Ransomware recovery CEO charged over secret ransom payments
Ransomware recovery CEO charged with defrauding victims by secretly paying attackers.
Zohar Pinhasi, owner of MonsterCloud, has been indicted on federal wire fraud charges for allegedly defrauding ransomware victims. Prosecutors claim Pinhasi's company did not use proprietary technology to recover data but instead secretly paid attackers for decryption keys, charging victims significantly more than the ransom amounts paid. The scheme allegedly facilitated over $8 million in ransom payments while charging clients more than $19 million.
AI summary of the linked source. Not reviewed by an editor. How this works
Run MonsterCloud?
Get an email when a new story names MonsterCloud, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonMonsterCloud misrepresented its services by claiming to use proprietary decryption technology while covertly paying ransoms to attackers and marking up costs significantly — extracting over $19 million from victims for $8 million in actual ransom payments. This case highlights a critical gap in victim awareness: organizations in crisis are highly vulnerable to predatory vendors who exploit urgency and technical complexity. It also underscores the risks of engaging third-party incident response providers without proper due diligence. The scheme simultaneously harmed victims financially and financially sustained ransomware criminal ecosystems, making the broader threat worse for everyone.