Indictment Overview
A federal grand jury in the Eastern District of New York indicted MonsterCloud founder Zohar Pinhasi on September 23, 2026, accusing him of running a multi‑year wire‑fraud scheme.
Pinhasi, who pleaded not guilty in Brooklyn federal court, was released on a $2 million bond. He faces one count of conspiracy to commit wire fraud and two counts of wire fraud, each carrying up to 20 years in prison if convicted.
How the alleged scheme operated
According to the indictment, the scheme spanned from June 2018 to June 2023. MonsterCloud, a Florida‑based ransomware remediation firm, allegedly paid ransomware gangs on behalf of its customers and then billed the victims far more than the ransom amounts.
- In one documented case the company paid roughly $8,200 to a gang and charged the victim about $150,000.
- In another instance it paid about $236,000 and billed the customer approximately $380,000.
- Prosecutors say the total ransom payments facilitated exceed $8 million, while the amount charged to customers tops $19 million.
Why it matters for security teams
Enterprises increasingly turn to third‑party “decryption” services after a ransomware incident. If a provider simply acts as a middleman for the attackers, the organization pays twice – once to the criminal gang and again to the service.
The indictment highlights the risk of relying on vendors that cannot demonstrate independent decryption capabilities. It also shows that legal exposure can extend beyond the original ransomware breach.
Defensive steps
Teams should treat any external recovery service with the same scrutiny they apply to incident‑response partners.
- Demand written proof of decryption keys before any payment.
- Verify the vendor’s technical expertise – a legitimate tool should be demonstrable in a sandbox.
- Document every communication with the provider and retain logs for potential legal review.
- Consider negotiating directly with the ransomware gang only as a last resort, and involve law‑enforcement early.
- Maintain up‑to‑date offline backups to avoid the need for third‑party decryption altogether.