Promised ransomware recovery without paying attackers: the case against Zohar Pinhasi and MonsterCloud
The Israeli and American owner of a cybersecurity company is accused of hiding ransom payments while charging clients over $19 million. The indictment, contractual caveat and not guilty plea.
A business is paralysed, its files are locked and the attacker demands money. Then a specialist offers another route: recover the data without paying the criminals. For the client, this is a double promise, restoring operations while avoiding funding the attacker. The indictment against Zohar Pinhasi alleges that this promise formed part of a fraud scheme.
Pinhasi, an Israeli and American citizen living in Florida, owns and runs MonsterCloud. Federal prosecutors say the company advertised proprietary decryption technology but actually bought decryption keys from attackers without telling many clients. In one example in the document, a payment of approximately $8,200 to a criminal was accompanied by a charge of approximately $150,000 to the client.
The indictment was filed on 23 September 2026 in the US District Court for the Eastern District of New York, case 26-CR-271. The arraignment and prosecution announcement followed on 7 October. BleepingComputer, citing the US Attorney's Office, reported that Pinhasi pleaded not guilty and was released on a $2 million bond. These are charges, not a conviction.
Sources: Indictment (PDF) · US Attorney, EDNY · BleepingComputer
The promise to the client and the alleged reality
According to the indictment, MonsterCloud's website advertised advanced tools and techniques for data recovery and warned against paying ransoms. Prosecutors say some clients chose the company specifically because they did not want to pay criminals and would not have authorised such a payment.
The prosecution alleges that Pinhasi and his associates had no proprietary decryption technology. Instead, they contacted attackers, paid for keys and used those keys to unlock files. At the centre of the case is the gap between what clients were told, the service provided and the information allegedly withheld.
Sources: Indictment (PDF) · US Attorney, EDNY
An unlocked file became proof of capability
The document describes a two-stage service. Clients were typically first charged approximately $2,500 to $10,000 for analysis and samples of recovered files. A more expensive full recovery service followed. Prosecutors allege that in many cases the decrypted samples came from the criminals themselves and were shown to clients without their origin being disclosed.
The journalistic significance of this allegation is that a working file does not, by itself, establish who decrypted it or how. According to the indictment, the demonstration helped persuade clients to buy the more expensive stage. Clients' computers, files and original communications were not examined for this article.
Sources: Indictment (PDF)
The contractual caveat is part of the story
The indictment itself acknowledges that some contracts allowed for communication with cybercriminals and even payments to them. It would therefore be inaccurate to say that every company contract excluded that possibility. Prosecutors say those contracts presented contact with attackers as a step to be taken only after direct decryption options had been exhausted.
The allegation is that dealing with attackers was generally the first step. This distinction matters: the case concerns what was promised, what clients were told, when consent was given and what actually happened, as well as whether money changed hands. Those questions are for the court to decide.
Sources: Indictment (PDF)
Over $19 million collected, more than $8 million paid in ransom
According to the indictment and US Justice Department statements, hundreds of companies in the United States and Canada collectively paid over $19 million for the company's services. More than $8 million was allegedly paid to ransomware criminals. These are prosecution figures that have not been proved at trial.
Alongside the $8,200 payment and $150,000 client charge, the document describes a payment of approximately $236,000 to an attacker and a client charge of approximately $380,000. The difference between revenue and ransom payments does not establish net profit or a finding that every dollar collected constitutes recoverable loss. This article does not calculate a proved theft amount or profit.
Sources: Indictment (PDF) · US Attorney, EDNY · US Department of Justice
Three counts and forfeiture contingent on conviction
The indictment contains one count of conspiracy to commit wire fraud and two counts of wire fraud. The Justice Department statement gives a statutory maximum of 20 years' imprisonment on each count if Pinhasi is convicted. This is a legal ceiling, not a sentencing prediction or an imposed sentence.
The indictment also gives notice that prosecutors intend to seek forfeiture upon conviction. This does not establish that funds have already been forfeited or returned to clients. The American proceedings and the defendant's Israeli citizenship do not make this an indictment filed in Israel.
Sources: Indictment (PDF) · US Department of Justice
The not guilty plea and what remains unknown
On 7 October, BleepingComputer reported that the US Attorney's Office confirmed Pinhasi appeared, pleaded not guilty and was released on a $2 million bond. The publication said it contacted his lawyers, Christopher Clark and Rodney Villazor; the version reviewed contained no response from them. No direct response from the defendant, company or defence lawyers was obtained for this article, and this website did not contact them.
As of 16 October 2026, the public search had not located a verdict in this case. The full court docket was not reviewed, so this does not confirm that there have been no subsequent developments or that release conditions remain unchanged. The indictment states the prosecution's case; Pinhasi is presumed innocent.
Sources: BleepingComputer
This article and its translations were prepared with AI assistance. The full ten-page indictment, accompanied by an information sheet, was visually examined, and prosecution statements and BleepingComputer reporting were read. Investigation materials and the full court docket were not reviewed, and no direct responses were obtained.