Fake Decryption Tools Masked $11M Markup in Ransomware Recovery Scheme

The owner of a US company was charged with defrauding clients through a ransomware remediation scheme. Zohar Pinhasi, 50, the owner of MonsterCloud, a US and Israeli national also known as ‘Zack Silver’ and ‘Zack Green’, appeared in a New York court to face wire fraud charges. According to the indictment, Pinhasi claimed that MonsterCloud could help organizations that fell victim to ransomware to recover their data without paying the attackers. While cautioning ransomware victims not to pay the attackers, Pinhasi allegedly falsely claimed his company could decrypt ransomware. Pinhasi allegedly claimed that MonsterCloud was using proprietary tools and advanced decryption techniques to recover encrypted data without paying the attackers. Instead, he contacted the ransomware groups that hacked his clients, paid ransoms to obtain the decryption keys, and then charged the victim organizations a fee when using the decryption key to restore the data. In one instance, he made a ransom payment of approximately $8,200 to a ransomware affiliate, and then charged the client approximately $150,000. Throughout the scheme, he allegedly paid over $8 million in ransoms and charged his clients over $19 million. Pinhasi was charged with wire fraud and wire fraud conspiracy and could be sentenced to tens of years in prison. “The defendant is charged with offering an alternative to ransom payments, but instead is alleged to have victimized the victim again and committed additional fraud, harming the victim again,” Assistant Attorney General A. Tysen Duva said. Related: Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany Related: FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware Related: Alleged ShinyHunters Leader Arrested in Jordan Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon

Zohar Pinhasi, 50, the owner of MonsterCloud, a US and Israeli national also known as ‘Zack Silver’ and ‘Zack Green’, appeared in a New York court to face wire fraud charges. According to the indictment, Pinhasi claimed that MonsterCloud could help organizations that fell victim to ransomware to recover their data without paying the attackers. While cautioning ransomware victims not to pay the attackers, Pinhasi allegedly falsely claimed his company could decrypt ransomware. Pinhasi allegedly claimed that MonsterCloud was using proprietary tools and advanced decryption techniques to recover encrypted data without paying the attackers. Instead, he contacted the ransomware groups that hacked his clients, paid ransoms to obtain the decryption keys, and then charged the victim organizations a fee when using the decryption key to restore the data. In one instance, he made a ransom payment of approximately $8,200 to a ransomware affiliate, and then charged the client approximately $150,000. Throughout the scheme, he allegedly paid over $8 million in ransoms and charged his clients over $19 million. Pinhasi was charged with wire fraud and wire fraud conspiracy and could be sentenced to tens of years in prison. “The defendant is charged with offering an alternative to ransom payments, but instead is alleged to have victimized the victim again and committed additional fraud, harming the victim again,” Assistant Attorney General A. Tysen Duva said. Related: Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany Related: FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware Related: Alleged ShinyHunters Leader Arrested in Jordan Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon

According to the indictment, Pinhasi claimed that MonsterCloud could help organizations that fell victim to ransomware to recover their data without paying the attackers. While cautioning ransomware victims not to pay the attackers, Pinhasi allegedly falsely claimed his company could decrypt ransomware. Pinhasi allegedly claimed that MonsterCloud was using proprietary tools and advanced decryption techniques to recover encrypted data without paying the attackers. Instead, he contacted the ransomware groups that hacked his clients, paid ransoms to obtain the decryption keys, and then charged the victim organizations a fee when using the decryption key to restore the data. In one instance, he made a ransom payment of approximately $8,200 to a ransomware affiliate, and then charged the client approximately $150,000. Throughout the scheme, he allegedly paid over $8 million in ransoms and charged his clients over $19 million. Pinhasi was charged with wire fraud and wire fraud conspiracy and could be sentenced to tens of years in prison. “The defendant is charged with offering an alternative to ransom payments, but instead is alleged to have victimized the victim again and committed additional fraud, harming the victim again,” Assistant Attorney General A. Tysen Duva said. Related: Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany Related: FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware Related: Alleged ShinyHunters Leader Arrested in Jordan Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon

While cautioning ransomware victims not to pay the attackers, Pinhasi allegedly falsely claimed his company could decrypt ransomware. Pinhasi allegedly claimed that MonsterCloud was using proprietary tools and advanced decryption techniques to recover encrypted data without paying the attackers. Instead, he contacted the ransomware groups that hacked his clients, paid ransoms to obtain the decryption keys, and then charged the victim organizations a fee when using the decryption key to restore the data. In one instance, he made a ransom payment of approximately $8,200 to a ransomware affiliate, and then charged the client approximately $150,000. Throughout the scheme, he allegedly paid over $8 million in ransoms and charged his clients over $19 million. Pinhasi was charged with wire fraud and wire fraud conspiracy and could be sentenced to tens of years in prison. “The defendant is charged with offering an alternative to ransom payments, but instead is alleged to have victimized the victim again and committed additional fraud, harming the victim again,” Assistant Attorney General A. Tysen Duva said. Related: Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany Related: FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware Related: Alleged ShinyHunters Leader Arrested in Jordan Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon

Pinhasi allegedly claimed that MonsterCloud was using proprietary tools and advanced decryption techniques to recover encrypted data without paying the attackers. Instead, he contacted the ransomware groups that hacked his clients, paid ransoms to obtain the decryption keys, and then charged the victim organizations a fee when using the decryption key to restore the data. In one instance, he made a ransom payment of approximately $8,200 to a ransomware affiliate, and then charged the client approximately $150,000. Throughout the scheme, he allegedly paid over $8 million in ransoms and charged his clients over $19 million. Pinhasi was charged with wire fraud and wire fraud conspiracy and could be sentenced to tens of years in prison. “The defendant is charged with offering an alternative to ransom payments, but instead is alleged to have victimized the victim again and committed additional fraud, harming the victim again,” Assistant Attorney General A. Tysen Duva said. Related: Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany Related: FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware Related: Alleged ShinyHunters Leader Arrested in Jordan Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon

Instead, he contacted the ransomware groups that hacked his clients, paid ransoms to obtain the decryption keys, and then charged the victim organizations a fee when using the decryption key to restore the data. In one instance, he made a ransom payment of approximately $8,200 to a ransomware affiliate, and then charged the client approximately $150,000. Throughout the scheme, he allegedly paid over $8 million in ransoms and charged his clients over $19 million. Pinhasi was charged with wire fraud and wire fraud conspiracy and could be sentenced to tens of years in prison. “The defendant is charged with offering an alternative to ransom payments, but instead is alleged to have victimized the victim again and committed additional fraud, harming the victim again,” Assistant Attorney General A. Tysen Duva said. Related: Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany Related: FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware Related: Alleged ShinyHunters Leader Arrested in Jordan Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon

In one instance, he made a ransom payment of approximately $8,200 to a ransomware affiliate, and then charged the client approximately $150,000. Throughout the scheme, he allegedly paid over $8 million in ransoms and charged his clients over $19 million. Pinhasi was charged with wire fraud and wire fraud conspiracy and could be sentenced to tens of years in prison. “The defendant is charged with offering an alternative to ransom payments, but instead is alleged to have victimized the victim again and committed additional fraud, harming the victim again,” Assistant Attorney General A. Tysen Duva said. Related: Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany Related: FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware Related: Alleged ShinyHunters Leader Arrested in Jordan Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon

Throughout the scheme, he allegedly paid over $8 million in ransoms and charged his clients over $19 million. Pinhasi was charged with wire fraud and wire fraud conspiracy and could be sentenced to tens of years in prison. “The defendant is charged with offering an alternative to ransom payments, but instead is alleged to have victimized the victim again and committed additional fraud, harming the victim again,” Assistant Attorney General A. Tysen Duva said. Related: Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany Related: FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware Related: Alleged ShinyHunters Leader Arrested in Jordan Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon

Pinhasi was charged with wire fraud and wire fraud conspiracy and could be sentenced to tens of years in prison. “The defendant is charged with offering an alternative to ransom payments, but instead is alleged to have victimized the victim again and committed additional fraud, harming the victim again,” Assistant Attorney General A. Tysen Duva said. Related: Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany Related: FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware Related: Alleged ShinyHunters Leader Arrested in Jordan Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon

“The defendant is charged with offering an alternative to ransom payments, but instead is alleged to have victimized the victim again and committed additional fraud, harming the victim again,” Assistant Attorney General A. Tysen Duva said. Related: Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany Related: FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware Related: Alleged ShinyHunters Leader Arrested in Jordan Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon

Related: Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany Related: FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware Related: Alleged ShinyHunters Leader Arrested in Jordan Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon

Related: FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware Related: Alleged ShinyHunters Leader Arrested in Jordan Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon

Related: Alleged ShinyHunters Leader Arrested in Jordan Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon

Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon

Ionut Arghire is an international correspondent for SecurityWeek.

More from Ionut Arghire

ASOS Confirms Cyberattack, Data Breach

Android’s October 2026 Updates Patch 25 Vulnerabilities

Atlassian Patches Critical Vulnerability Affecting 8 Products

FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware

Apple to Tighten Full Disk Access Controls in macOS Amid AI Risks

Long-Running NPM Malware Campaign Accumulates 40,000 Downloads

8.8 Million Impacted by Data Breach at Denmark’s Central Person Register

Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws

Oracle Health Data Breach Tally Climbs to Nearly 20 Million

FortiBleed Attackers Locking Victims Out of Fortinet Devices

Georgia Power, Alabama Power Data Breach Hits 400,000 Accounts

Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany

Hadrian Raises $40 Million to Expand Autonomous Offensive Security Platform

Advantest Discloses Data Breach Months After Ransomware Attack

Chrome 155 Update Patches 247 Vulnerabilities

Anthropic Introduces 3-Tier Cyber Verification Program for AI Access

Webinar: Securing AI Agents, MCPs, and AI Automations

Learn how to address potential risks and not restrict AI adoption in your organization. See what a centralized AI gateway is and how it works in practice.

Virtual Event: Zero Trust & Identity Strategies Summit 2026

Join as we decipher the world of zero trust and war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction.

Flipboard Whatsapp Whatsapp Email