MonsterCloud Owner Accused of Billing Over $19M While Secretly Paying Ransoms to Decrypt Data
- ID
- 33123
- Status
- summarized
- Published
- 08 Oct 2026, 3:41 PM
- Fetched
- 08 Oct 2026, 5:56 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/10/monstercloud-owner-accused-of-billing.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 4.0
- Created
- 08 Oct 2026, 5:57 PM
- Tags
- Audience
- saas_foundersdevelopersit_ops
What happened
The U.S. Department of Justice charged Zohar Pinhasi (also known as Zack Silver and Zack Green), the owner-operator of Florida-based MonsterCloud, with two counts of wire fraud and one count of wire fraud conspiracy, each carrying up to 20 years in prison. Prosecutors allege MonsterCloud told ransomware victims not to pay ransoms and claimed "proprietary tools" and "advanced decryption techniques," while Pinhasi instead paid the attackers for decryptors and billed clients a fee "substantially higher" than the ransom paid — over $19M in total billing is alleged, with one August 2023 case involving an ~$8,200 ransom payment (the excerpt cuts off before the amount billed to that client).
Why it matters
If you or a client ever hires a ransomware recovery or incident-response firm, this case is a concrete vendor-diligence prompt: MonsterCloud's own site said it "sometimes resort[s] to other means" and that "all terms are disclosed in our service contract," so ask for that clause in writing and get the fee-to-actual-recovery-cost breakdown before signing. The allegation is that a vendor charged a markup over a ransom it secretly paid, so a fixed-fee or cost-transparent engagement model is the practical ask — not a promise of "proprietary decryption tools."
Discussion angle
Should incident-response firms be legally required to disclose when they pay a threat actor on a client's behalf, and would you know how to verify that claim if a small Malaysian team hired one tomorrow?