Ransomware firm's CEO charged with billing victims for ransoms

Zohar Pinhasi, owner and CEO of Florida-based ransomware remediation firm MonsterCloud, appeared in Brooklyn federal court on October 7 to face two counts of wire fraud and one count of wire-fraud conspiracy filed by the U.S. Attorney's Office for the Eastern District of New York. Prosecutors allege the company collected more than $19 million from clients while paying a bit over $8 million to ransomware operators, behaving more like a courier than the "no-ransom" decryption service it marketed itself as. The case remains pending; Pinhasi is presumed innocent.

The indictment alleges Pinhasi advertised proprietary decryption tools and a principled stance against paying ransoms. What the company supposedly had in-house, prosecutors say, was nothing of the sort: there were no special decryption capabilities to speak of. The actual recovery path ran through the criminal groups themselves.

The mechanism: marketing a "no-ransom" stance while quietly paying attackers

The alleged scheme fits a specific failure of trust. A victim hit by ransomware cannot verify who can decrypt their data and what the real cost should be. That asymmetry is the vulnerability MonsterCloud exploited, repeatedly, over a five-year period.

According to the allegations, Pinhasi — who also used the pseudonyms "Zack Silver" and "Zack Green" — contacted cybercriminals directly to purchase decryption keys, then billed clients far above what was actually paid out. The company's own materials reinforced the fiction; the website reportedly advised victims against paying ransoms and touted advanced decryption techniques, while the payments to attackers supposedly continued behind the scenes.

The August 2023 transaction prosecutors cite illustrates the mark-up. Pinhasi allegedly paid about $8,200 to a cybercriminal for a decryption key, then charged the client about $150,000 — roughly an 18-fold increase. The indictment reportedly cites a separate transaction as well, in which the company allegedly paid $236,000 to an attacker and charged the client $380,000.

The pattern leaned on several controls that are familiar to anyone who has watched ransomware recovery from the outside: non-disclosure agreements kept victims from comparing notes, and insurance policies paid out on claim submission regardless of the actual cost incurred. Payments to attackers totaled over $8 million across the scheme, against more than $19 million in client fees.

What's supported and what's not

The numbers come with limits worth stating plainly. The $19 million billed and $8 million paid are alleged totals over a five-year stretch, not audited accounts. The $8,200-to-$150,000 example is a single cited transaction, illustrative rather than representative, though the separate $236,000-to-$380,000 example points to a pattern rather than one bad deal. The charges are filed by prosecutors, not established findings, and the defense case has not been heard.

What the record does support is the structural mechanism: an intermediary with control over information flow, access to insurance payouts, and no obligation to disclose its real counterparties can turn a victim's emergency into a profit center. The double dip — billing the client for the ransom, then billing them again for "services" that consisted of arranging the ransom — is the recognizable failure here.

The insight beyond the announcement

The case is a reminder that in ransomware response, the negotiation layer is itself a supply chain, and supply-chain trust failures do not require malicious code. A vendor with NDAs and no verification of its counter-party relationships can convert desperation into recurring revenue while the real decryption capability sits with the adversary. The FBI and CISA are investigating; each wire-fraud count carries a maximum of 20 years in prison. The decisive open question — how many other brokers operate a comparable pass-through model with sounder legal cover — is not answered in this indictment.

Explore more coverage on BeansSearch this story across publishers→