Ransomware 'Rescuer' Allegedly Just Paid the Criminals and Pocketed a $11M Markup

A Florida man has appeared in a New York federal court on wire fraud charges after allegedly running a protection racket dressed up as ransomware recovery. Zohar Pinhasi, 50, operated a company called MonsterCloud while also apparently going by the names 'Zack Silver' and 'Zack Green', which should perhaps have been a hint.

The pitch was straightforward: don't pay the hackers, pay us instead. MonsterCloud claimed to use proprietary decryption tools and advanced techniques to recover data without any ransom changing hands. According to federal prosecutors, this was complete fiction.

What Pinhasi allegedly actually did was contact the ransomware groups directly, negotiate with them, pay the ransom, obtain the decryption keys, and then bill clients at a substantial premium. The definition of a middleman, except clients were told there was no middleman.

The numbers are stark. In one documented case, Pinhasi reportedly paid around $8,200 to a ransomware affiliate and then invoiced the client for roughly $150,000. Across the entire operation, prosecutors allege he paid out over $8 million in ransoms while billing his clients more than $19 million. That is a tidy margin for someone telling victims not to negotiate with criminals.

Assistant Attorney General A. Tysen Duva put it bluntly: the defendant allegedly victimised the victim a second time by committing additional fraud on top of the original attack.

Pinhasi faces charges of wire fraud and wire fraud conspiracy. Combined, those carry the potential for decades in prison.

There is a grim irony here. Ransomware recovery firms have long occupied murky territory, with some legitimate operators quietly paying ransoms while maintaining a public position against doing so. The FBI has warned about exactly this dynamic. MonsterCloud, it seems, may have taken the practice to a brazen extreme, charging markups that would make a defence contractor blush.