Zohar Pinhasi, 50, a dual U.S.-Israeli national based in Florida, served in Israeli military security intelligence before founding MonsterCloud, a ransomware remediation company that marketed itself as an alternative to paying ransom demands, claiming to use "proprietary tools" and "advanced decryption techniques" -- and, per one site quote cited in the indictment, calling itself "the most sophisticated Counter Cyber Terrorism team in the world." At its peak, the company reportedly had around 70 employees and 7,000 clients worldwide, and Pinhasi was widely quoted in media as a ransomware expert, including in a 2021 interview about the Black Shadow hacking group.
Federal prosecutors allege Pinhasi's company had no special decryption technology at all. Instead, he is accused of secretly contacting the ransomware attackers himself, paying them for the decryption keys, and then charging clients far more than he had paid -- in one example cited in the indictment, paying a cybercriminal about $8,200 in August 2023 while billing the client roughly $150,000. In a May 2019 exchange cited in the indictment, a paid company spokesperson asked Pinhasi whether MonsterCloud had proprietary decryption software, and he allegedly replied, "MonsterCloud doesn't hold any Proprietary technology [to] decrypt the ransomware data." Prosecutors allege that, since 2023, he collected more than $19 million in fees from clients while secretly paying out more than $8 million to the cybercriminals he was supposedly helping victims avoid.
Pinhasi was charged on October 7, 2026, in the Eastern District of New York with two counts of wire fraud and one count of wire fraud conspiracy, each carrying a maximum sentence of 20 years in prison. He was arraigned the same day, pleaded not guilty, and was released on $2 million bail. The indictment also names unidentified co-conspirators, including MonsterCloud employees and contractors, raising the possibility of further charges. As with any indictment, the allegations are presumed unproven and Pinhasi is presumed innocent unless and until convicted.
"The defendant is charged with offering an alternative to ransom payments [and] falsely claiming to decrypt ransomware without paying off the ransomers."
-- A. Tysen Duva, Assistant Attorney General, DOJ Criminal Division, and Joseph Nocella, Jr., U.S. Attorney, Eastern District of New York
