A ransomware recovery business is supposed to help organizations escape the consequences of a cyberattack. But US prosecutors say the owner of a Florida-based cybersecurity company built a multimillion-dollar operation by secretly paying ransomware criminals while convincing victims that his proprietary technology could recover their encrypted files.
The US Department of Justice has charged Zohar Pinhasi, the owner of MonsterCloud, with allegedly defrauding ransomware victims out of more than $19 million. According to prosecutors, the company collected substantial recovery fees while quietly paying more than $8 million to the same criminals responsible for encrypting its customers’ data.
The case raises uncomfortable questions about trust, transparency and accountability in an industry where desperate organizations often depend on external specialists to recover from devastating attacks.
A Recovery Service That Allegedly Concealed Its Methods
MonsterCloud marketed itself as a ransomware recovery specialist capable of restoring encrypted information through advanced technical methods.
The company promoted proprietary tools and sophisticated decryption techniques, presenting its services as an alternative to negotiating directly with cybercriminals. Customers were encouraged not to pay ransom demands themselves.
Prosecutors allege that the reality was considerably different.
Rather than independently breaking ransomware encryption, Pinhasi allegedly contacted the attackers, negotiated payments and purchased the decryptors needed to restore customers’ files.
The recovery process may have produced the desired technical outcome, but prosecutors argue that customers were misled about how their data was recovered and what they were actually paying for.
That distinction is central to the case. Paying a ransom and using a proprietary decryption capability are fundamentally different services, with different costs, risks and implications for the victim.
Millions in Payments, Millions More in Fees
The financial details outlined by investigators illustrate the alleged scheme.
In one August 2023 incident, Pinhasi reportedly paid a ransomware operator approximately $8,200 to obtain a decryptor, then billed the affected customer around $150,000.
In another case dating to October 2021, prosecutors say he paid approximately $236,000 to the attackers while charging the victim roughly $380,000.
Across the alleged operation, customers were charged more than $19 million, while payments to ransomware operators exceeded $8 million.
The difference between those amounts is not, by itself, proof of fraud. Incident response companies legitimately charge for technical expertise, investigation, recovery and business continuity services.
The prosecution instead centers on allegations that customers were deliberately deceived about the recovery methods being used, including claims that the company possessed specialized technology capable of decrypting data without paying criminals.
The Problem With Secret Ransom Payments
Ransomware recovery is rarely straightforward. When backups are unavailable or compromised, victims may face enormous pressure to restore operations quickly.
Specialized recovery companies can provide valuable assistance, but their work requires unusually high levels of trust. They may receive privileged access to infrastructure, sensitive business information and direct responsibility for restoring critical systems.
Secretly paying attackers introduces additional complications.
Organizations may have legal, regulatory or insurance obligations affecting ransom payments. They may also need to assess whether the recipient is associated with a sanctioned entity or whether payment creates additional exposure.
When a recovery provider conceals negotiations with criminals, customers lose the ability to make informed decisions about those risks.
There is also a technical concern: obtaining a working decryptor does not necessarily mean the original compromise has been resolved.
Attackers may retain stolen credentials, persistence mechanisms or copies of sensitive information. Restoring encrypted files is only one component of recovering securely from ransomware.
Criminal Charges and a Broader Trust Problem
Pinhasi, a 50-year-old US and Israeli national also known as Zack Silver and Zack Green, faces two counts of wire fraud and one count of conspiracy to commit wire fraud.
Each charge carries a potential maximum sentence of 20 years in prison if he is convicted. The allegations remain unproven, and he is presumed innocent unless prosecutors establish guilt in court.
The FBI has characterized the alleged conduct as turning victims’ emergencies into a source of personal profit rather than genuinely resolving the underlying security threat.
Beyond the criminal case, the allegations expose a difficult reality of the ransomware recovery market.
Victims frequently cannot independently verify whether a recovery provider has developed a genuine technical solution, obtained a decryptor from a third party or negotiated directly with the attackers.
That information imbalance becomes especially dangerous when organizations are facing operational shutdowns, financial losses and pressure to restore services immediately.
The MonsterCloud case is therefore about more than allegedly inflated recovery invoices. It illustrates why transparency over recovery methods, payments and security remediation is essential when selecting an incident response provider.
For ransomware victims, recovering encrypted data is important. Knowing how that recovery was achieved — and whether the attackers still have access — can be just as critical.