Ransomware recovery sounds like the answer every victim wants when files are locked and operations stop. That urgency is exactly what a new criminal case says one company exploited, and it’s a warning every business should hear before it ever needs help.
Zohar Pinhasi, owner of the ransomware remediation company MonsterCloud, has been arraigned in New York on wire fraud charges. Prosecutors allege he defrauded clients by claiming he could recover encrypted files without paying a ransom, when in fact he was paying the criminals himself and billing victims far more.
What Happened
According to CSO Online, MonsterCloud promoted itself as an alternative to giving in to attackers. Its website said its team specialized “in helping businesses recover their data without succumbing to ransom demands.”
The indictment tells a different story. It alleges that instead of using any special decryption technology, Pinhasi paid the cybercriminals for a decryption key, which MonsterCloud employees then used to try to unlock clients’ files. Prosecutors allege he typically charged clients a fee substantially higher than the ransom itself. In one 2023 example cited in the case, he allegedly paid a cybercriminal $8,200 while charging the client $150,000.
“The defendant re-victimized his clients while extracting a hefty profit for himself,” district attorney Joseph Nocella said. Pinhasi, who also allegedly went by the names “Zack Silver” and “Zack Green,” has been charged, not convicted.
Why Victims Turn to “No-Pay” Ransomware Recovery Promises
It’s easy to see why a promise like MonsterCloud’s would appeal to a business in crisis. U.S. government guidance, echoed by other governments, discourages paying ransoms because it can encourage more attacks, and paying doesn’t guarantee you’ll get your data back. Paying can also create legal exposure: if the attackers belong to a group or country under trade sanctions, a payment may itself be illegal.
A provider that promises recovery without paying seems to solve all of that at once. If the allegations are true, clients may have ended up funding the attackers anyway, unknowingly, at many times the price. The appeal of “no-pay” ransomware recovery remains strong precisely because the alternative feels so unattractive.
It’s Part of a Bigger Pattern
This isn’t the only way ransomware victims are being squeezed a second time. Ilia Kolochenko of cybersecurity company ImmuniWeb told CSO Online that some negotiators simply overcharge, while others inflate the final amount with add-ons, such as an extra 50 percent for “third-party validation of secure data erasure.”
He described other schemes too. Some victims are contacted by fake law enforcement agencies that promise to catch the hackers but ask the victim to prepay a bond toward a possible regulatory fine. Others hear from fake cybersecurity companies claiming they’ve found the stolen data on the dark web and will “securely erase” it for a fee. Kolochenko said similar cases have come to court recently, including one in July involving a Florida business and another in May targeting a Latvian national.
It echoes the “Ransom Busters” scheme we covered in August, where a supposed recovery firm turned out to be linked to the attackers themselves. The common thread is that the period right after an attack is when victims are most likely to trust the wrong person.
Why This Matters for Your Organization
The worst time to choose an incident response partner is in the middle of an incident. Under pressure, with operations down and customers calling, most businesses will hire whoever sounds most confident. Without a plan in place, you have no easy way to check what you’re being told, what you’re being charged, or where your money is really going.
It also helps to set expectations inside your company before anything happens. Employees should know not to engage with anyone who reaches out about an incident, whether that’s a “recovery” firm, a “negotiator,” or someone claiming to be law enforcement. Those contacts should go straight to leadership and your security partner, who can verify them through official channels. Clear internal guidance reduces the chance that a ransomware recovery pitch reaches decision-makers unchallenged.
How to Vet a Ransomware Recovery Responder Before You Need One
- Get the scope and fees in writing up front. Know exactly what the provider will do, how they bill, and what costs could be added later.
- Ask directly whether any ransom will be paid, by whom, and how that decision gets made. A legitimate partner will be transparent and will involve your leadership, legal counsel, and insurer.
- Be skeptical of unsolicited offers. Anyone who contacts you after an attack offering recovery, “data erasure,” or law enforcement help for a fee deserves verification through official channels before you respond.
- Check references and track record. Ask for past clients, certifications, and how the provider coordinates with law enforcement.
- Line up your partner and plan now. A pre-arranged incident response relationship and tested backups mean you never have to choose a stranger under pressure.
The Takeaway
Ransomware already costs victims dearly, and the MonsterCloud case shows that the cost doesn’t always end with the attackers. Businesses that come through an incident best don’t scramble to find help after the fact. They have a trusted partner, a written plan, and backups they know they can restore. Choosing ransomware recovery support carefully—and early—remains one of the most practical steps any organization can take.
Want to make sure your business has a plan, and a partner you can trust, before ransomware strikes? Schedule a free assessment with our team today, and we’ll review your incident response readiness and recovery options.