[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpPDGMhHGPrV3SkP4eTN1BVGNn_GJqEHmHnoyKsxDqQk":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"a578cfcc-b5d8-425a-aa07-f01afe70c4d1","MonsterCloud Owner Accused of Billing Over $19M While Secretly Paying Ransoms to Decrypt Data","monstercloud-owner-accused-of-billing-over-19m-while-secretly-paying-ransoms-to--9d4247","The U.S. Department of Justice (DoJ) on Wednesday announced charges against a 50-year-old U.S. and Israeli national for allegedly defrauding ransomware victims by secretly paying the attackers to obtain decryptors while claiming to use proprietary tools to recover their data. Zohar Pinhasi (aka Zack Silver and Zack Green) has been charged with two counts of wire fraud and one count of wire","Zohar Pinhasi, owner of MonsterCloud, has been charged by the U.S. Department of Justice for allegedly defrauding ransomware victims. He is accused of secretly paying ransoms to attackers to obtain decryptors, while falsely claiming to use proprietary tools and advanced techniques to recover data for his clients. Pinhasi allegedly charged clients significantly more than the ransom payments, totaling over $19 million in billed fees and over $8 million in ransom payments.","MonsterCloud owner charged with defrauding victims by secretly paying ransoms while claiming proprietary decryption.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fmonstercloud-owner-accused-of-billing.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEj-Hxj4Ir77Q0O6Rp9Sl0KYLSls340zQ9WBZYebBilMmz0l_V2uLs76lrTrFnLxVfjx_FhV6wGm9rRxUTxCE-f3aZwo-DTYvYoSEd4AuW0qFFKOmrHFO44mToyUy7yzpvSnAmaUUUs4yEg_91GBxijxbPxhYcB22TX7c4WdmekZaddHxvs_V89WUdgM3dte\u002Fs1600\u002Frasnomware-fees.jpg","2026-10-08T07:41:44+00:00","2026-10-08T10:00:21.17727+00:00",8,[17,20,23,25],{"name":18,"type":19},"MonsterCloud","product",{"name":21,"type":22},"Zohar Pinhasi","threat_actor",{"name":24,"type":22},"Zack Silver",{"name":26,"type":22},"Zack Green","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":27,"icon":29,"name":30,"slug":31},null,"Ransomware","ransomware",[33,38,40],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":48,"vendors":49},[],[],{"slug":51,"title":52,"body":53,"framework_refs":54,"framework_notes":63},"ransomware-recovery-firm-charged-with-secretly-paying-ransoms-while-billing-victims-19m","Ransomware Recovery Firm Charged With Secretly Paying Ransoms While Billing Victims $19M+","MonsterCloud's owner allegedly defrauded ransomware victims by secretly paying ransoms to obtain decryptors while falsely claiming to use proprietary recovery tools — charging clients far more than the actual ransom amounts. This case highlights a critical blind spot: organizations under duress often lack the technical expertise to vet the legitimacy or methods of incident response vendors they hire. The fraud persisted because victims had no visibility into what recovery actions were actually being taken on their behalf. This matters not only because of direct financial harm, but because secret ransom payments may violate OFAC sanctions regulations and can fund further criminal activity. Trust in third-party IR vendors must be earned through transparency, credentials, and contractual accountability — not assumed during a crisis.",[55,56,57,58,59,60,61,62],"NIST SP 800-61 Rev. 2 – Incident Response Lifecycle (Vendor Coordination)","NIST CSF RS.CO-5 – Voluntary information sharing with external stakeholders","CIS Control 17 – Incident Response Management","OFAC Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (2021)","FTC Act Section 5 – Unfair or Deceptive Acts or Practices","GDPR Article 28 – Processor obligations and data processing agreements","ISO\u002FIEC 27035 – Information Security Incident Management","ITIL 4 – Problem and Incident Management practices",{}]