U. S. authorities have charged Zohar Pinhasi, a 50-year-old dual U. S.-Israeli citizen and owner of MonsterCloud, with wire fraud and money laundering for allegedly deceiving ransomware victims by secretly paying attackers to decrypt data while claiming to use proprietary recovery tools. The Department of Justice announced the indictment on Wednesday, stating that Pinhasi’s scheme defrauded clients of over $19 million between 2019 and 2023. Prosecutors say he marketed his company as a leader in ransomware recovery, promising victims they could regain access to encrypted systems without paying ransoms, when in fact he was making those payments behind the scenes.
Pinhasi allegedly told clients that MonsterCloud used advanced, in-house technology to break encryption and restore data without engaging with cybercriminals. However, according to the indictment, he routinely contacted ransomware groups, negotiated payments, and transferred funds—often in cryptocurrency—to obtain decryption keys. He then billed clients for fake „proprietary” services, inflating charges by hundreds or even thousands of percent above the actual ransom amounts paid. In some cases, victims were charged tens of thousands of dollars for recoveries that cost MonsterCloud only a few hundred dollars in ransom payments. The DOJ says this conduct violated federal fraud statutes by misrepresenting the nature of the services provided and concealing the true cost and method of recovery.
The fraud relied on a pattern of deception that unfolded during ransomware incidents. When a client contacted MonsterCloud after an attack, Pinhasi or his team would claim immediate action using specialized tools. In reality, they would identify the ransomware variant, contact the threat actors—sometimes through intermediaries—and arrange payment. Once the decryption key was received, it was applied to restore the victim’s data, after which MonsterCloud would issue an invoice for services like „advanced forensic analysis” or „custom decryption development,” despite no such work being performed. Email records cited in the indictment show Pinhasi discussing how to conceal payments and avoid leaving a traceable link between client funds and ransom transfers. The scheme allowed MonsterCloud to profit significantly while presenting itself as a ransomware-resistant solution.
Pinhasi faces multiple counts of wire fraud and money laundering, each carrying a maximum penalty of 20 years in prison. If convicted on all charges, he could face decades behind bars. The DOJ also seeks forfeiture of proceeds traceable to the fraud, including assets purchased with illicit funds. The case highlights growing scrutiny of companies that offer ransomware recovery services, particularly those that may be facilitating payments to criminal groups under the guise of technical expertise. Legal experts note that while paying ransoms is not illegal per se, misrepresenting such payments to clients as proprietary recovery work constitutes fraud. The indictment serves as a warning to other firms in the cybersecurity recovery space about the legal risks of opaque practices and false claims regarding ransomware engagement.
Was it illegal for MonsterCloud to pay ransoms to attackers? Paying a ransom is not inherently illegal under U. S. law, but doing so without client consent and while falsely claiming to use alternative methods constitutes fraud. The charges stem from the deception, not the payment itself.
How did authorities uncover the fraudulent scheme? The investigation was based on victim complaints, financial records, and email communications that showed Pinhasi negotiating with ransomware groups and inflating service fees. Internal documents revealed the disparity between actual costs and client billings.
What should organizations look for in a legitimate ransomware recovery provider? Reputable providers should be transparent about their methods, avoid guaranteeing decryption without payment when appropriate, and clearly disclose if third-party payments are made. Clients should request detailed service agreements and verify claims through independent references.