[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDtjSC3F-VcrHK0TIvUAKUQCUI1836J-Zi5SbfoRrNz0":3},{"article":4,"iocs":50,"watch_terms":54,"solutions":55,"lesson":58},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"347eca2f-f96f-4ffa-bb39-8de4f81095de","Ransomware recovery CEO indicted after allegedly paying hackers and pocketing millions","ransomware-recovery-ceo-indicted-after-allegedly-paying-hackers-and-pocketing-mi-08b122","Zohar Pinhasi allegedly deceived ransomware recovery clients into a payment scheme disguised as a specialized service that helped victims avoid paying cybercriminals. The post Ransomware recovery CEO indicted after allegedly paying hackers and pocketing millions appeared first on CyberScoop.","Zohar Pinhasi, owner of MonsterCloud, has been indicted for allegedly defrauding hundreds of clients who were victims of ransomware attacks. He claimed to have proprietary tools for data recovery but instead secretly paid cybercriminals, charging clients inflated fees. Over five years, Pinhasi allegedly collected over $19 million and paid out more than $8 million in ransoms.","Ransomware recovery CEO indicted for defrauding clients and pocketing millions.","https:\u002F\u002Fcyberscoop.com\u002Fmonstercloud-zohar-pinhasi-ransomware-recovery-scheme\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F10\u002FGettyImages-1197779904.jpg","2026-10-08T19:44:29+00:00","2026-10-08T20:00:16.884981+00:00",8,[17,20,23,25],{"name":18,"type":19},"cybercriminals","threat_actor",{"name":21,"type":22},"MonsterCloud","product",{"name":24,"type":19},"Zack Silver",{"name":26,"type":19},"Zack Green","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":27,"icon":29,"name":30,"slug":31},null,"Ransomware","ransomware",[33,38,40,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[51],{"type":52,"value":21,"context":53},"malware","Name of the ransomware remediation company operated by the indicted CEO.",[21],{"controls":56,"vendors":57},[],[],{"slug":59,"title":60,"body":61,"framework_refs":62,"framework_notes":72},"ransomware-recovery-firm-ceo-indicted-for-secretly-paying-hackers-and-defrauding-clients","Ransomware 'Recovery' Firm CEO Indicted for Secretly Paying Hackers and Defrauding Clients","MonsterCloud's CEO allegedly exploited ransomware victims at their most vulnerable moment, posing as a legitimate recovery firm while secretly paying ransoms and pocketing the difference. This case exposes a critical blind spot: organizations under attack often lack the expertise to verify vendor claims or audit remediation activities. The fraud persisted for five years across hundreds of clients, illustrating how crisis conditions can suppress normal due diligence. This matters because victims not only suffered financial harm but may have inadvertently funded criminal ransomware operations, potentially violating OFAC sanctions regulations. Trust in third-party incident responders must be earned through transparency and verifiable credentials, not just marketing claims.",[63,64,65,66,67,68,69,70,71],"NIST SP 800-61 Rev. 2 – Incident Response Planning (Section 2.3: IR Team Structure & Vendor Selection)","NIST CSF RS.CO-5 – Voluntary information sharing with external stakeholders","CIS Control 17 – Incident Response Management","NIST SP 800-53 IR-4 – Incident Handling","OFAC Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (Oct 2020)","FTC Act Section 5 – Prohibition on Unfair or Deceptive Business Practices","ISO\u002FIEC 27035 – Information Security Incident Management","GDPR Article 28 – Processor obligations (due diligence on third-party data handlers)","ITIL 4 – Vendor and Contract Management Practice",{"NIST SP 800-53 IR-4 – Incident Handling":73,"CIS Control 17 – Incident Response Management":74,"ITIL 4 – Vendor and Contract Management Practice":75,"ISO\u002FIEC 27035 – Information Security Incident Management":76,"FTC Act Section 5 – Prohibition on Unfair or Deceptive Business Practices":77,"NIST CSF RS.CO-5 – Voluntary information sharing with external stakeholders":78,"GDPR Article 28 – Processor obligations (due diligence on third-party data handlers)":79,"OFAC Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (Oct 2020)":80,"NIST SP 800-61 Rev. 2 – Incident Response Planning (Section 2.3: IR Team Structure & Vendor Selection)":81},"Incident handling procedures should define how ransom decisions are made and verified.","Incident response management includes selecting trusted partners in advance.","Vendor management practices help verify claims and contracts of recovery firms.","Incident management standards support structured vendor selection and oversight.","Deceptive practices by recovery firms fall under consumer protection law.","Sharing information with authorities and peers helps expose fraudulent recovery firms.","Due diligence on third parties handling data is required when recovery firms access victim systems.","OFAC guidance warns that paying ransoms can carry sanctions risk, relevant when vendors pay secretly.","Incident response planning should include vetting recovery vendors before an attack, so victims are not exploited in a crisis."]