Zohar Pinhasi, owner of Florida-based MonsterCloud LLC, was arraigned Oct. 7, 2026, in federal court in Brooklyn on wire-fraud charges tied to the company.
Prosecutors allege he exploited ransomware victims by selling decryption help while secretly paying attackers. Ransomware is software that locks business files until a ransom is paid. A remediation firm is hired to restore access, often because the victim wants to avoid funding criminals.
Table of Contents
- What did MonsterCloud promise clients?
- Where did the client money allegedly go?
- Who trusted the company?
- What happened at the Brooklyn hearing?
- What should businesses demand first?
What did MonsterCloud promise clients?
Pinhasi, 50, is a U.S.-Israeli national from Hollywood, Florida, also known as Zack Silver and Zack Green. He owns MonsterCloud, a company presented as a ransomware-remediation specialist.
According to The Hacker News in its account of the allegations, the firm claimed proprietary tools could decrypt files without paying attackers. Prosecutors allege those claims were false. They say Pinhasi secretly negotiated with ransomware operators and paid them to obtain decryption keys.
Where did the client money allegedly go?
Between June 2018 and June 2023, MonsterCloud allegedly billed clients over $19 million. During the same period it secretly paid over $8 million in ransoms, as detailed by Cybernews in its billing breakdown.
Prosecutors point to one August 2023 case as an example. The firm allegedly paid attackers about $8,200 yet charged the client about $150,000. The difference shows why billed technique matters more than restored access.
Who trusted the company?
Those affected were hundreds of ransomware-hit businesses in the United States and Canada. They hired MonsterCloud specifically to avoid funding criminals and to restore locked files.
For those buyers, the promise shaped the purchase. They thought they paid for lawful technical work. They allegedly paid for ransom payments marked up as expert service.
What happened at the Brooklyn hearing?
A federal grand jury in the Eastern District of New York indicted Pinhasi on Sept. 23, 2026. The indictment charges two counts of wire fraud and one count of conspiracy to commit wire fraud. He was arraigned Oct.
7 in Brooklyn federal court. Pinhasi surrendered, pleaded not guilty, and was released on a $2 million bond, according to Gizmodo in its court report. Each wire-fraud count carries up to 20 years in prison. The charges remain allegations, and he is presumed innocent unless proven guilty.
What should businesses demand first?
Businesses facing encryption should get payment terms in writing before hiring help. The U.S.
Department of Justice notes in the Eastern District announcement that clients should demand written proof of methods and any attacker payments. Keep that paperwork with the invoice and incident record. Get it in writing before you pay.
- written explanation of how files will be recovered without paying attackers
- written disclosure of whether any money will go to attackers, with amounts and receipts
You Might Also Like
- Double Extortion Ransomware Guide 2026: What Happened, Who Is Affected, and Next Steps
- Royal Ransomware Update 2026: Disclosure, Response, and Open Questions
- Ransomware Negotiation Response Checklist: Passwords, Accounts, and Credit