A US ransomware-remediation company owner has been charged with allegedly telling clients that he could recover encrypted data without paying attackers, while secretly buying decryption keys from those attackers and charging customers substantially more. The US Department of Justice says Zohar Pinhasi, owner of MonsterCloud, was arraigned in New York on two wire-fraud counts and one wire-fraud-conspiracy count. [1]
The case is an allegation, not a conviction. Pinhasi is presumed innocent, and the indictment must still be tested in court. The evidence released so far does, however, offer a detailed warning about the difference between a decryption service’s marketing claim and the work it actually performs.
Key points
- DOJ alleges MonsterCloud presented proprietary decryption capabilities that Pinhasi did not possess.
- Prosecutors say the company secretly paid ransomware operators for keys and then billed clients more.
- One cited example involved an $8,200 ransom payment and an approximately $150,000 client charge.
- DOJ says clients were charged more than $19 million while more than $8 million was paid in ransom.
- A decryption key can restore files, but it does not by itself remove an attacker from a network.
What happened
The DOJ said Pinhasi, 50, also known as “Zack Silver” and “Zack Green”, marketed MonsterCloud as an alternative to paying ransomware operators. The company’s website warned victims against paying and claimed that its team could recover data through “proprietary tools” and “advanced decryption techniques”. [1]
According to the indictment described by DOJ, prosecutors allege that the special technology did not exist. Instead, Pinhasi allegedly contacted the criminals who had attacked a MonsterCloud client, paid for a decryption key and had employees use that key in an attempt to restore the client’s files. The company then charged the client a fee substantially higher than the ransom it had secretly paid. [1]
The charging announcement identifies the case as a federal prosecution in the Eastern District of New York. It says the FBI is investigating and that the charges carry a maximum penalty of 20 years on each count if there is a conviction. Those are statutory maximums, not a prediction of any sentence or an indication that the allegations have been proved. [1]
How the alleged markup worked
The clearest example in the DOJ account is dated to around August 2023. Prosecutors say Pinhasi paid approximately $8,200 to a cybercriminal and charged the affected client approximately $150,000. [1] The Stack described the alleged arrangement as an arbitrage model: a key bought from the attacker was presented as the result of in-house technology, with the difference between the payment and the bill becoming the provider’s margin. [2]
Across the alleged scheme, DOJ says MonsterCloud charged clients more than $19 million and paid more than $8 million in ransom payments. [1] News reports often describe the difference as an approximately $11 million markup. The totals are allegations attributed to the indictment.
SecurityWeek reported the same $8,200 and $150,000 example and said Pinhasi appeared in a New York court to face wire-fraud charges. [3] Bitdefender also reported the totals and said the alleged conduct involved hundreds of companies in the United States and Canada, while stressing that Pinhasi had been charged but not convicted. [4] These reports corroborate the public account of the case, but they are not independent proof beyond the underlying indictment and DOJ release.
Why it matters for ransomware victims
A ransomware victim may be making decisions under intense pressure: systems are unavailable, deadlines are approaching and an organization may not know whether data was stolen as well as encrypted. That urgency makes a promise of “recovery without paying” especially important to test. The allegation in this case concerns a provider that prosecutors say sold that promise while allegedly using the very payment route it warned clients to avoid.
The operational distinction also matters. Obtaining a working key may help restore files, but it does not establish how attackers entered, whether they created hidden accounts, whether they copied data, or whether they can return after systems are restored. CISA’s response guide tells organizations to isolate affected systems, triage restoration, preserve evidence and investigate for earlier compromise before rebuilding. [6]
The FBI says it does not support paying a ransom because payment does not guarantee that data will be recovered and can encourage further attacks. It directs victims to report ransomware to a local field office or the Internet Crime Complaint Center. [5] That guidance does not mean every recovery case has the same technical or legal answer. It does mean that a provider’s fee, claimed method, chain of custody for keys and incident-response scope should be documented before an emergency decision is made.
What a recovery contract should make clear
The public case does not establish a universal rule about ransomware-remediation firms. It does point to questions that customers and boards should ask before authorizing work. A contract should identify whether the provider may communicate with or pay an attacker, who approves such a payment, what evidence will be preserved, and whether the service includes threat hunting and containment rather than file restoration alone.
Customers should also ask how a provider determines that a decryptor is genuine, whether it has tested the tool on a copy of the data, what happens if restoration fails, and which costs are pass-through payments rather than professional fees. They help separate a technical recovery plan from an unsupported claim of proprietary capability.
CISA advises organizations to engage internal and external stakeholders, including incident-response providers, insurers and relevant authorities, and says federal law enforcement may know about decryptors for some ransomware variants. [6] A provider that resists evidence preservation or refuses to explain the division between recovery, containment and payment should receive additional scrutiny.
What remains uncertain
The DOJ announcement gives the charging facts but not a finding of guilt. The public materials retrieved for this draft do not establish Pinhasi’s defense, the full indictment text, the identity of affected customers or the final accounting of any alleged loss. They also do not establish whether every client received usable files, whether any data was exfiltrated, or what technical work employees performed in individual incidents.
The more-than-$19 million and more-than-$8 million figures are prosecution allegations. The $11 million description should therefore remain an approximate spread, not a confirmed judgment. The same caution applies to descriptions of the number of companies involved and to any claim about MonsterCloud’s broader business practices outside the alleged conduct set out by prosecutors.
What happens next
The federal case will proceed through the court process, where the government’s allegations can be challenged and evidence tested. The FBI investigation and the prosecution by Justice Department and Eastern District of New York attorneys may produce further filings, responses or changes to the public record. [1]
For organizations facing a live ransomware incident, the immediate priority is not to copy the MonsterCloud allegations into a decision rule. It is to isolate affected systems, preserve evidence, involve qualified incident responders and notify appropriate authorities. A decryption key may be one part of recovery; it is not, on its own, a clean bill of health for the network. [5] [6]
