{"id":3435,"date":"2026-10-08T09:25:00","date_gmt":"2026-10-08T09:25:00","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3435"},"modified":"2026-10-08T09:25:00","modified_gmt":"2026-10-08T09:25:00","slug":"monstercloud-owner-accused-of-billing-over-19m-while-secretly-paying-ransoms-to-decrypt-data","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3435","title":{"rendered":"MonsterCloud Owner Accused of Billing Over $19M While Secretly Paying Ransoms to Decrypt Data"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Oct 08, 2026<\/span><\/span>Cybercrime \/ Ransomware<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The U.S. Department of Justice (DoJ) on Wednesday announced charges against a 50-year-old U.S. and Israeli national for allegedly defrauding ransomware victims by secretly paying the attackers to obtain decryptors while claiming to use proprietary tools to recover their data.<\/p>\n

Zohar Pinhasi (aka Zack Silver and Zack Green) has been charged with two counts of wire fraud and one count of wire fraud conspiracy. If convicted, the defendant faces up to 20 years in prison for each count.<\/p>\n

\u00abBy falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself,\u00bb said<\/a> U.S. Attorney Joseph Nocella, Jr. for the Eastern District of New York.<\/p>\n

Pinhasi, who owned and operated a Florida company called MonsterCloud, is alleged to have made false representations to ransomware victims, urging them not to pay a ransom and claiming to have \u00abproprietary tools\u00bb and \u00abadvanced decryption techniques\u00bb in possession that could be used to recover encrypted data without yielding to ransom demands.<\/p>\n

On its website, MonsterCloud claims<\/a> it uses \u00abadvanced decryption techniques and cutting-edge technology\u00bb to restore data. Under a section called \u00abShould I Pay The Ransom?,\u00bb it states, \u00abPaying a ransom to cybercriminals does not guarantee a positive outcome. In fact, it only serves to encourage and reward their illegal behavior.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

In a Q&A published<\/a> on its site, MonsterCloud also addressed the question \u00abDo you pay ransoms on behalf of your clients to recover data?,\u00bb stating, \u00abWhile we strongly advocate not paying ransoms yourselves, we have extensive experience working with ransomware perpetrators and sometimes resort to other means to resolve the ransomware incident for our clients. All terms are disclosed in our service contract.\u00bb<\/p>\n

Contrary to its claims, there were no specialized tools to decrypt the data. Instead, Pinhasi approached the cybercriminals and paid them in exchange for obtaining a decryptor to recover the information.<\/p>\n

Pinhasi is said to have charged MonsterCloud’s clients a fee that was \u00absubstantially higher\u00bb than the ransom that was secretly paid to the criminals. In one case in August 2023, the defendant made a ransom payment of approximately $8,200 to a threat actor and billed the client approximately $150,000.<\/p>\n

In another incident in or around October 2021, Pinhasi made a ransom payment of approximately $236,000 and charged the customer about $380,000. In all, Pinhasi is accused of charging clients more than $19 million and paying more than $8 million in ransom payments. <\/p>\n

\u00abAs alleged, Zohar Pinhasi claimed to fix ransomware while never remediating the underlying threat,\u00bb said Assistant Director James C. Barnacle Jr. of the U.S. Federal Bureau of Investigation (FBI). \u00abInstead, he turned the victim’s crisis into his own profit center. This deception is unacceptable.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Oct 08, 2026Cybercrime \/ Ransomware The U.S. Department of Justice (DoJ) on Wednesday announced charges against a 50-year-old U.S. and Israeli national for allegedly defrauding ransomware victims by secretly…<\/p>\n","protected":false},"author":1,"featured_media":3436,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[3705,2035,3601,38,3709,3703,3704,3707,3708,3706],"class_list":["post-3435","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-19m","tag-accused","tag-billing","tag-data","tag-decrypt","tag-monstercloud","tag-owner","tag-paying","tag-ransoms","tag-secretly"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3435","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3435"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3435\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3436"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3435"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3435"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3435"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}