MonsterCloud Allegedly Paid the Ransoms Police Hired It to Refuse

Police departments and sheriff’s offices that would not give taxpayer money to criminals hired MonsterCloud, a Florida ransomware recovery firm, because it promised to get their files back without paying the hackers. A federal indictment says its CEO, Zohar Pinhasi, paid the hackers anyway. He billed clients more than $19 million, paid more than $8 million of it to ransomware gangs, and kept roughly $11 million.

In one case, prosecutors say, he paid about $8,200 and charged the client about $150,000. The alleged scheme ran from June 2018 to June 2023. The Justice Department describes the victims as hundreds of companies in the United States and Canada.

Pinhasi, 50, of Hollywood, Florida, faces two counts of wire fraud and one of wire fraud conspiracy. Each count carries up to 20 years. He pleaded not guilty in Brooklyn federal court on October 7 and was released on a $2 million bond.

Ransomware locks a victim’s files, and the attackers sell back the key. MonsterCloud’s pitch was that clients could skip that purchase. According to the Justice Department, Pinhasi told clients he had “proprietary tools” and “advanced decryption techniques.” Prosecutors say he actually contacted the attackers in secret, bought the decryption key and sent the client an invoice for it with a markup added. He did business under the aliases “Zack Silver” and “Zack Green.”

The billing came in stages. Clients first paid an “exploratory” fee of $2,500 to $10,000, then a recovery fee that could run to more than twice the ransom. In a second example in the indictment, Pinhasi allegedly paid about $236,000 and billed about $380,000. Across the whole alleged scheme, the invoices came to about 2.4 times the ransoms.

The $8,200 case is the extreme one. The Stack works it out as an 18-fold markup. A flat fee up front plus a multiple of the ransom does that to a small ransom: the smaller the victim, the steeper the bill.

MonsterCloud’s homepage carried a video of John Pistole, a former FBI deputy director, crediting “MonsterCloud’s proprietary technology and expertise.” In May 2019, Pinhasi said the opposite:

“Monstercloud doesn’t hold any Proprietary technology [to] decrypt the ransomware data.”

The indictment has the scheme running for four more years after he said it.

Police departments chose MonsterCloud because they would not pay ransoms

Local governments and police departments were among the firm’s clients. ProPublica’s 2019 investigation, “The Trade Secret,” named three of them: the Lauderdale County Sheriff’s Office in Mississippi, the Trumann Police Department in Arkansas and the Lamar County Sheriff’s Office in Texas. MonsterCloud’s website ran the line “Don’t Pay the Ransom.” Several agencies told ProPublica they picked MonsterCloud because they believed it would never pay a ransom, a point the outlet repeated in 2026.

For a police chief, the deliverable was not decrypted files, since any firm willing to pay hackers can supply those. It was being able to say the department paid no criminals.

The named agencies mostly paid MonsterCloud nothing. Trumann’s $75,000 fee was waived in exchange for a testimonial. Lamar County, which faced a ransom demand of 1 bitcoin, about $8,000, also got the work free in exchange for a testimonial. Officials at both sheriff’s offices said they believed no ransom had been paid.

For a police chief, the deliverable was not decrypted files, since any firm willing to pay hackers can supply those.

What MonsterCloud took from police was endorsements, not fees. A sheriff vouching that his office never paid criminals is the strongest advertisement a no-ransom pitch can carry. The invoices went to the paying customers, and the indictment’s 18-fold and 2.4-fold markups land on them.

The firm’s credibility with law enforcement also had a famous face. Pistole served as FBI deputy director under Robert Mueller and later ran the TSA. He was listed as the only member of MonsterCloud’s “Cyber Security Advisory Council.” In 2019 he told ProPublica that he was paid indirectly through a speaker’s bureau and that Pinhasi scripted the testimonial. He also described how he understood the firm to work:

“That’s the business model as I understood it. Based on my experience and knowledge, ransom is paid and they facilitate the best practices moving forward.”

A spokesperson for the U.S. Attorney’s Office declined to comment on his connection to MonsterCloud.

A police badge beside a ransomware-locked laptop, with a concealed bitcoin payment

Exposed in 2019, charged in 2026

The practice had been tested in public long before a grand jury saw it. In December 2016, Emsisoft researcher Fabian Wosar infected his own machine with a custom ransomware strain and posed as a victim. Messages from MonsterCloud and other recovery firms looking to deal with the attacker arrived at email accounts he controlled.

In May 2019, ProPublica concluded that the firm must have paid ransoms in certain cases. It also found that MonsterCloud’s contract allowed for “communicating with the cyber attacker” if decryption failed. Pinhasi called his methods a “trade secret”:

“How we do it, it’s our problem. You will get your data back. Sit back, relax and enjoy the ride.”

That is the defence’s likely ground: MonsterCloud never promised any particular method, and the contract mentioned talking to attackers. The record it has to answer includes:

a homepage headed “Don’t Pay the Ransom”
a promise to recover data “without succumbing to ransom demands”
claims of decryption tools that did not exist, according to prosecutors
the CEO’s own 2019 statement that MonsterCloud held no such technology
the firm’s only advisory-council member saying “ransom is paid”

A fallback clause in a contract does not describe a business in which paying the attackers was the method, and the people who knew it was the method included its CEO and its advisory council.

The alleged scheme ran until June 2023, four years after ProPublica’s story. The indictment came on September 23, 2026, more than seven years after the story. Prosecutors have not explained the gap. When the story ran, the FTC had cited neither MonsterCloud nor Proven Data, the other recovery firm ProPublica traced paying hackers. U.S. Attorney Joseph Nocella now says Pinhasi “re-victimized his clients while extracting a hefty profit for himself.”

The case follows a prosecution reported in May 2026 of a different and worse crime. Two ransomware negotiators, Ryan Goldberg and Kevin Martin, got four years each for working as BlackCat ransomware affiliates who attacked victims themselves.

Pinhasi hung up when ProPublica called his cellphone in October. His attorneys, Christopher Clark and Rodney Villazor, had not responded to requests for comment.

Exterior of the federal courthouse in Brooklyn

A judge has granted a one-month delay because the two sides are negotiating a plea. A plea means the indictment’s victims, and the ledger of which clients’ money reached which gangs, may never be laid out in court. The clearest public account of how MonsterCloud recovered files would then remain the one its own advisory council member gave in 2019: ransom is paid.