MonsterCloud owner accused of hiding ransom payments from recovery clients
Federal prosecutors in New York have charged MonsterCloud owner Zohar Pinhasi with wire fraud and conspiracy. They allege his ransomware recovery business secretly paid cybercriminals for decryption keys while telling customers it used proprietary technology. Pinhasi pleaded not guilty and was released on a $2 million bond.
Pinhasi, 50, also used the names Zack Silver and Zack Green. A federal grand jury in the Eastern District of New York indicted him on September 23; he surrendered, pleaded not guilty, and was released on $2 million bond. Prosecutors allege his Florida company, MonsterCloud, lacked the proprietary decryption tools it advertised.
The alleged scheme ran from June 2018 to June 2023. Prosecutors say MonsterCloud paid attackers for keys, sometimes charged far more than ransoms, and used decrypted samples as proof. A 2019 ProPublica report had raised similar concerns.
The case may heighten scrutiny of ransomware recovery firms, affecting victims who rely on them during crises. If allegations hold, clients could lose trust and face uncertainty about whether payments truly help or fund further crime. Insurers, regulators, and businesses may reassess contracts and disclosure practices. The outcome could shape how recovery services advertise and handle attacker negotiations, though its broader deterrent effect remains uncertain.