MonsterCloud owner accused of covert ransom payments and inflated client fees
US prosecutors have charged Zohar Pinhasi, owner of Florida-based MonsterCloud, with fraud over an alleged scheme to pay ransomware gangs without clients' knowledge. He is accused of billing clients more than $19 million while paying attackers over $8 million, including one case where an $8,200 payment led to a $150,000 charge. MonsterCloud marketed itself as an alternative to paying ransoms, but prosecutors say it lacked proprietary decryption technology.
Prosecutors say Pinhasi, also known as “Zack Silver” and “Zack Green,” is a 50-year-old US and Israeli national from Hollywood, Florida. He ran MonsterCloud, which presented itself as a way to recover files without yielding to extortion. Authorities allege the firm actually bought decryption keys from the same attackers, then charged clients much more. In one August 2023 matter, an approximately $8,200 payment reportedly became a roughly $150,000 bill.
The indictment also claims some website endorsements were purchased. In May 2019, an alleged paid promoter asked whether MonsterCloud owned decryption software, and Pinhasi reportedly answered that it did not. He faces two wire fraud counts and one wire fraud conspiracy count, each carrying a possible 20-year sentence.
The case may deepen mistrust in ransomware recovery vendors, especially for small businesses and public organizations that turn to outside specialists during emergencies. If the allegations are proven, victims could face both extortion losses and inflated fees, while legitimate firms may encounter greater scrutiny. It could also prompt buyers to demand clearer proof of recovery methods and stronger billing transparency, though the broader effect on ransomware payments remains uncertain.