Ransomware recovery firm owner charged with secretly paying hackers and overbilling clients
The Justice Department says Zohar Pinhasi of MonsterCloud falsely claimed he could decrypt ransomware without paying cybercriminals. Prosecutors allege he secretly paid the attackers and charged clients far more than the ransom.
The US Department of Justice announced on October 7, 2026 that Zohar Pinhasi, 50, was arraigned in the Eastern District of New York. He is charged with two counts of wire fraud and one count of wire fraud conspiracy in connection with his company, MonsterCloud. Each count carries a maximum penalty of 20 years in prison. An indictment is only an allegation, and Pinhasi is presumed innocent unless proven guilty.
According to the DOJ, Pinhasi made false claims that MonsterCloud could decrypt files locked by ransomware (malicious software that encrypts a victim's data until a ransom is paid) without paying the cybercriminals. Prosecutors allege that he instead contacted and paid the cybercriminals for decryption keys, and that the ransom payments were kept secret from clients.
The DOJ gives one example: in or around August 2023, Pinhasi allegedly made a ransom payment of approximately $8,200 and charged the client approximately $150,000. Over the course of the scheme, he allegedly charged clients more than $19 million and paid more than $8 million in ransom payments.
The FBI is investigating the case. It is being prosecuted by the DOJ Criminal Division's Computer Crime and Intellectual Property Section and the US Attorney's Office for the Eastern District of New York.
Why it matters to AML professionals
Ransom payments can pass through third parties such as recovery or incident-response firms, which can hide who is really paying cybercriminals. AML professionals should understand the role each party plays in a ransomware payment and whether a client's stated service matches the flow of funds. Payments from a service provider to unknown recipients shortly after a client pays that provider deserve a closer look.
Red flags in this case
- A cyber recovery firm receives a large client payment and soon after sends a smaller payment to an unknown or unrelated party
- A service provider claims it does not pay ransoms, but its account activity shows outgoing payments consistent with ransom amounts
- Large gaps between the fee a client pays and the cost the provider incurs, with no clear explanation of the service
- A business pays a third party to resolve a ransomware incident without receiving clear documentation of how files were recovered
Sources
Go deeper on AMLift
Every fact in AMLift News Desk stories comes from an official source: a regulator, court, government gazette or the company's own filing.
Report an error
Every report is checked against the official source. If we got something wrong, the story is corrected.