{"id":7079726,"date":"2026-10-08T05:00:42","date_gmt":"2026-10-08T05:00:42","guid":{"rendered":"https:\/\/fivemor.com\/?p=7079726"},"modified":"2026-10-08T05:00:42","modified_gmt":"2026-10-08T05:00:42","slug":"ransomware-fixer-claimed-he-could-decrypt-files-allegedly-defrauded-clients-instead","status":"publish","type":"post","link":"https:\/\/fivemor.com\/?p=7079726","title":{"rendered":"Ransomware fixer claimed he could decrypt files, allegedly defrauded clients instead"},"content":{"rendered":"


\n
<\/p>\n

\n

<\/p>\n

\n cyber-crime\n <\/p>\n

<\/a><\/p>\n

\n Feds claim he charged clients more than ransoms, paid up, pocketed the difference\n <\/p>\n<\/div>\n

\n

<\/p>\n

The United States Department of Justice has charged a man with fraud after he allegedly told clients he could decrypt files locked up by ransomware but actually paid ransoms \u2013 and seemingly got away with it for years.<\/p>\n

The Feds allege that Zohar Pinhasi \u2013 aka \u201cZack Silver\u201d and \u201cZack Green\u201d \u2013 ran a Florida company called \u201cMonsterCloud\u201d that advised ransomware victims not to pay because it had a way to recover encrypted data.<\/p>\n

\u201cThe charges relate to Pinhasi\u2019s claimed ability to decrypt ransomware without paying cybercriminals, purportedly using \u2018proprietary tools\u2019 and \u2018advanced decryption techniques’ on behalf of distressed business owners who came to his company,\u201d according to a DoJ press release<\/a>. \u201cIn fact, Pinhasi allegedly used a portion of his clients\u2019 fees to pay off the ransomware attackers, and then kept the rest, often extracting a substantial markup.\u201d<\/p>\n

In one case, Pinhasi allegedly charged his client $150,000, paid the $8,200 ransom, and pocketed the rest \u2013 but didn\u2019t admit he had paid the ransom.<\/p>\n

That scheme allegedly worked so well that Pinhasi charged clients more than $19 million and paid more than $8 million in ransom payments.<\/p>\n

The DOJ\u2019s indictment<\/a> [PDF] says MonsterCloud\u2019s website mentions its use of \u201cadvanced decryption techniques and cutting-edge technology\u201d \u2013 the same language found on this monstercloud.com page<\/a>.<\/p>\n

The site also contains this claim: \u201cAt MonsterCloud, we are not a team of IT Experts. We are the most sophisticated Counter Cyber Terrorism team in the world.\u201d<\/p>\n

The indictment suggests MonsterCloud was nothing of the sort, and that its claims rang hollow for years.<\/p>\n

\u201cMonsterCloud’s website included \u2018testimonials\u2019 and other promotional content, including from at least one compensated spokesperson,\u201d the indictment states. \u201cIn May 2019, one such spokesperson \u2013 an individual who had provided a paid testimonial for the MonsterCloud website \u2013 contacted the defendant Zohar Pinhasi with questions about Pinhasi\u2019s business practices and truthfulness.\u201d<\/p>\n

\u201cAmong other things, the spokesperson asked Pinhasi whether MonsterCloud actually had any proprietary software that would allow MonsterCloud to decrypt encrypted data. Pinhasi responded: \u2018MonsterCloud doesn’t hold any proprietary technology [to] decrypt the ransomware data.\u2019\u201d<\/p>\n

Pinhasi faces two counts of wire fraud, and one of wire fraud conspiracy. He could do twenty years on each count, if convicted.<\/p>\n

The FBI is investigating this case, and it appears further charges could follow as the indictment states Pinhasi had \u201cmultiple co-conspirators, individuals whose identities are both known and unknown to the Grand Jury, including MonsterCloud employees and contractors.\u201d \u00ae<\/p>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"

cyber-crime Feds claim he charged clients more than ransoms, paid up, pocketed the difference The United States Department of Justice has charged a man with fraud after he allegedly told clients he could decrypt files locked up by ransomware but actually paid ransoms \u2013 and seemingly got away with it for years. The Feds allege […]<\/p>\n","protected":false},"author":1,"featured_media":7079727,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[240426],"tags":[45266,43630,11235,240427,110277,8277,42992,37598],"dealstore":[],"offerexpiration":[],"class_list":["post-7079726","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-crime-2","tag-allegedly","tag-claimed","tag-clients","tag-decrypt","tag-defrauded","tag-files","tag-fixer","tag-ransomware"],"yoast_head":"\nRansomware fixer claimed he could decrypt files, allegedly defrauded clients instead - Som2ny Network<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fivemor.com\/?p=7079726\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ransomware fixer claimed he could decrypt files, allegedly defrauded clients instead - Som2ny Network\" \/>\n<meta property=\"og:description\" content=\"cyber-crime Feds claim he charged clients more than ransoms, paid up, pocketed the difference The United States Department of Justice has charged a man with fraud after he allegedly told clients he could decrypt files locked up by ransomware but actually paid ransoms \u2013 and seemingly got away with it for years. The Feds allege […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fivemor.com\/?p=7079726\" \/>\n<meta property=\"og:site_name\" content=\"Som2ny Network\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-08T05:00:42+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/image.theregister.com\/?imageId=241830&width=800\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fivemor.com\/?p=7079726#article\",\"isPartOf\":{\"@id\":\"https:\/\/fivemor.com\/?p=7079726\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371\"},\"headline\":\"Ransomware fixer claimed he could decrypt files, allegedly defrauded clients instead\",\"datePublished\":\"2026-10-08T05:00:42+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fivemor.com\/?p=7079726\"},\"wordCount\":429,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fivemor.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/fivemor.com\/?p=7079726#primaryimage\"},\"thumbnailUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/10\/241830.jpg\",\"keywords\":[\"Allegedly\",\"claimed\",\"Clients\",\"decrypt\",\"Defrauded\",\"files\",\"Fixer\",\"ransomware\"],\"articleSection\":[\"cyber-crime\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fivemor.com\/?p=7079726#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fivemor.com\/?p=7079726\",\"url\":\"https:\/\/fivemor.com\/?p=7079726\",\"name\":\"Ransomware fixer claimed he could decrypt files, allegedly defrauded clients instead - Som2ny Network\",\"isPartOf\":{\"@id\":\"https:\/\/fivemor.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/fivemor.com\/?p=7079726#primaryimage\"},\"image\":{\"@id\":\"https:\/\/fivemor.com\/?p=7079726#primaryimage\"},\"thumbnailUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/10\/241830.jpg\",\"datePublished\":\"2026-10-08T05:00:42+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fivemor.com\/?p=7079726#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fivemor.com\/?p=7079726\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/?p=7079726#primaryimage\",\"url\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/10\/241830.jpg\",\"contentUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/10\/241830.jpg\",\"width\":1200,\"height\":683},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fivemor.com\/?p=7079726#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/fivemor.com\/?bp_activities=1\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ransomware fixer claimed he could decrypt files, allegedly defrauded clients instead\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fivemor.com\/#website\",\"url\":\"https:\/\/fivemor.com\/\",\"name\":\"Som2ny Network\",\"description\":\"Daily Deals\",\"publisher\":{\"@id\":\"https:\/\/fivemor.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fivemor.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/fivemor.com\/#organization\",\"name\":\"Som2ny Network\",\"url\":\"https:\/\/fivemor.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png\",\"contentUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png\",\"width\":300,\"height\":86,\"caption\":\"Som2ny Network\"},\"image\":{\"@id\":\"https:\/\/fivemor.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/fivemor.com\"],\"url\":\"https:\/\/fivemor.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Ransomware fixer claimed he could decrypt files, allegedly defrauded clients instead - Som2ny Network","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fivemor.com\/?p=7079726","og_locale":"en_US","og_type":"article","og_title":"Ransomware fixer claimed he could decrypt files, allegedly defrauded clients instead - Som2ny Network","og_description":"cyber-crime Feds claim he charged clients more than ransoms, paid up, pocketed the difference The United States Department of Justice has charged a man with fraud after he allegedly told clients he could decrypt files locked up by ransomware but actually paid ransoms \u2013 and seemingly got away with it for years. The Feds allege […]","og_url":"https:\/\/fivemor.com\/?p=7079726","og_site_name":"Som2ny Network","article_published_time":"2026-10-08T05:00:42+00:00","og_image":[{"url":"https:\/\/image.theregister.com\/?imageId=241830&width=800","type":"","width":"","height":""}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fivemor.com\/?p=7079726#article","isPartOf":{"@id":"https:\/\/fivemor.com\/?p=7079726"},"author":{"name":"admin","@id":"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371"},"headline":"Ransomware fixer claimed he could decrypt files, allegedly defrauded clients instead","datePublished":"2026-10-08T05:00:42+00:00","mainEntityOfPage":{"@id":"https:\/\/fivemor.com\/?p=7079726"},"wordCount":429,"commentCount":0,"publisher":{"@id":"https:\/\/fivemor.com\/#organization"},"image":{"@id":"https:\/\/fivemor.com\/?p=7079726#primaryimage"},"thumbnailUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/10\/241830.jpg","keywords":["Allegedly","claimed","Clients","decrypt","Defrauded","files","Fixer","ransomware"],"articleSection":["cyber-crime"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fivemor.com\/?p=7079726#respond"]}]},{"@type":"WebPage","@id":"https:\/\/fivemor.com\/?p=7079726","url":"https:\/\/fivemor.com\/?p=7079726","name":"Ransomware fixer claimed he could decrypt files, allegedly defrauded clients instead - Som2ny Network","isPartOf":{"@id":"https:\/\/fivemor.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/fivemor.com\/?p=7079726#primaryimage"},"image":{"@id":"https:\/\/fivemor.com\/?p=7079726#primaryimage"},"thumbnailUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/10\/241830.jpg","datePublished":"2026-10-08T05:00:42+00:00","breadcrumb":{"@id":"https:\/\/fivemor.com\/?p=7079726#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fivemor.com\/?p=7079726"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/?p=7079726#primaryimage","url":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/10\/241830.jpg","contentUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/10\/241830.jpg","width":1200,"height":683},{"@type":"BreadcrumbList","@id":"https:\/\/fivemor.com\/?p=7079726#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/fivemor.com\/?bp_activities=1"},{"@type":"ListItem","position":2,"name":"Ransomware fixer claimed he could decrypt files, allegedly defrauded clients instead"}]},{"@type":"WebSite","@id":"https:\/\/fivemor.com\/#website","url":"https:\/\/fivemor.com\/","name":"Som2ny Network","description":"Daily Deals","publisher":{"@id":"https:\/\/fivemor.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fivemor.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/fivemor.com\/#organization","name":"Som2ny Network","url":"https:\/\/fivemor.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/#\/schema\/logo\/image\/","url":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png","contentUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png","width":300,"height":86,"caption":"Som2ny Network"},"image":{"@id":"https:\/\/fivemor.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png","caption":"admin"},"sameAs":["https:\/\/fivemor.com"],"url":"https:\/\/fivemor.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts\/7079726","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7079726"}],"version-history":[{"count":0,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts\/7079726\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/media\/7079727"}],"wp:attachment":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7079726"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7079726"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7079726"},{"taxonomy":"dealstore","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fdealstore&post=7079726"},{"taxonomy":"offerexpiration","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fofferexpiration&post=7079726"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}