Feds charge ransomware fixer Zohar Pinhasi with defrauding clients

Federal prosecutors charged Zohar Pinhasi, the 50-year-old owner of MonsterCloud and a dual US-Israeli national also known as Zack Silver and Zack Green, with wire fraud and wire fraud conspiracy in New York. Rather than using the proprietary decryption tools he advertised, Pinhasi allegedly contacted ransomware affiliates directly, paid more than $8 million in ransoms, and then billed victims over $19 million for the recovered keys. In a single instance documented in the indictment he paid about $8,200 to an affiliate and then charged the client approximately $150,000, a markup that exposes the scheme as pure intermediation disguised as technical recovery.

The exposure is not a software vulnerability but a supply-chain trust failure in the ransomware-remediation market. Any organization that engaged MonsterCloud between the start of the alleged scheme and the October 2026 indictment should treat its past recoveries as potentially compromised by unknown attackers who received payment directly from Pinhasi. The $19 million in client fees and $8 million in underlying ransom payments are not abstract losses; they represent real victim budgets diverted to both the defendant and the ransomware affiliates he paid, which means clients paid twice (once to the attacker through Pinhasi, once to MonsterCloud) while receiving no verified proprietary service.

Defenders should audit any past engagement with MonsterCloud, review invoices against claimed decryption events, and treat any data restored through the company as potentially handled by third-party ransomware groups rather than independent tools. There is no patch or version to deploy because the risk is organizational: verify any vendor's decryption claims independently, demand audit trails for key provenance, and prefer direct law-enforcement reporting over unverified remediation intermediaries. The indictment does not specify a technical IoC set or log path, so hunting should focus on financial flows to MonsterCloud and correspondence with the aliases Zack Silver or Zack Green.

The assessment changes if the trial produces additional victim counts or reveals that Pinhasi shared victim data with affiliates beyond the ransom transaction, or if law enforcement releases a confirmed client list. Watch also for any security vendor confirming independent technical review of MonsterCloud's claimed decryption methods, since the indictment's central claim is that those methods never existed.