Businesses that hired MonsterCloud were told they were buying an alternative to paying off ransomware gangs. Federal prosecutors in New York say the Florida company was doing exactly that behind their backs, and billing far more than the ransom for the service. Its owner, Zohar Pinhasi, was indicted on September 23 and arraigned on October 7 in federal court in Brooklyn on three counts, one of wire fraud conspiracy and two of wire fraud.
The indictment alleges that over five years that ended in 2023, the company billed hundreds of clients a combined total above $19 million and passed more than $8 million of it to the criminals who had locked their files. Pinhasi pleaded not guilty; a judge set his bond at $2 million. The charges are allegations, and he is presumed innocent unless prosecutors prove their case.
How the alleged scheme worked
According to prosecutors, MonsterCloud's website warned victims against paying ransoms and said its team specialized in recovering data without giving in to the attackers' demands, using what it called proprietary tools and advanced decryption methods. The indictment says no such technology existed. Instead, Pinhasi or an employee would obtain the ransom note and a handful of encrypted files from a prospective client, then quietly contact the attackers, who decrypted the samples. In many cases those samples were presented to the client as proof that MonsterCloud could do the job.
That preliminary step, billed as an analysis phase and priced between $2,500 and $10,000, led clients into full recovery contracts costing as much as double the ransom or more. The contracts stated that the company would approach the criminals only after every other option had been exhausted; prosecutors say contacting them was often the first thing that happened. In one case from August 2023, the indictment says, MonsterCloud paid a ransom of about $8,200 and charged the client roughly $150,000.
The indictment also describes a May 2019 exchange in which a paid spokesperson featured in the company's testimonials asked whether MonsterCloud actually possessed proprietary decryption software, and Pinhasi answered that it did not. The recovery industry had faced similar accusations in 2019, when the company was among those described as paying ransoms while advertising its own recovery methods; Pinhasi denied misleading clients at the time and said his techniques were a trade secret.
A business built in the gaps
Ransomware recovery occupies an awkward space. The FBI and CISA advise victims not to pay, pointing out that payment guarantees neither working decryption nor an end to the intrusion. Many victims pay anyway, and a market of negotiators, brokers and recovery firms has grown up around them. Some of it is legitimate incident response. Some of it is not: in May 2026 two people who had worked as ransomware negotiators received four year prison terms after admitting they had carried out attacks themselves and coordinated with the gangs whose demands they were supposedly negotiating down.
Prosecutors frame the MonsterCloud case as a second victimization, in which a company that had already been extorted paid again, this time to someone it trusted. James Barnacle, the assistant director in charge of the FBI's New York field office, said Pinhasi professed to cure ransomware while leaving the underlying compromise untouched. If the allegations hold, the markup was not the only harm. Clients who believed no ransom had been paid could not report a payment, screen the recipient against sanctions lists or make an informed decision about whether to deal with the attackers at all. Anyone weighing an offer of guaranteed decryption can borrow three questions from this case:
- How exactly will the data be recovered? A firm that cites secret or proprietary methods and declines to explain them should be treated with suspicion. Working decryptors exist only where a particular ransomware family has a known weakness, and a reputable responder will say which one applies.
- Will any money go to the attackers? Get the answer in writing, with an itemized invoice that separates the firm's fee from any ransom paid, so that the decision to pay stays with the victim.
- Has the recipient been screened against sanctions lists? The United States Treasury has warned that facilitating a payment to a sanctioned group can expose the payer to penalties, and that prompt reporting to law enforcement counts in a victim's favor.
Pinhasi faces up to 20 years on each count. In October the court postponed the proceedings by a month, noting that the two sides were in plea negotiations. Whatever the outcome, the figure that lingers is the one from August 2023: roughly $8,200 to the criminals, roughly $150,000 billed to the client who thought nobody had been paid at all.
