[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foIJ4g8HWilRXBffnWibirZ2Q6OUeYm8znIagkyW0Ymw":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":46},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"64a47d64-cf98-415c-ae24-ed501be7590d","MonsterCloud CEO Zohar Pinhasi Accused of Paying Hackers, Defrauding Victims","monstercloud-ceo-zohar-pinhasi-accused-of-paying-hackers-defrauding-victims-bf101d","The DOJ accuses MonsterCloud CEO Zohar Pinhasi of secretly paying ransomware gangs for decryption keys while charging victims…","The CEO of ransomware recovery firm MonsterCloud, Zohar Pinhasi, has been charged by the US Department of Justice with wire fraud and conspiracy to commit wire fraud. Prosecutors allege that Pinhasi falsely claimed to use proprietary decryption technology while secretly paying ransomware attackers for decryption keys and then charging clients significantly inflated fees for the recovery services. The indictment details instances where Pinhasi paid attackers hundreds of thousands of dollars while billing clients millions.","MonsterCloud CEO Zohar Pinhasi charged with defrauding victims by paying hackers and overcharging for recovery.","https:\u002F\u002Fhackread.com\u002Fmonstercloud-ceo-zohar-pinhasi-ransomware-victims\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Fmonstercloud-ceo-zohar-pinhasi-ransomware-victims.jpg","2026-10-09T18:19:01+00:00","2026-10-09T20:00:19.044082+00:00",7,[17,20],{"name":18,"type":19},"MonsterCloud","product",{"name":21,"type":22},"Zohar Pinhasi","threat_actor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":23,"icon":25,"name":26,"slug":27},null,"Breaches","breaches",[29,31,36],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":44,"vendors":45},[],[],{"slug":47,"title":48,"body":49,"framework_refs":50,"framework_notes":59},"ransomware-recovery-firm-ceo-charged-with-defrauding-victims-while-secretly-paying-attackers","Ransomware Recovery Firm CEO Charged with Defrauding Victims While Secretly Paying Attackers","MonsterCloud's CEO allegedly exploited victims at their most vulnerable moment — immediately after a ransomware attack — by falsely claiming proprietary decryption capabilities while simply paying ransomware gangs and massively marking up the cost. This case exposes a critical blind spot: organizations in crisis often cannot verify the claims of third-party recovery vendors, creating fertile ground for fraud. It also highlights the dangerous reality that engaging with ransomware attackers, even indirectly through a vendor, carries legal, financial, and ethical risks. The incident underscores that the incident response supply chain itself is an attack surface that requires due diligence, transparency, and contractual accountability.",[51,52,53,54,55,56,57,58],"NIST CSF RS.CO-5 (Coordinate with stakeholders consistent with response plans)","NIST SP 800-61 Rev. 2 – Computer Security Incident Handling Guide","CIS Control 17 – Incident Response Management","ISO\u002FIEC 27035 – Information Security Incident Management","GDPR Article 28 – Processor obligations and due diligence on third-party processors","FTC Act Section 5 – Prohibition on unfair or deceptive acts or practices","NIST SP 800-161 – Supply Chain Risk Management Practices","CIS Control 15 – Service Provider Management",{}]