Florida Ransomware 'Expert' Charged With Secretly Paying the Hackers He Promised to Beat

Key points

• The U.S. Department of Justice arraigned Zohar Pinhasi, 50, in the Eastern District of New York on wire fraud charges tied to his Florida firm MonsterCloud.
• Prosecutors allege Pinhasi told victims his company could recover files without paying criminals, then paid the ransoms in secret and billed clients far more.
• Pinhasi, a dual U.S. And Israeli citizen, also used the aliases "Zack Silver" and "Zack Green," according to the indictment.
• The case is one of the first federal prosecutions targeting a ransomware "recovery" vendor rather than the hackers themselves.
• Victims included U.S. Police departments and small governments that had publicly refused to deal with ransomware crews.

The owner of a Florida company that marketed itself as a clean alternative to paying ransomware gangs has been charged with doing exactly what he told customers he'd never do: wiring money to the criminals.

Zohar Pinhasi, 50, was arraigned this week in federal court in Brooklyn. He runs MonsterCloud, a firm that spent years pitching itself to police departments and small businesses as a team of cyber specialists who could recover files without funding crime.

Prosecutors tell a different story. According to the Justice Department, Pinhasi paid the attackers in secret, took the decryption key they handed back, and billed his clients a much larger sum while claiming the recovery came from proprietary tools.

Ransomware is malicious software that scrambles a victim's files and demands money for the key to unscramble them. A whole industry of recovery firms has grown up around it, and some of them, regulators have long suspected, are quietly paying the ransom and marking it up.

What is Pinhasi actually accused of?

Two counts of wire fraud and one count of wire fraud conspiracy. He also went by "Zack Silver" and "Zack Green," and the indictment says the lie about his methods was the whole business model.

"The defendant is charged with offering an alternative to ransom payments, but instead is alleged to have victimized the victim again," Assistant Attorney General A. Tysen Duva said in the department's statement. U.S. Attorney Joseph Nocella Jr. Said Pinhasi "re-victimized his clients while extracting a hefty profit for himself."

The department hasn't published a full victim list. Earlier reporting, including a 2019 investigation by ProPublica that first put MonsterCloud under scrutiny, documented municipal and police-department clients who were told their data had been rescued by in-house expertise.

Why does this case matter beyond one company?

It reframes who can be prosecuted in a ransomware incident. The hackers themselves usually sit in jurisdictions the FBI cannot reach. A U.S.-based recovery vendor cannot.

Federal agencies have warned for years that paying a ransom may breach sanctions when the gang on the other end is tied to Russia or North Korea. If a recovery firm pays on a client's behalf without disclosure, the client can end up on the wrong side of that rule without knowing it.

There's also the market distortion. If one firm wins contracts by promising a clean recovery it cannot deliver, honest responders who tell clients the hard truth lose work. Our coverage of how a small government agency rebuilt after a wire-transfer fraud on 20 August shows how thin the margin for error already is at that level.

Should you worry about your recovery vendor?

Ask any recovery vendor, in writing, whether they'll pay a ransom on your behalf. Get the answer before you sign. Ask them to name the ransomware family and explain the decryption method they intend to use.

Report the attack to the FBI's Internet Crime Complaint Center early. Federal investigators sometimes hold decryption keys seized from takedowns of groups like LockBit or Hive, and those keys are free.

The charges against Pinhasi are allegations. He's presumed innocent until a jury says otherwise. If the government proves its case, the message to the recovery industry is blunt: the quiet payment is the crime.