A Florida man who marketed himself as an elite cyberattack solutions expert stands accused of operating a sophisticated and predatory double-extortion fraud scheme, exploiting panicked business owners while lining his own pockets with exorbitant fees, according to a federal grand jury indictment.

Zohar Pinhasi, the owner and operator of the Miami-based cybersecurity firm MonsterCloud, was arraigned this week in a federal courtroom in New York. The arraignment follows a formal indictment handed down in September, which charges Pinhasi with multiple counts of fraud stemming from his handling of high-stakes corporate ransomware incidents.

Federal prosecutors assert that rather than utilizing proprietary technology to bypass cybercriminals, Pinhasi routinely engaged in the very practice he publicly condemned: paying off extortionists behind the scenes, and then drastically inflating the costs to bill unsuspecting clients under the guise of specialized technical remediation.

"As alleged in the indictment, by falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself," said U.S. Attorney Joseph Nocella Jr. in a public statement detailing the charges against the Florida executive.

According to court documents and detailed allegations compiled by federal prosecutors, the fraudulent operation targeted distressed business owners who turned to MonsterCloud in the chaotic immediate aftermath of debilitating ransomware attacks. When desperate executives sought a way to recover locked files and restore crippled operations, Pinhasi allegedly assured them that his company possessed advanced, proprietary software capable of unlocking encrypted data securely and independently, without negotiating with or paying the malicious actors responsible for the breach.

In practice, however, the indictment alleges that Pinhasi did nothing of the sort. Instead of deploying sophisticated decryption algorithms or technical workarounds, he would quietly contact the cybercriminals, negotiate a modest fee to obtain the necessary decryption key, and then turn around to bill the victimized businesses a vastly inflated sum for purported expert consulting and technical services.

The financial discrepancy highlighted by investigators underscores the sheer scale of the alleged markups. In one specific case detailed in the federal indictment, Pinhasi quietly paid approximately $8,200 to a cybercriminal group to secure a decryption key for a compromised client. Without disclosing to the client that the underlying threat had been resolved for a nominal sum, Pinhasi allegedly charged the business a staggering $150,000 for the service, capturing a massive profit margin by taking advantage of a corporation in crisis.

Law enforcement officials emphasized that Pinhasi’s actions did not merely extract excessive fees; they actively compromised the security and financial stability of the businesses that trusted him. By concealing the true nature of the resolution, the defendant left victimized organizations in the dark about how the attack was handled, failing to provide genuine long-term remediation or secure their networks against potential secondary breaches by the same criminal syndicates.

"As alleged, Zohar Pinhasi claimed to fix ransomware while never remediating the underlying threat. Instead, he turned the victim’s crisis into his own profit center," said Assistant FBI Director James Barnacle, highlighting the exploitative nature of the fraud scheme.

Pinhasi, who holds dual citizenship in the United States and Israel, could not be reached for comment regarding the federal allegations. An attempt to reach him by phone at MonsterCloud’s primary office number was unsuccessful. According to a letter submitted to the federal court by his defense counsel, Pinhasi was originally scheduled to appear for a bond hearing in September, but was out of the country at the time the hearing was scheduled. It remained unclear following his recent arraignment whether he had successfully posted bond or if he was being held in federal custody.

The federal indictment and ongoing legal proceedings also leave open several questions regarding the broader financial fallout for the victimized companies, particularly concerning corporate insurance policies. The court documents do not indicate whether the businesses targeted by MonsterCloud maintained cyber insurance coverage, nor do they clarify whether commercial insurers ultimately footed the inflated bills submitted by Pinhasi’s firm. Furthermore, legal experts note that if insurance providers did cover the fraudulent invoices, those companies could potentially pursue legal action or seek financial compensation through subrogation claims against Pinhasi and MonsterCloud as the legal process unfolds.

Representatives for the U.S. Department of Justice were not immediately available to provide further comment on the scope of the investigation or whether additional charges or co-conspirators might be identified as the case proceeds through the federal court system.