U.S. prosecutors have charged a Florida man with fraud after he allegedly told ransomware victims he could decrypt their files with proprietary tools, then simply paid the attackers and pocketed the difference.
The Justice Department says Zohar Pinhasi, who also used the names Zack Silver and Zack Green, ran a company called MonsterCloud that advised clients not to pay ransoms because it had another way to recover locked data. In reality, according to the indictment, Pinhasi used part of each client’s fee to settle with the ransomware crew and kept the remainder, frequently at a steep markup.
One example stands out. Prosecutors say he charged a client $150,000 for a recovery, paid the attackers $8,200, and never disclosed that a ransom had changed hands.
Over time the scheme is alleged to have brought in more than $19 million in client fees, with more than $8 million of that flowing out as ransom payments. The charges surfaced after a paid spokesperson for the company asked Pinhasi directly whether any proprietary decryption software existed.
The case lands as the ransomware recovery industry draws heavier scrutiny. Victims weighing a negotiation firm’s promises should demand evidence that claimed decryption tooling actually exists, and should insist on transparency about whether a payment was ever made on their behalf.
