The Radical Reading Room

On October 7, 2026, federal prosecutors in the Eastern District of New York announced that Zohar Pinhasi, also known as Zack Silver and Zack Green, had been arraigned on wire fraud charges after a grand jury indictment returned on September 23. The Justice Department says Pinhasi owned and operated MonsterCloud LLC, a Florida ransomware-remediation company, and that he misled customers into believing the firm could recover encrypted files through proprietary technology rather than by paying the hackers behind the attack. Prosecutors say the company charged clients far more than the ransom payments it secretly forwarded. ([justice.gov](https://www.justice.gov/usao-edny/pr/owner-florida-ransomware-remediation-company-charged-defrauding-clients?utm_source=openai))

The indictment gives a concrete example: in one August 2023 matter, prosecutors say MonsterCloud paid about $8,200 to a cybercriminal group and then billed the client about $150,000. The charging document says that over the course of the alleged scheme, from June 2018 through June 2023, Pinhasi and associates collected more than $19 million from victims while paying more than $8 million in ransom. Those allegations are presented in a federal indictment, so they remain accusations unless and until proven in court. ([justice.gov](https://www.justice.gov/usao-edny/media/1464771/dl?utm_source=openai))

ProPublica’s 2019 reporting on MonsterCloud is the original journalistic record that this indictment appears to mirror. In that earlier investigation, the outlet described customers who believed they were buying a technical alternative to ransom payment, and it reported that MonsterCloud’s approach in some cases appeared to depend on paying hackers anyway. The new DOJ case does not prove the earlier reporting, but it independently aligns with the same core conduct and business model described at the time. ([justice.gov](https://www.justice.gov/usao-edny/pr/owner-florida-ransomware-remediation-company-charged-defrauding-clients?utm_source=openai))

Independent cybersecurity coverage also matched the government’s account. BleepingComputer reported the charge and repeated the allegation that MonsterCloud advertised decryption help while actually forwarding ransom payments. CSO Online likewise described the arraignment and the allegation that Pinhasi used ransom payments, not secret technology, to recover data. That broader reporting does not establish guilt, but it does support the public significance of the case and the continuity between the indictment and prior reporting. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ransomware-recovery-ceo-charged-over-secret-ransom-payments/amp/?utm_source=openai))

What is known now is narrow but consequential: prosecutors have accused a ransomware-remediation executive of profiting by promising protection from extortion while allegedly participating in the same ransom ecosystem he was selling himself against. What is not yet known is whether a jury will credit the government’s account, whether Pinhasi will contest the facts, or how much of MonsterCloud’s business involved disclosed versus undisclosed ransom payments. For now, the case is a reminder that ransomware response services can blur the line between victim assistance and hidden facilitation, especially when customers are under urgent pressure and cannot easily verify what their vendor is doing behind the scenes. ([justice.gov](https://www.justice.gov/usao-edny/pr/owner-florida-ransomware-remediation-company-charged-defrauding-clients?utm_source=openai))