Federal prosecutors in the Eastern District of New York have charged a dual US and Israeli citizen who operated a Florida-based ransomware recovery firm with wire fraud, alleging he misled clients by promising specialized decryption capabilities while quietly paying off the same cybercriminals who had encrypted their data.
Zohar Pinhasi, 50, who also used the names Zack Silver and Zack Green, appeared for arraignment on October 7, 2026, on charges stemming from his work through MonsterCloud.
According to the indictment, Pinhasi positioned his company as an ethical option for businesses already hit by ransomware.
MonsterCloud’s website advised against meeting attackers’ demands and advertised specialized expertise in restoring access through proprietary tools and advanced decryption methods.
Distressed business owners seeking help were told they could recover their files without enriching the criminals responsible.
In practice, investigators say, MonsterCloud lacked any unique technology for breaking encryption.
Instead, Pinhasi and associates reportedly contacted the ransomware operators, paid them for a decryption key, and then used that key in attempts to restore client data.
The company typically billed victims far more than the amount secretly transferred to the attackers.
One cited instance from around August 2023 involved a ransom payment of roughly $8,200 followed by a client invoice of approximately $150,000.
Across the alleged scheme, MonsterCloud is said to have collected more than $19 million in fees while disbursing over $8 million in ransom payments.
Officials framed the case as a secondary victimization of organizations already under attack. Assistant Attorney General A.
Tysen Duva of the Justice Department’s Criminal Division stated that the defendant is accused of offering an alternative to ransom payments only to commit further fraud against the same victims.
US Attorney Joseph Nocella, Jr., for the Eastern District of New York, described the conduct as re-victimizing clients while generating substantial profit, and said his office would pursue both ransomware operators and those who exploit the resulting crises.
FBI Assistant Director James C. Barnacle Jr. noted that the defendant allegedly converted victims’ emergencies into a profit center rather than addressing the underlying threat.
Pinhasi faces two counts of wire fraud and one count of conspiracy to commit wire fraud.
Each charge carries a maximum statutory penalty of 20 years in prison if he is convicted.
The FBI is handling the investigation, with prosecution led by Senior Trial Attorneys Brian Mund and Vasantha Rao of the Criminal Division’s Computer Crime and Intellectual Property Section, along with Assistant US Attorneys Alexander Mindlin and Lindsey Oken of the Eastern District of New York.
The announcement referenced joint FBI and Cybersecurity and Infrastructure Security Agency guidance that generally advises against paying ransomware demands, noting that payment does not guarantee data recovery, prevent further compromise, or stop potential leaks. As with all federal indictments, the charges remain allegations, and the defendant is presumed innocent unless and until proven guilty beyond a reasonable doubt.