Ransomware 'Recovery' Firm Owner Charged With Secretly Paying Hackers While Billing Victims Millions

Published Oct. 8, 2026. Case statuses are current as of that date.

When ransomware locks a company's files, the owner faces a terrible choice: pay criminals or lose the data. Federal prosecutors say a Florida remediation company sold a third option that did not exist, and charged victims far more than the ransom it was quietly paying.

On Oct. 7, 2026, Zohar Pinhasi, 50, also known as "Zack Silver" and "Zack Green," a U.S. and Israeli national who owned the ransomware remediation company MonsterCloud, was arraigned in federal court in Brooklyn on wire fraud charges, the Justice Department announced [1].

"As alleged in the indictment, by falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself," said U.S. Attorney Joseph Nocella Jr. for the Eastern District of New York [1].

Important: Pinhasi has pleaded not guilty. An indictment is only an allegation, and he is presumed innocent unless and until proven guilty in court.

How the alleged scheme worked

According to the indictment, as described by the Justice Department [1] and BleepingComputer [2]:

1. The promise. MonsterCloud's website cautioned clients not to pay the ransom and said its team specialized in recovering data without giving in to ransom demands. Pinhasi claimed access to "proprietary tools" and "advanced decryption techniques."
2. The secret step. Prosecutors allege he had no special decryption technology. Instead, he contacted the cybercriminals who had attacked the client, paid them for a decryption key, and had MonsterCloud employees use that key to try to unlock the client's files.
3. The markup. Pinhasi typically charged clients far more than the ransom he secretly paid. In one example, around August 2023, he allegedly paid a cybercriminal about $8,200 and charged the client about $150,000. BleepingComputer reported another example from the indictment in which about $236,000 was paid and the customer was charged about $380,000 [2].
4. The "proof." The indictment also alleges MonsterCloud used decrypted sample files as "recovery proofs" to convince victims it could restore their data, even though those samples came from the ransomware operators, BleepingComputer reported [2].

Over the course of the alleged scheme, which BleepingComputer said ran from June 2018 to June 2023, Pinhasi allegedly charged clients more than $19 million and paid more than $8 million in ransoms [1][2]. BleepingComputer reported that the victims were hundreds of companies in the United States and Canada.

The indictment acknowledges that some MonsterCloud contracts disclosed that the company might communicate with or pay cybercriminals, but says those contracts stated it would do so only if it could not decrypt files by other means. Prosecutors claim dealing with the attackers was usually the company's first step [2].

Earlier questions about the company

BleepingComputer noted that a 2019 ProPublica investigation raised similar concerns, reporting that researchers posing as ransomware victims traced offers to pay their fake attackers back to recovery firms including MonsterCloud. Pinhasi told ProPublica at the time that he did not promise in advance that MonsterCloud could decrypt files, denied misleading customers, and called the company's methods a "trade secret" [2].

The person charged

Zohar Pinhasi, 50 (aka "Zack Silver," "Zack Green"), is charged with one count of wire fraud conspiracy and two counts of wire fraud. Each count carries a maximum of 20 years in prison [1]. A grand jury returned the indictment on Sept. 23, 2026, in United States v. Pinhasi, No. 1:26-cr-00271 (E.D.N.Y.) [3].

The U.S. Attorney's Office told BleepingComputer that Pinhasi surrendered on Oct. 7, pleaded not guilty, and was released on a $2 million bond. BleepingComputer said it had contacted his attorneys, Christopher Clark and Rodney Villazor, for comment [2]. We found no public response from the defense as of publication.

Red flags when hiring a ransomware recovery firm

• A guarantee that it can decrypt "without paying" for a strain that has no publicly available decryptor.
• Vague claims of "proprietary" technology with no explanation of how a specific ransomware variant will be handled.
• A flat fee far above the ransom demand without a written breakdown of what is being paid to whom.
• Contracts that allow contact with the attackers "only if needed," without promising to tell you before any payment.
• "Proof" files that you can't trace to the firm's own work.

The FBI and the Cybersecurity and Infrastructure Security Agency have said in joint guidance that they do not recommend paying ransoms, because payment does not ensure that data is decrypted, that systems will no longer be compromised, or that data won't be leaked [1].

What to do if you're hit by ransomware

1. Contact the FBI through your local field office or at ic3.gov before you pay anyone, including a recovery firm.
2. Ask any vendor in writing whether it will contact or pay the attackers, and require notice and your approval before any payment.
3. Check the free decryptors that law enforcement and security companies publish for known strains.
4. Keep records of all communications, invoices and "proof" files the vendor provides.
5. If you were a MonsterCloud client and believe you were misled, you can contact the FBI; prosecutors have not published a victim hotline in the release we reviewed.

Case status (as of Oct. 8, 2026)

Defendant	Court	Status as of Oct. 8, 2026	Source
Zohar Pinhasi, 50 (aka "Zack Silver," "Zack Green")	Federal, E.D.N.Y. (1:26-cr-00271)	Indicted Sept. 23, 2026 (wire fraud conspiracy, 2 counts wire fraud); arraigned Oct. 7; pleaded not guilty; released on $2M bond	[1], [2], [3]
MonsterCloud LLC	Not charged	Pinhasi's company; not named as a defendant in the releases reviewed	[1], [2]

Pinhasi has not been convicted and is presumed innocent. Statuses can change.

Sources

1. U.S. Department of Justice, Office of Public Affairs, "Known Cybersecurity Expert and Owner of Florida Ransomware Remediation Company Charged with Defrauding Clients," press release, Oct. 7, 2026. https://www.justice.gov/opa/pr/known-cybersecurity-expert-and-owner-florida-ransomware-remediation-company-charged
2. Lawrence Abrams, "Ransomware recovery CEO charged over secret ransom payments," BleepingComputer, Oct. 7, 2026. https://www.bleepingcomputer.com/news/security/ransomware-recovery-ceo-charged-over-secret-ransom-payments/
3. United States v. Pinhasi, No. 1:26-cr-00271 (E.D.N.Y., filed Sept. 23, 2026), docket, CourtListener, accessed Oct. 8, 2026. https://www.courtlistener.com/docket/74843971/united-states-v-pinhasi/

---

Corrections and updates: If you are named in this article, or represent someone who is, and believe anything here is inaccurate or out of date (including a dismissal, acquittal, or change in case status), please contact us at editorandchief@scammers.com. We will review it and update the article promptly.