A ransomware remediation operator allegedly paid cybercriminals $8,200 for a decryption key in 2023 — and billed the client $150,000. Zohar Pinhasi, owner of MonsterCloud, has been arraigned in New York on wire fraud charges for allegedly defrauding clients of his Florida-based ransomware remediation company.

The US Attorney's Office for the Eastern District of New York announced the charges. Pinhasi, who also went by the aliases "Zack Silver" and "Zack Green," is facing trial for defrauding customers who believed his firm could break ransomware encryption on its own.

What does the indictment allege?

MonsterCloud marketed itself as an alternative to paying ransom demands. Its website stated that "our team specializes in helping businesses recover their data without succumbing to ransom demands" thanks to its proprietary decryption techniques.

The indictment tells a different story:

• Pinhasi allegedly used no decryption technology at all.
• He paid cybercriminals for decryption keys, which MonsterCloud employees then used to unlock client files.
• He typically charged clients a fee substantially higher than the ransom payment itself.

The 2023 transaction is the prosecution's headline example: an $8,200 payment to a cybercriminal, offset by a $150,000 invoice to the victimized client.

District Attorney Joseph Nocella pulled no punches in his assessment. "The defendant re-victimized his clients while extracting a hefty profit for himself," Nocella said.

Why did victims turn to MonsterCloud?

US government guidance — echoed by other governments — advises against paying ransoms on two grounds: payment may encourage further attacks, and victims may never recover their data.

There is also a legal trap. Where attackers belong to a country or group subject to trade sanctions, making a ransom payment may itself be illegal. Victims could face criminal charges simply for complying with extortion demands.

Are there other scams targeting ransomware victims?

Ilia Kolochenko of cybersecurity company ImmuniWeb said overcharging by negotiators takes several forms. "Cases vary; sometimes negotiators simply overcharge for their services. In other cases, they may inflate the final amount, saying, for instance, that 50 percent extra is to ensure a third-party validation of secure data erasure or something similar that the client would buy," he said.

Kolochenko warned of additional techniques used to extract money from ransomware victims:

• Fake law enforcement agencies promising to find and arrest the hackers, then citing the victim's civil liability and demanding prepayment of a "bond" for an eventual regulatory fine.
• Fake cybersecurity companies claiming to have already found stolen data on the dark web, then charging fees to "securely erase" it in order to avoid bad publicity and regulatory sanctions.

Is this an isolated case?

No. Kolochenko pointed to two similar prosecutions in recent months: a Florida business case in July, and the May sentencing of a Latvian national described by the Justice Department as a global ransomware group negotiator involved in 5.6 million cyberattacks, who received an 8.5-year prison term.

For CISOs and procurement teams, the cases underline a due-diligence gap: incident-response vendors that claim independent decryption capability should be able to explain their methods. A vendor that cannot — or will not — may simply be a middleman marking up extortion payments.