not sealed, and no arrest warrant was ordered — consistent with Pinhasi's self-surrender at his October 7, 2026 arraignment before Magistrate Judge Peggy Cross-Goldenberg.¹³² The investigation file number (F. #2022R00375) indicates the matter was opened by 2022.³

Counts. One count of conspiracy to commit wire fraud (18 U.S.C. § 1349) and two counts of wire fraud (18 U.S.C. § 1343); Count Two rests on a ~$175,000 wire from Victim 1 to Pinhasi's Florida account on April 26, 2021, and Count Three on an August 2, 2021 interstate telephone call with a Victim 2 representative. A criminal forfeiture allegation seeks proceeds of the offenses.³

Agencies and prosecutors. The FBI New York Field Office investigated; Assistant Director in Charge James C. Barnacle, Jr. is quoted in the release. The case was announced by EDNY U.S. Attorney Joseph Nocella, Jr. and Criminal Division head A. Tysen Duva, with assistance from the Justice Department's Office of International Affairs. It is handled by the EDNY National Security and Cybercrime Section (Assistant U.S. Attorneys Alexander F. Mindlin and Lindsey R. Oken) with Senior Trial Attorneys Brian Mund and Vasantha Rao of the Computer Crime and Intellectual Property Section; Assistant U.S. Attorney Laura Mantell handles forfeiture.¹³

Defense. BleepingComputer identifies Pinhasi's attorneys as Christopher Clark and Rodney Villazor; no defense statement had been reported as of October 8, 2026.²

Regulatory. No civil regulatory action (FTC, SEC or state) tied to MonsterCloud had been announced as of October 10, 2026; the matter is a federal criminal prosecution. The 2019 ProPublica reporting did not result in any publicly announced charges at the time.⁴

Impact Assessment

• Confirmed (by indictment, as allegations): Hundreds of companies across the United States and Canada collectively paid MonsterCloud more than $19 million; Pinhasi facilitated dozens of ransom payments totaling more than $8 million.³
• Confirmed (procedural): Pinhasi charged on three counts, arraigned, released on $2 million bond, pleaded not guilty.¹²
• Reported, not independently confirmed: The characterization of an "$11 million markup" — a derived figure, not stated in any primary source.⁵
• Estimated: Individual-transaction harm is illustrated by two examples (roughly 20x and ~1.6x the ransom); the full per-victim distribution is not in the public record.³
• Named victims: Only two are identified by sector and venue — a home-decor company (Victim 1) and a display manufacturer (Victim 2), both in the EDNY. The hundreds of other affected companies are not named.³
• Unknown: Whether any co-conspirator is cooperating; whether further charges or additional defendants will follow; how investigators first identified the scheme and how they matched ransom payments to client charges (the indictment describes no cryptocurrency tracing, seized infrastructure, or cooperating witness).³
• Original observation: The August 2023 markup example in the indictment falls roughly six weeks after the charged conspiracy period's stated end (June 30, 2023); both scheme dates are pleaded as "approximate and inclusive."³

Lessons and Defensive Recommendations

For organizations hit by ransomware (leadership and incident response):

• Treat a vendor's promise to decrypt without paying as a claim to be tested, not a differentiator to be trusted. The indictment alleges MonsterCloud's "proprietary" recovery was, in practice, buying the attacker's key and reselling it at a markup.³
• Read the contract clause on attacker contact literally and demand disclosure. A term permitting contact "only once all possible means of directly decrypting Client's files have been exhausted" is meaningless if, as alleged here, contacting the criminal is the first step. Require written, contemporaneous disclosure of any ransom payment and its amount.³
• Watch the language. An internal instruction to call a decryptor a "recovery tool" is a tell that the real mechanism is being hidden.³
• For public-sector and regulated victims, an undisclosed ransom payment can carry its own legal exposure (for example, sanctions-screening obligations on the recipient). A remediation firm that pays quietly on your behalf may transfer that risk to you without your knowledge.

For insurers, brokers and procurement:

• Require remediation vendors to attest, in writing, whether recovery will or may involve paying the threat actor, and to itemize ransom versus service fees. The charged harm here is precisely the concealed spread between the two.³

For journalists and researchers:

• A derived number is not a reported fact. The "$11 million markup" exists only as the arithmetic gap between two "over" figures and appears in a headline, not in the indictment; repeating it as a stated figure, or equating markup with profit, overstates the record.³⁵
• Investigative reporting can precede prosecution by years. ProPublica documented this conduct in 2019; the federal case followed. Flagging a practice early, with sourcing, retains value even when charges lag.⁴

Sources