Cybersecurity

MonsterCloud Owner Charged in Ransomware Recovery Scheme

Federal authorities have charged the owner of MonsterCloud with wire fraud after he allegedly masked ransom payments behind fake proprietary decryption tools, netting a massive markup from victim organizations.

Radwan AbdulhadiEditor and technology writer

Published: October 8, 2026 · Updated: October 8, 2026 · 3 min read

MonsterCloud Owner Charged in Ransomware Recovery Scheme — Image: SecurityWeek

Court Appearance Over Fraudulent Ransomware Remediation

The owner of a US company has been charged in federal court with defrauding clients through a deceptive ransomware remediation scheme. Zohar Pinhasi, a 50-year-old US and Israeli national also known by the aliases 'Zack Silver' and 'Zack Green', appeared in a New York court to face wire fraud charges. Pinhasi is the owner of MonsterCloud, an organization that publicly positioned itself as a defender of ransomware victims.

According to the official indictment, Pinhasi heavily cautioned ransomware victims against paying cybercriminals. Simultaneously, he allegedly made false claims that his company possessed the capability to decrypt compromised systems independently.

The Mechanics of the Deceptive Recovery Scheme

Rather than utilizing advanced internal capabilities, Pinhasi's operation relied on secretly cooperating with the very threat actors who targeted his clients. Pinhasi allegedly claimed that MonsterCloud was deploying proprietary tools and advanced decryption techniques to recover encrypted data safely without paying the attackers.

Instead of executing these advanced proprietary methods, he directly contacted the ransomware groups that hacked his clients, paid them ransoms to secure the decryption keys, and subsequently charged victim organizations a massive fee for restoring their data using those exact keys. This hidden markup allowed him to drastically inflate costs for organizations already suffering from operational disruption.

Inflated Markups and Multi-Million Dollar Figures

The financial scale of the operation detailed in the indictment reveals immense markups charged to distressed companies. In one specific instance highlighted by federal authorities, Pinhasi made a ransom payment of approximately $8,200 to a ransomware affiliate before charging the client approximately $150,000 for the supposed remediation service.

Throughout the course of the entire alleged scheme, Pinhasi paid over $8 million in ransoms to various cybercriminal groups. In return, he billed his victimized clients a cumulative total exceeding $19 million.

Legal Charges and Potential Penalties

As a result of the investigation and subsequent indictment, Pinhasi faces severe legal consequences. He has been formally charged with wire fraud and wire fraud conspiracy, offenses that carry potential prison sentences spanning tens of years.

The case highlights ongoing federal crackdowns on illicit cyber operations, joining recent international arrests and legal actions reported by outlets such as SecurityWeek, which frequently documents global cybersecurity law enforcement updates like Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany.

Statements from Law Enforcement Officials

Federal prosecutors emphasized the cynical nature of the fraud, noting that the accused took advantage of organizations already reeling from damaging cyberattacks. Assistant Attorney General A. Tysen Duva condemned the operations, stating that the defendant offered an alternative to ransom payments but instead allegedly victimized the victim again and committed additional fraud, causing further harm.