Florida 'Ransomware Recovery' Boss Charged With Quietly Paying Hackers While Billing Victims $19M for Fake Expertise
The Department of Justice has charged a Florida cybersecurity company owner with fraud after he allegedly spent years telling ransomware victims he could decrypt their files using proprietary technology, while actually just paying the attackers and pocketing a substantial markup.
Zohar Pinhasi, 50, a dual U.S.-Israeli national, ran a company called MonsterCloud. He faces two counts of wire fraud and one count of conspiracy to commit wire fraud. Each count carries a potential 20-year sentence.
The pitch was simple and, frankly, appealing to anyone who's just had their systems locked up by criminals: don't pay the ransom, we have advanced tools, we'll sort it. MonsterCloud's website confidently declared that paying ransoms only encourages criminal behaviour, and assured visitors the company used cutting-edge decryption techniques to recover data without capitulating to attackers.
None of that was true. According to prosecutors, there were no proprietary tools. Pinhasi simply contacted the ransomware operators, negotiated a payment, obtained a decryptor, and handed it to the client, all while billing them significantly more than the ransom itself cost.
The margins were extraordinary. In one case from August 2023, Pinhasi allegedly paid attackers around $8,200 to obtain a decryptor, then invoiced the victim roughly $150,000. A separate incident in October 2021 saw him pay approximately $236,000 in ransom and charge the client around $380,000. Across all cases, prosecutors allege he collected over $19 million from clients while paying out just over $8 million to the actual criminals.
To be fair, MonsterCloud's FAQ did include a line acknowledging the company sometimes uses 'other means' to resolve incidents. That single vague sentence is apparently the legal fig leaf the whole operation was built around. Clients presumably didn't interpret 'other means' as 'we pay the ransom and tell you we didn't.'
FBI Assistant Director James Barnacle put it plainly: Pinhasi turned victims' crises into his own profit centre without actually fixing anything. The underlying vulnerabilities, the attackers' access, none of it was addressed. Victims paid a premium for the illusion of sophisticated cyber recovery and got a ransom payment with a 1,700% markup.
MonsterCloud's website remains online at time of writing, still advertising its decryption expertise.