- Pinhasi was charged with two counts of wire fraud and one count of wire fraud conspiracy.
- The Justice Department alleges that he paid attackers for decryption keys instead of using special decryption technology.
- The department alleges that he charged clients more than $19 million and paid more than $8 million in ransom payments.
The U.S. Department of Justice said MonsterCloud owner Zohar Pinhasi was arraigned on two counts of wire fraud and one count of wire fraud conspiracy over alleged false representations that he could decrypt ransomware without paying cybercriminals.
The department alleges that Pinhasi secretly paid the attackers who had targeted MonsterCloud clients, then generally charged those clients substantially more than the ransom. It alleges he charged clients more than $19 million and paid more than $8 million in ransom payments.
Ransomware is malware that holds a victim’s private data hostage until a ransom is paid. The alleged scheme ran from June 2018 through June 2023 and affected hundreds of companies in the United States and Canada, according to Bitdefender’s reporting on the indictment.
On this page
The indictment alleges MonsterCloud used ransom payments as a hidden service
The Justice Department said Pinhasi claimed MonsterCloud offered a principled alternative to paying ransomware attackers. Prosecutors allege that he had no special technology to decrypt data and instead contacted and paid the cybercriminals who had attacked a client in exchange for a decryption key.
The department alleges that MonsterCloud typically charged a client substantially more than the ransom it secretly paid. In or around August 2023, it alleges that Pinhasi paid approximately $8,200 to a cybercriminal and charged the client approximately $150,000.
The alleged scheme included claims about decryption tools and customer results
The Hacker News reported that MonsterCloud claimed to have “proprietary tools” and “advanced decryption techniques” that could recover encrypted data without yielding to ransom demands.
The Hacker News also reported that, in another incident around October 2021, Pinhasi allegedly paid approximately $236,000 and charged the customer about $380,000.
Bitdefender reported that prosecutors said MonsterCloud displayed customer testimonials, including some involving paid spokespersons.
FBI investigation follows charges in federal court
Bitdefender reported that Pinhasi, also known as Zack Silver and Zack Green, was arraigned Oct. 7 in federal court in Brooklyn. The Justice Department said the FBI is investigating the case.
The Justice Department said FBI and CISA guidance does not recommend that ransomware victims pay ransom. It said paying does not ensure that data will be decrypted, systems or data will no longer be compromised, or data will not be leaked.
The FBI is investigating the case. If convicted, Pinhasi faces a maximum penalty of 20 years on each count.
The Justice Department said an indictment is merely an allegation and that defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.
What to do now
- Do not pay ransom, following FBI and CISA guidance.
- Before an incident happens, identify reputable incident-response providers and establish a response plan.
FAQ
What was Zohar Pinhasi charged with?
The Justice Department charged him with two counts of wire fraud and one count of wire fraud conspiracy.
What does the Justice Department allege Pinhasi did?
It alleges that he falsely claimed MonsterCloud could decrypt ransomware without paying cybercriminals, then secretly paid attackers and charged clients more than the ransom.
How much money did MonsterCloud allegedly charge and pay?
The department alleges that Pinhasi charged clients more than $19 million and paid more than $8 million in ransom payments.
Was Pinhasi convicted?
The Justice Department said an indictment is merely an allegation and that defendants are presumed innocent until proven guilty beyond a reasonable doubt.
What is ransomware?
Ransomware is malware that takes a victim’s private data hostage until a ransom is paid.
Sources
- Known Cybersecurity Expert and Owner of Florida Ransomware Remediation Company Charged with Defrauding Clients, U.S. Department of JusticePrimary
- MonsterCloud Owner Accused of Billing Over $19M While Secretly Paying Ransoms to Decrypt Data, The Hacker News
- Ransomware recovery firm boss charged with secretly paying attackers and overcharging victims, Help Net Security
- Ransomware recovery boss accused of secretly paying hackers, Bitdefender
- Ransomware, Wikipedia
How we checked this story
| Claim | Source | Status |
|---|---|---|
| The Justice Department said Zohar Pinhasi was arraigned on wire fraud charges over alleged false claims that he could decrypt ransomware without paying cybercriminals. | U.S. Department of Justice | Confirmed |
| The indictment alleges that Pinhasi claimed MonsterCloud offered an alternative to paying ransomware attackers. | U.S. Department of Justice | Confirmed |
| Pinhasi was charged with two counts of wire fraud and one count of wire fraud conspiracy. | U.S. Department of Justice | Confirmed |
| If convicted, Pinhasi faces a maximum penalty of 20 years on each count. | U.S. Department of Justice | Confirmed |
| The Justice Department alleges that Pinhasi had no special decryption technology and instead paid the cybercriminals who attacked MonsterCloud clients for decryption keys. | U.S. Department of Justice | Confirmed |
| The Justice Department alleges that Pinhasi generally charged clients substantially more than MonsterCloud secretly paid in ransom. | U.S. Department of Justice | Confirmed |
| In or around August 2023, Pinhasi allegedly paid approximately $8,200 to a cybercriminal and charged the client approximately $150,000. | U.S. Department of Justice | Confirmed |
| The Justice Department alleges that Pinhasi charged clients more than $19 million and paid more than $8 million in ransom payments. | U.S. Department of Justice | Confirmed |
| The FBI is investigating the case. | U.S. Department of Justice | Confirmed |
| The Justice Department said an indictment is merely an allegation and defendants are presumed innocent until proven guilty beyond a reasonable doubt. | U.S. Department of Justice | Confirmed |
| The Justice Department said paying ransom does not ensure that data will be decrypted, systems or data will no longer be compromised, or data will not be leaked. | U.S. Department of Justice | Confirmed |
| The Hacker News reported that the Justice Department announced the charges on Wednesday against a 50-year-old U.S. and Israeli national. | Wednesday, via The Hacker News | Attributed |
| The Hacker News reported that MonsterCloud claimed to use proprietary tools and advanced decryption techniques to recover encrypted data without ransom payments. | The Hacker News | Attributed |
| The Hacker News reported that in another incident around October 2021, Pinhasi allegedly paid approximately $236,000 and charged the customer about $380,000. | The Hacker News | Attributed |
| Help Net Security reported that MonsterCloud’s owner faces fraud charges for allegedly secretly paying ransomware gangs while overcharging clients for decryption services. | Help Net Security | Attributed |
| Bitdefender reported that Pinhasi was arraigned on Oct. 7 in federal court in Brooklyn on two wire fraud counts and one wire fraud conspiracy count. | Bitdefender | Attributed |
| Bitdefender reported that the alleged scheme ran from June 2018 through June 2023 and affected hundreds of companies in the United States and Canada. | Bitdefender | Attributed |
| Bitdefender reported that MonsterCloud allegedly displayed customer testimonials, including some involving paid spokespersons. | Bitdefender | Attributed |
| Bitdefender said proper incident response includes investigating entry, compromised systems and accounts, malicious access, data theft, safe restoration and security gaps. | Bitdefender | Attributed |
| Wikipedia defines ransomware as malware that holds a victim’s private data hostage until a ransom is paid. | Wikipedia | Confirmed |
| justice.gov published its report on Oct 7, 2026. | justice.gov | Confirmed |
Could not verify
- Whether Pinhasi will be convicted is not established
- Whether the alleged scheme affected a specific number of companies is not established
- Whether the alleged payments involved any particular ransomware groups is not established
- Whether any victims’ data was stolen or leaked is not established
Related stories
Vulns & PatchesSonicWall and Splunk announced patches for flaws enabling code execution
AI-Powered AttacksSilent Ransom Group chats showed plans for physical intrusions and extortion
Vulns & PatchesHadrian raised $40 million to expand its AI offensive security platform