MonsterCloud owner charged over hidden ransom payments

MonsterCloud owner Zohar Pinhasi has been charged with fraud for allegedly selling ransomware victims a misleading account of how he recovered their files: prosecutors say he secretly paid the attackers rather than using the independent recovery methods he advertised. Ransomware is malicious software that locks files and is used to demand payment for their release. The case concerns what victims were told about restoring their data, and how much they were charged for that work.

The U.S. Department of Justice (DoJ) announced the charges on Wednesday. Pinhasi, a 50-year-old U.S. and Israeli national also known as Zack Silver and Zack Green, faces two counts of wire fraud and one count of wire fraud conspiracy. Those charges concern alleged deception using electronic communications and an alleged agreement to commit that fraud. Each count carries a possible prison sentence of up to 20 years if he is convicted. The accusations are allegations, not findings of guilt.

According to the allegations, Pinhasi owned and operated MonsterCloud in Florida and encouraged customers not to pay the criminals holding their data hostage. He allegedly represented that the company had its own specialized tools and sophisticated methods capable of restoring encrypted data without a ransom payment. Encrypted data has been transformed into an unreadable form; a decryptor is a tool that can reverse that process when supplied with the necessary means to unlock it.

Prosecutors describe a different recovery process. They allege that Pinhasi did not have the specialized tools he claimed to possess and instead contacted the ransomware operators, paid them and obtained a decryptor to restore customers' information. MonsterCloud's fees allegedly exceeded those concealed payments by substantial amounts. The central accusation is therefore not simply that money reached ransomware operators, but that clients were misled about the method they were buying.

Two transactions described in the source illustrate the alleged billing pattern. In August 2023, Pinhasi allegedly paid an attacker approximately $8,200 while charging the customer approximately $150,000. In another incident, in or around October 2021, he allegedly paid approximately $236,000 and billed the customer about $380,000. Overall, prosecutors accuse him of charging clients more than $19 million and making more than $8 million in ransom payments. Those totals describe customer charges and payments to attackers, not an established measure of net profit.

MonsterCloud's website, as described in the report, promotes sophisticated decryption methods and modern technology for restoring data. Its guidance on whether victims should pay a ransom warns that payment does not assure a successful recovery and rewards criminal activity. However, a separate answer about whether the company pays attackers for clients is less categorical. It discourages customers from paying themselves, describes experience dealing with ransomware perpetrators and says the company sometimes uses other approaches to resolve incidents. It also states that the service contract discloses all terms. That website language does not establish what individual customers were told or what their contracts contained.

Joseph Nocella, Jr., U.S. Attorney for the Eastern District of New York, characterized the alleged deception as exploiting victims a second time by profiting from false claims of recovery without ransom payments. James C. Barnacle Jr., an assistant director at the U.S. Federal Bureau of Investigation (FBI), also alleged that Pinhasi presented the service as a ransomware fix without addressing the underlying threat. Recovering readable files and removing the cause of a compromise are different tasks; a successful restoration alone does not demonstrate that an affected system is safe.

For businesses, website owners and IT teams, the practical issue is transparency when buying recovery services under pressure. Before authorizing work, ask for a written explanation of the recovery method, whether the provider will contact or pay attackers, and which costs the quoted fee covers. Separately, establish whether the work includes investigating and addressing the intrusion, rather than only returning access to files. These questions follow directly from the distinction at the heart of the allegations, without assuming that every recovery provider operates in the same way.

For readers reviewing those responsibilities, AEU-I offers security-first IT, infrastructure and consulting, services relevant to planning how systems are protected and how outside recovery work is assessed. The supplied report does not include a response from Pinhasi or a court determination of the charges, so the alleged deception and the claimed failure to address the underlying threat remain accusations attributed to the authorities.