Ransomware Recovery CEO Indicted for Allegedly Faking Decryption Tech to Mark Up Ransom Payments

Zohar Pinhasi, owner of Florida-based MonsterCloud, was indicted by a federal grand jury on conspiracy and wire fraud charges for a scheme allegedly running from 2018 to 2023. Prosecutors allege the company advertised proprietary decryption technology but instead secretly paid ransomware operators for keys, taking a massive margin while hiding the payments from clients. The indictment claims MonsterCloud facilitated more than $8M in actual ransom payments while charging victims in the US and Canada over $19M for "remediation services." In one specific incident detailed by prosecutors, MonsterCloud allegedly paid a ransomware gang $8,200 and subsequently billed the victim approximately $150,000. A 2019 investigation by ProPublica previously highlighted these practices after security researchers created fake ransomware and caught recovery firms offering to pay them. "As alleged in the indictment, by falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself." — Joseph Nocella Jr.