Owner of Florida Ransomware Remediation Company Charged with Defrauding Clients

 

Defendant Claimed to Use Proprietary Techniques to Decrypt Ransomware; Instead, His Company Paid Cybercriminals and Defrauded Victims

Zohar Pinhasi, also known as “Zack Silver” and “Zack Green,” was arraigned on wire fraud charges for allegedly defrauding clients of his ransomware remediation company, MonsterCloud LLC (MonsterCloud).  Pinhasi, a national of the United States and Israel, was indicted by a grand jury in the Eastern District of New York on September 23, 2026.  The proceeding was held in federal court in Brooklyn before United States Magistrate Judge Peggy Cross‑Goldenberg.

Joseph Nocella, Jr., United States Attorney for the Eastern District of New York; A. Tysen Duva, Assistant Attorney General, head of the Justice Department’s Criminal Division; and James C. Barnacle, Jr., Assistant Director in Charge, Federal Bureau of Investigation, New York Field Office (FBI), announced the charges.

“As alleged in the indictment, by falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself,” stated United States Attorney Nocella.  “Our Office will vigorously prosecute ransomware attackers who prey on Americans from across the world and those who cynically profit from their criminal activity.”

Mr. Nocella thanked the Justice Department’s Office of International Affairs for its assistance.

“The defendant is charged with offering an alternative to ransom payments, but instead is alleged to have victimized the victim again, committed additional fraud, and offered nothing useful,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division.  “This prosecution underscores the Department’s commitment to protecting ransomware victims, regardless of how these cyber ransoms occur.”

"As alleged, Zohar Pinhasi claimed to fix ransomware while never remediating the underlying threat.  Instead, he turned the victim's crisis into his own profit center.  This deception is unacceptable, and the FBI is committed to ensuring accountability for those who choose to victimize the very people who trusted them for help," stated FBI Assistant Director in Charge Barnacle. 

The charges relate to Pinhasi’s claimed ability to decrypt ransomware without paying cybercriminals, purportedly using “proprietary tools” and “advanced decryption techniques” on behalf of distressed business owners who came to his company, MonsterCloud, for help after being victimized by cybercriminals.  In fact, Pinhasi allegedly used a portion of his clients’ fees to pay off the ransomware attackers, and then kept the rest, often extracting a substantial markup.

As alleged in the indictment, Pinhasi claimed to prospective clients that MonsterCloud offered a principled alternative to paying off ransomware attackers.  MonsterCloud’s website cautioned clients not to pay the ransom, and proclaimed that “our team specializes in helping businesses recover their data without succumbing to ransom demands.”  MonsterCloud supposedly did this using “advanced decryption techniques and cutting-edge technology.”

Instead, as alleged, Pinhasi had no special technology to decrypt data.  Rather, Pinhasi contacted and paid the cybercriminals who had victimized MonsterCloud’s client, in exchange for a decryption key that MonsterCloud employees then used in an attempt to decrypt the client’s files.  Pinhasi typically charged MonsterCloud’s clients a fee that was substantially higher than the ransom that MonsterCloud secretly paid. For example, in August 2023, Pinhasi made a ransom payment of approximately $8,200 to a cybercriminal and charged the client approximately $150,000. 

MonsterCloud’s website included “testimonials,” including some from paid spokespersons.  As alleged, in May 2019, one such spokesperson contacted Pinhasi to ask whether MonsterCloud truly had any proprietary software to decrypt encrypted data. Pinhasi responded:  “Monstercloud doesn’t hold any Proprietary technology [to] decrypt the ransomware data.”   

Over the course of the scheme, Pinhasi allegedly charged clients more than $19 million, and paid more than $8 million in ransom payments. 

The charges in the indictment are allegations, and the defendant is presumed innocent unless and until proven guilty.  If convicted, the defendant faces a maximum sentence of up to 20 years in prison.