DOJ Charges Florida Ransomware Remediation Owner With Wire Fraud for False Decryption Claims

Zohar Pinhasi, a 50-year-old cybersecurity professional and the owner of a Florida-based ransomware remediation company, was arraigned today in federal court in the Eastern District of New York. According to an official advisory from the U.S. Department of Justice, Pinhasi faces wire fraud charges stemming from allegations that he deceived clients into paying for services he could not deliver.

The Department of Justice states that Pinhasi, who is both a U.S. and Israeli national, used aliases including “Zack Silver” and “Zack Green” during the course of his operations. The core of the prosecution’s case involves Pinhasi’s false representations to victims that he possessed the technical capability to decrypt ransomware-encrypted data without requiring the payment of ransoms to cybercriminal groups. The charges specifically target these fraudulent claims as the mechanism through which he allegedly defrauded clients.

The Nature of the Allegations

The indictment highlights a specific modus operandi involving the exploitation of ransomware victims who are often under significant duress. According to the Justice Department, Pinhasi leveraged his reputation as a known cybersecurity expert to convince clients that he could bypass the encryption locks imposed by ransomware operators. By asserting that he could restore access to files without engaging with the attackers financially, he solicited payments under false pretenses.

Wire fraud is a federal crime that involves using interstate communications to execute a scheme to defraud. In this case, the fraudulent scheme centers on the sale of decryption services that the prosecution alleges were impossible to perform as promised. The use of multiple aliases suggests an attempt to obscure his identity or create multiple personas within the cybersecurity consulting space. The arraignment marks the formal reading of charges and the beginning of the federal legal process against Pinhasi.

Who Is Affected

The primary victims in this case are individuals and organizations that sought Pinhasi’s assistance after falling victim to ransomware attacks. These clients, located presumably within the reach of his Florida-based company, paid for remediation services based on the promise of data recovery without ransom payment. Because ransomware incidents often involve critical business data or personal files, the financial loss from Pinhasi’s services is compounded by the continued inaccessibility of the victims’ encrypted data.

Broader implications extend to the cybersecurity services industry, where trust is a critical component of vendor-client relationships. The case underscores the risks faced by victims who may turn to third-party negotiators or remediation specialists without verifying their actual technical capabilities or legal standing. The Justice Department’s action serves as a public record of the charges, but does not yet establish guilt.

What should you do?

Security professionals and organizations seeking ransomware remediation should verify the credentials and claims of any third-party service provider. Legitimate decryption typically requires either a pre-existing backup, a vulnerability in the ransomware’s implementation, or cooperation with law enforcement that leads to key recovery. Promises of guaranteed decryption without ransom payment should be treated with extreme skepticism.

No patch, fix, or technical update has been confirmed in relation to this legal proceeding, as the charges are criminal in nature rather than technical. Victims of ransomware are advised to report incidents to the FBI’s Internet Crime Complaint Center (IC3) and consult with verified incident response firms that adhere to industry standards. Do not engage with individuals using aliases or those who cannot provide verifiable proof of past successful decryptions independent of ransom payments.