Key points
- Zohar Pinhasi is charged with wire fraud for false decryption claims.
- The defendant operated a ransomware remediation business in Florida.
- He is a dual US and Israeli national known by aliases.
A prominent cybersecurity consultant based in Florida has been charged with wire fraud after allegedly convincing clients he could decrypt their ransomware-encrypted files without making payments to cybercriminals. The Department of Justice announced the charges today, marking a significant enforcement action against the ransomware remediation industry.
In plain English
Ransomware attacks lock victims’ data, demanding payment for a decryption key. Pinhasi allegedly told clients he possessed the technical capability to reverse this encryption process without engaging with the attackers or paying the demanded ransoms. The Department of Justice states these representations were false. By charging clients for services that did not work as described, Pinhasi is accused of defrauding them through interstate communications, which constitutes wire fraud under US federal law.
The background
Zohar Pinhasi, 50, was arraigned in the Eastern District of New York today. The Department of Justice identifies him as both a US and Israeli national. He is also known by the aliases “Zack Silver” and “Zack Green.” Pinhasi operated a ransomware remediation company in Florida, positioning himself as an expert who could help victims recover data. The charges relate specifically to his false claims regarding the ability to decrypt ransomware without paying the criminals responsible for the attacks.
What changes now
Pinhasi now faces criminal charges. For managed service providers and cybersecurity firms, this case highlights the legal risks associated with making unsubstantiated claims about ransomware decryption capabilities. The Department of Justice’s action signals increased scrutiny of actors in the incident response and remediation space who promise results that bypass standard recovery protocols. No technical patches or fixes are relevant to this case, as the issue concerns criminal fraud rather than a software vulnerability.
Background: Ransomware decryption tools
Decryption tools analyse encrypted files to identify the ransomware variant and check for known keys or flaws. They succeed when the malware uses weak cryptography, fails to generate unique keys per victim, or leaves the key stored locally. They cannot break strong, correctly implemented encryption.
Read the full guide: How Ransomware Decryption Tools Work: The Hidden Mechanics
What to do and how to stay safe: Zohar Pinhasi
- Offline communication channels prevent attackers from monitoring your coordination efforts.
- Regular tabletop exercises reveal gaps in logic before a real breach occurs.
- Documenting decisions during an incident provides legal and operational clarity later.
An incident response plan is only as good as its last test. Schedule a tabletop exercise this quarter to validate your procedures and identify hidden weaknesses.
Step-by-step guide: Incident Response Plans: Best Practices for Resilient Recovery
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who is being charged and what are the charges?
Zohar Pinhasi, a 50-year-old cybersecurity expert, is charged with wire fraud for falsely claiming he could decrypt ransomware without paying criminals.
Where did the arraignment take place?
Pinhasi was arraigned in the Eastern District of New York today.
What aliases does the defendant use?
According to the Department of Justice, Pinhasi is also known as “Zack Silver” and “Zack Green.”
