Ransomware

MonsterCloud charges: how to vet a ransomware recovery firm

By Yaali. October 12, 2026, 6 min read, Ransomware, Resilience, Threat intel.

MonsterCloud's owner is charged with secretly paying ransomware gangs while billing victims $19 million. How to vet a recovery vendor, and what to check if you hired one.

US prosecutors have charged Zohar Pinhasi, 50, the owner of Florida ransomware recovery company MonsterCloud, with two counts of wire fraud and one count of wire fraud conspiracy. A grand jury in the Eastern District of New York returned the indictment on September 23. Pinhasi was arraigned in Brooklyn on October 7, pleaded not guilty and was released on a $2 million bond. Each count carries up to 20 years in prison. These are allegations and he is presumed innocent.

The indictment says MonsterCloud told ransomware victims it could recover their data without paying the criminals, then quietly paid the criminals itself. Between June 2018 and June 2023, Pinhasi allegedly billed hundreds of companies in the United States and Canada more than $19 million and paid more than $8 million in ransoms without telling them. If your organisation hired a "no ransom" recovery firm in that period, or might hire one during the next incident, the questions below are the ones to put to that firm, in writing.

How the alleged scheme worked

MonsterCloud's website told victims not to pay and claimed "advanced decryption techniques and cutting-edge technology." Prosecutors say the company had no such tool. Ransomware that uses modern encryption correctly cannot be reversed without the attacker's private key. Real decryptors exist only for families with a flaw in how they generate or store keys, and those are usually published for free.

According to the charges, the work went like this. MonsterCloud collected the ransom note and sample encrypted files from the client. Pinhasi, who also went by "Zack Silver" and "Zack Green," allegedly sent those samples to the attackers and got them back decrypted. The firm then showed the client the decrypted samples as "recovery proofs" of its own capability. Once the client signed for full recovery, the firm paid the ransom, received the attacker's decryption key and had employees run it against the client's files.

In one example from August 2023, Pinhasi allegedly paid a criminal about $8,200 and charged the client about $150,000, roughly 18 times the ransom. Across the scheme, the gap between more than $19 million billed and more than $8 million paid is about $11 million.

The indictment also cites the firm's marketing. Some testimonials on its website came from paid promoters, and in May 2019 Pinhasi allegedly wrote to one of them: "Monstercloud doesn't hold any Proprietary technology [to] decrypt the ransomware data." That same year, a ProPublica investigation reported that MonsterCloud paid ransoms without telling clients, including police departments and local governments. Pinhasi denied lying then and called his methods a trade secret.

Why this hurts victims twice

Beyond the overcharge, the client is left with a false record. A victim told "we recovered your data without paying" may tell its board, insurer and regulators that no ransom was paid, which may now be untrue. And as the FBI's James Barnacle put it, Pinhasi allegedly "claimed to fix ransomware while never remediating the underlying threat." A firm whose real skill is buying keys may never find the stolen credential or backdoor that let the attacker in.

There is also a sanctions problem. The US Treasury's Office of Foreign Assets Control (OFAC) said in its September 21, 2021 advisory that companies which pay ransoms on behalf of victims, naming digital forensics and incident response firms and cyber insurers, may violate sanctions rules if the money reaches a sanctioned person or country. OFAC enforces on strict liability: a company can be held civilly liable even if it did not know the recipient was sanctioned. A victim that never knew a payment was made had no chance to screen it, report it or seek the mitigation OFAC offers.

What to demand from a recovery vendor

Before you sign, put these answers in the contract or statement of work.

1. Will you contact the threat actor? If yes, the vendor must tell you before every contact and get written approval for any payment.
2. How exactly do you decrypt? Ask for the ransomware family, the name of the decryptor and where it comes from. If they claim their own tool, ask which flaw in that family it exploits. Check the family yourself on No More Ransom (nomoreransom.org), the free decryptor portal run by Europol and security companies.
3. Where did the "proof" come from? A decrypted sample file proves someone holds the key. It does not prove the vendor does. Ask whether the samples went to the attacker.
4. Itemised invoices. Require any ransom to be a separate pass-through line with the amount, the cryptocurrency, the wallet address, the transaction hash and the date. Service fees go on separate lines.
5. Sanctions screening. Require a written record of OFAC screening of the threat actor and wallet before any payment, and the vendor's sanctions compliance policy.
6. Law enforcement reporting. OFAC treats a complete, early report to the FBI, the Internet Crime Complaint Center (IC3), CISA or the Secret Service as a significant mitigating factor, and says license requests for ransom payments face a presumption of denial. Decide who files that report and when.
7. Root cause. The engagement must include finding and closing the initial access path, with a written report.

Bring in your insurer and outside counsel early. Many cyber policies name approved incident response firms, and counsel can keep the investigation under privilege.

If you already used one

If you hired MonsterCloud or any "no ransom" recovery firm, work through this:

• Pull the contract, invoices, statements of work and all email with the vendor. Compare the invoice against what a ransom for that incident would have cost. An invoice many times larger than a typical demand with no technical deliverables is worth questioning.
• Ask the vendor in writing whether any payment went to the attacker, how much, when and to which wallet. Keep the reply.
• If a payment may have been made, talk to counsel about telling OFAC and your insurer, and about correcting any statement you made to regulators or your board that no ransom was paid.
• Report the incident and the vendor's conduct to the FBI through IC3 (ic3.gov) if you have not already.
• Check that the original intrusion was closed. Look for accounts created during the incident window, remote access tools such as AnyDesk or ScreenConnect installed outside change control, scheduled tasks and services added around the encryption date, and VPN logins from unknown addresses. Reset domain admin and service account passwords and reset the KRBTGT account twice if that was never done.

The wider lesson

Pick your incident response vendor before you need one, while you have time to read contracts. A retainer agreed in advance, with payment approval, sanctions screening and invoice terms already settled, means nobody is choosing a vendor from a search result while the file servers are encrypted.

Our security operations team can sit on your side during an incident and check what any outside vendor tells you, and our compliance and audit readiness work covers incident response retainers and payment decision policies. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: Help Net Security, US Department of Justice, Eastern District of New York, BleepingComputer, CyberScoop, The Record, The Stack, OFAC updated advisory on ransomware payments, September 21, 2021.