Federal prosecutors have charged Zohar Pinhasi, who owned and operated the Florida-based ransomware remediation company MonsterCloud LLC, with conspiracy to commit wire fraud and two counts of wire fraud. The U.S. Attorney’s Office for the Eastern District of New York alleges that Pinhasi told clients his firm decrypted their files with proprietary tools and advanced techniques, when it was in fact contacting the attackers, obtaining decryption keys, and charging clients well beyond the ransom. These are allegations. Pinhasi has not been convicted, and he is presumed innocent unless and until proven guilty.
What prosecutors allege
A grand jury indicted Pinhasi on September 23, 2026, and he was arraigned on October 7, 2026, according to the Eastern District of New York’s announcement. He is also known as “Zack Silver” and “Zack Green.” The charges are one count of conspiracy to commit wire fraud and two counts of wire fraud.
As an Amazon Associate I earn from qualifying purchases.
The core of the case is a claim about method. Prosecutors allege that MonsterCloud represented that it recovered ransomware-encrypted files without paying attackers, using proprietary tools and advanced decryption techniques. According to the charging release, the firm instead contacted the attackers for decryption keys and charged clients substantially more than the ransom itself.
Recommended Free Tools
The Justice Department alleges that part of each client’s fee went to the attackers and the rest was kept by the company, often at a steep markup. Whether any specific engagement involved concealed payments, or whether the company had any real decryption capability, are questions the indictment raises but that have not been decided in court. Those points should be read as the prosecution’s position.
#1 Best Overall
The figures, and how to read them
The Justice Department’s release cites two sets of numbers. Both are allegations in the charging document, not findings:
- More than $19 million charged to clients, and more than $8 million paid to ransomware attackers, as alleged across the scheme (U.S. Department of Justice, Eastern District of New York, 2026).
- A single example the release describes: approximately $8,200 paid to an attacker against approximately $150,000 charged to one client (U.S. Department of Justice, 2026). The release presents this as an illustrative case within the allegations, not a complete accounting.
The gap between those two figures is the heart of the prosecution’s argument. If the allegations are accurate, the client paid far more for the service than the attacker received, and the difference was retained by the company rather than used to resolve the intrusion.
The timeline is not uniform across reports
Coverage gives different periods for the conduct at issue, and the sources should not be merged. BleepingComputer reports the alleged scheme period as June 2018 through June 2023. The Justice Department’s release, by contrast, describes an example payment made in August 2023, which falls after the period BleepingComputer reports. Readers who need an exact date range should check the charging release and the indictment itself rather than a secondary summary.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Officials’ statements
Three officials spoke on the announcement. Each framed the matter as allegations:
- U.S. Attorney Joseph Nocella Jr.: “As alleged in the indictment, by falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself.”
- Assistant Attorney General A. Tysen Duva: “The defendant is charged with offering an alternative to ransom payments, but instead is alleged to have victimized the victim again and committed additional fraud, harming the victim again.”
- FBI Assistant Director in Charge James C. Barnacle Jr.: “As alleged, Zohar Pinhasi claimed to fix ransomware while never remediating the underlying threat.”
Where the case stands
The announced status is arraignment. Pinhasi pleaded not guilty and was released on a $2 million bond, as reported by BleepingComputer. The reporting available at the time of writing does not establish any later court dates, motions, a trial, or an outcome. If you are reading this after further proceedings, the court docket for the Eastern District of New York is the authoritative source.
Earlier reporting on the same company
This is not the first time MonsterCloud’s methods have been questioned. ProPublica’s May 15, 2019 investigation described concerns about recovery firms that advertised proprietary or high-tech solutions while paying ransomware operators, and it reported earlier allegations involving MonsterCloud. The same article records Pinhasi’s denial that the company misled clients and his statement that recovery methods varied from case to case. That reporting is useful background on why the company drew scrutiny, but it is not evidence for the current charges, which must be tested in court.
Why the case matters beyond one company
Recovery services sell a promise that is hard for a victim to check: that the files will come back without the attacker being paid. A victim facing a shutdown has little time and little leverage, and a firm that describes its method in technical language can be difficult to verify from the outside. The charges, if proven, would mean the marketing claim itself was the fraud.
That is why the case is being read as a warning about the recovery market rather than only about one firm. Whatever happens in court, the questions below are the ones a buyer should ask before paying any provider.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Questions to ask a recovery provider
These checks do not prove a firm is honest, but they make the claims that matter easier to test:
- Ask whether the firm will contact, or has contacted, the attacker. A provider that negotiates or communicates with the threat actor should say so in writing before any engagement begins.
- Ask what the technical method is. Require a specific description of the approach. Be wary of answers that rely only on words such as “proprietary” or “advanced” without any explanation of how files are recovered.
- Separate fees from any ransom. Ask for an itemized quote showing the service fee and any amount that would be paid to the attacker. A single bundled price with no breakdown is a red flag.
- Confirm that any payment requires your approval. You should be able to decline a payment and still receive the service you paid for, with the terms in writing.
- Check for a record of prior disputes or legal action. Search court filings and public reporting under the company’s legal name and its principals’ names.
Protect yourself before an attack
A secondary source covering this case recommends tested offline backups as the most reliable recovery path. Backups that are disconnected from the network and restored in a test at least periodically give you an option that does not depend on any outside firm’s claims. The backup must be verified, because an untested copy may be encrypted or corrupt when you need it.
If you are already affected
- Report the incident to the FBI at ic3.gov or through a local field office.
- Preserve ransom notes, logs, and the names of any firms you have spoken to.
- Involve legal counsel before paying anyone, because payment to a sanctioned party can create legal exposure.
Each of these steps is practical guidance rather than a finding about any particular provider.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
