ZOHAR Pinhasi, the head of MonsterCloud, appeared in a New York court facing wire fraud charges related to a ransomware remediation scheme.
The indictment alleges that Pinhasi claimed MonsterCloud could decrypt ransomware and recover encrypted data without paying attackers, using “proprietary tools and advanced decryption techniques.” In reality, he contacted the ransomware groups that had hacked his clients, paid ransoms to obtain decryption keys, and then charged victims a fee to use those keys for data restoration.
The scheme’s financials are laid out in the charging papers: in one case, Pinhasi paid about $8,200 to a ransomware affiliate but billed the client roughly $150,000; overall, he allegedly paid more than $8 million in ransoms and charged clients more than $19 million. If convicted, he faces wire fraud and wire fraud conspiracy charges and could receive a lengthy prison sentence.
Prosecutors emphasised that while he purported to offer an alternative to ransom payments, the conduct victimised clients a second time and compounded harm.
The case underscores the risk of firms purporting to provide ransomware recovery without paying attackers, and the need for due diligence when engaging third parties for incident response. The article does not indicate any confirmed decryption success or verifiable independent recovery results achieved by MonsterCloud in this involvement. The proceedings are ongoing.