MonsterCloud’s website carries a clear message: “Don’t Pay the Ransom.” Federal prosecutors allege the company’s owner was doing exactly that, secretly, while billing clients as if he wasn’t.
Zohar Pinhasi, also known as “Zack Silver” and “Zack Green,” faces two counts of wire fraud and one count of wire-fraud conspiracy filed by the U.S. Attorney’s Office for the Eastern District of New York. He is presumed innocent of all charges.
The Alleged Scheme
Prosecutors allege that MonsterCloud’s “no-ransom” marketing concealed a pattern of secret payments to attackers and inflated billing to clients.
MonsterCloud positioned itself as a principled alternative to negotiating with cybercriminals, marketing proprietary decryption capabilities that it claimed could restore files without any ransom payment.
Prosecutors allege Pinhasi possessed no such capability. According to the indictment, he contacted ransomware attackers directly, paid their demands, obtained decryption keys, and used those keys to attempt to restore clients’ files.
Clients were billed substantially more than the ransom amounts actually paid to criminals. In one example cited in the indictment, prosecutors allege Pinhasi paid approximately $8,200 to an attacker in August 2023 while charging the affected client approximately $150,000.
According to the Justice Department, MonsterCloud allegedly charged clients more than $19 million while paying more than $8 million in ransom payments across the alleged scheme. That gap between fees billed and ransom paid is the financial centerpiece of the federal prosecution.
Each wire-fraud count carries a potential maximum sentence of 20 years upon conviction.
Why This Case Matters
The allegations highlight a specific vulnerability for ransomware victims: urgent circumstances can make fraudulent technical claims difficult to detect until significant damage is done.
When systems go offline and revenue stops, the pressure to trust whoever promises the fastest fix is considerable. That operational stress is the environment the indictment describes being exploited.
Clients were allegedly told they were receiving technical expertise when prosecutors say they were funding ransom payments at a steep markup. The distinction between genuine decryption capability and undisclosed ransom negotiation is exactly what organizations need to verify before signing with any recovery provider.
A provider’s claim to restore files without paying attackers should be backed by a concrete explanation of the actual recovery method. That means verified backups, a known public decryptor, or a documented vulnerability in the specific ransomware strain, not a marketing assertion alone.
Before signing any engagement, ask the recovery firm to separate its technical-response fees from any negotiation or payment component. Get that separation confirmed in writing.
The indictment also signals something broader for the industry. Misleading statements about cybersecurity capabilities and billing practices can carry criminal exposure, not just civil liability.
Marketing language is not insulated from fraud statutes when it allegedly contradicts what a company is actually doing. The ransomware-remediation market operates under conditions where technical claims are genuinely difficult for non-experts to verify quickly, which makes provider transparency more critical, not less.
The MonsterCloud case could prompt cybersecurity buyers to require contractual disclosure of any ransom negotiation, itemized billing, and documented proof of claimed recovery methods. Requiring those disclosures in writing before any engagement is a concrete step organizations can take now to stay safe.
