MonsterCloud Owner Accused of Billing Over $19M While Secretly Paying Ransoms to Decrypt Data
MonsterCloud owner charged with defrauding victims by secretly paying ransoms while claiming proprietary decryption.
Zohar Pinhasi, owner of MonsterCloud, has been charged by the U.S. Department of Justice for allegedly defrauding ransomware victims. He is accused of secretly paying ransoms to attackers to obtain decryptors, while falsely claiming to use proprietary tools and advanced techniques to recover data for his clients. Pinhasi allegedly charged clients significantly more than the ransom payments, totaling over $19 million in billed fees and over $8 million in ransom payments.
AI summary of the linked source. Not reviewed by an editor. How this works
Run MonsterCloud?
Get an email when a new story names MonsterCloud, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonMonsterCloud's owner allegedly defrauded ransomware victims by secretly paying ransoms to obtain decryptors while falsely claiming to use proprietary recovery tools — charging clients far more than the actual ransom amounts. This case highlights a critical blind spot: organizations under duress often lack the technical expertise to vet the legitimacy or methods of incident response vendors they hire. The fraud persisted because victims had no visibility into what recovery actions were actually being taken on their behalf. This matters not only because of direct financial harm, but because secret ransom payments may violate OFAC sanctions regulations and can fund further criminal activity. Trust in third-party IR vendors must be earned through transparency, credentials, and contractual accountability — not assumed during a crisis.