Ransomware Recovery Firm Boss Charged With Secretly Paying the Hackers

A ransomware recovery firm sold itself as the clean alternative to paying criminals. According to US prosecutors, it quietly paid them instead. On 8 October 2026 the US Attorney’s Office for the Eastern District of New York announced charges against Zohar Pinhasi, the owner of Florida-based MonsterCloud, over a scheme it says ran from 2018 to 2023.

These are allegations, not findings. Pinhasi has pleaded not guilty and is presumed innocent. The case lands on a question many UK firms face in the worst week of their year: who do you call when your files are locked?

What prosecutors say happened

The Justice Department announcement charges Pinhasi with two counts of wire fraud and one count of wire fraud conspiracy. Each carries a maximum of 20 years. Reporting on the indictment says he told clients MonsterCloud could unlock their data without paying the attackers.

Prosecutors allege the reality was different. The firm had no special decryption technology. Staff contacted the criminals, paid for a decryption key, and then used that key on the client’s files. The client saw a bill for “recovery” and never heard about the ransom.

The numbers are striking. The indictment alleges clients were billed more than $19 million, while more than $8 million went to ransomware gangs. In one case from around August 2023, he allegedly paid a criminal about $8,200 and charged the client about $150,000, according to The Register.

The “trade secret” that was a payment

The indictment also describes the marketing. Website testimonials allegedly came from paid promoters. In May 2019, one of them asked whether the company had decryption software. Pinhasi allegedly replied that MonsterCloud “doesn’t hold any proprietary technology” to decrypt ransomware data.

None of this is new to anyone who read the ProPublica investigation from May 2019. It found MonsterCloud calling its method a “trade secret” while sometimes paying ransoms without telling victims, including local law enforcement agencies. It also reported that a contact known as “Zack Green” was an alias. The indictment names “Zack Silver” and “Zack Green” as aliases of the same defendant.

The gap between the 2019 reporting and the 2026 charges is worth sitting with. The practice was public for seven years before it became a criminal case.

What a ransomware recovery firm should tell you

Good ones are open about the trade-offs. They say up front that negotiation is sometimes on the table, who decides, and what it costs. Some firms do negotiate on behalf of victims, and that can be legitimate when the client knows and agrees. The alleged problem here is secrecy and the markup, not the existence of a negotiator.

Think of the $8,200 against $150,000 example. A client who knew the ransom was a few thousand pounds could have weighed other options, such as restoring from backups or asking the police for help. Instead, the client paid for a service that was described as something else.

Why this matters beyond one company

Paying a ransom is not automatically illegal. It can carry real risks, though. Sanctions exposure is one. Funding the next attack is another. Insurers, regulators and your own board all expect to be told. A middleman who pays in secret removes your ability to make that decision.

It also leaves you with a false picture. Any ransomware recovery firm that hides a payment hides the risk too. If you believe a vendor cracked the encryption, you may assume the attackers have no leverage. In fact the criminals were paid, and they may still hold copies of your stolen data.

What to check before you hire a ransomware recovery firm

The checklist below is short on purpose. Print it and keep it with your incident plan. Each point closes a gap the indictment describes.

• Ask in writing whether the firm will ever contact or pay the attackers, and under what approval.
• Require a named decision-maker on your side to sign off on any payment.
• Ask how the firm decrypts, and whether it has done so without a key from the criminals.
• Get an itemised bill that separates fees from any third-party payments.
• Treat testimonials and “guaranteed results” as marketing, not evidence.

So the best fix is to avoid the situation. A tested plan for the first hour matters more than any vendor, as we covered in why incident response plans fail early. Offline, tested backups remove most of the need to negotiate at all. A ransomware readiness assessment shows you whether yours would hold up.

Test the defences before the criminals do

Most ransomware starts with an ordinary weakness: a stolen password, an exposed service, an unpatched gateway. A scoped penetration test finds those routes while fixing them is still cheap. If you want to talk it through, get in touch with our team.