[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZiViP-eXrqIBgEJes10ew7vcQfERGiQrRKvfICvgcfw":3},{"article":4,"iocs":50,"watch_terms":51,"solutions":52,"lesson":55},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"347aee89-c47b-492c-8857-1470a3d13128","Ransomware recovery CEO charged over secret ransom payments","ransomware-recovery-ceo-charged-over-secret-ransom-payments-8112fe","The owner of ransomware remediation company MonsterCloud has been charged with allegedly defrauding ransomware victims by secretly paying their attackers for decryptors while claiming to use proprietary technology to recover encrypted data. [...]","Zohar Pinhasi, owner of MonsterCloud, has been indicted on federal wire fraud charges for allegedly defrauding ransomware victims. Prosecutors claim Pinhasi's company did not use proprietary technology to recover data but instead secretly paid attackers for decryption keys, charging victims significantly more than the ransom amounts paid. The scheme allegedly facilitated over $8 million in ransom payments while charging clients more than $19 million.","Ransomware recovery CEO charged with defrauding victims by secretly paying attackers.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fransomware-recovery-ceo-charged-over-secret-ransom-payments\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2022\u002F10\u002F09\u002Fcyber-key.jpg","2026-10-07T23:04:37+00:00","2026-10-08T00:00:27.007941+00:00",8,[17,20,23,25],{"name":18,"type":19},"MonsterCloud","product",{"name":21,"type":22},"Zohar Pinhasi","threat_actor",{"name":24,"type":22},"Zack Silver",{"name":26,"type":22},"Zack Green","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":27,"icon":29,"name":30,"slug":31},null,"Ransomware","ransomware",[33,38,40,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":53,"vendors":54},[],[],{"slug":56,"title":57,"body":58,"framework_refs":59,"framework_notes":69},"ransomware-recovery-firm-defrauded-victims-by-secretly-paying-ransoms","Ransomware Recovery Firm Defrauded Victims by Secretly Paying Ransoms","MonsterCloud misrepresented its services by claiming to use proprietary decryption technology while covertly paying ransoms to attackers and marking up costs significantly — extracting over $19 million from victims for $8 million in actual ransom payments. This case highlights a critical gap in victim awareness: organizations in crisis are highly vulnerable to predatory vendors who exploit urgency and technical complexity. It also underscores the risks of engaging third-party incident response providers without proper due diligence. The scheme simultaneously harmed victims financially and financially sustained ransomware criminal ecosystems, making the broader threat worse for everyone.",[60,61,62,63,64,65,66,67,68],"NIST CSF RS.CO-5 (Coordinate with stakeholders)","NIST SP 800-61 Rev. 2 (Incident Response Planning)","CIS Control 17 (Incident Response Management)","NIST SR-6 (Supplier Assessments and Reviews)","GDPR Article 28 (Processor obligations and due diligence)","OFAC Ransomware Payment Advisory (2021)","FBI Ransomware Guidance (Victim reporting obligations)","ISO\u002FIEC 27035 (Incident Management)","ITIL Service Provider Due Diligence",{}]