A ransomware recovery company allegedly charged $19mn while quietly paying hackers $8mn

A federal grand jury has indicted MonsterCloud owner Zohar Pinhasi on wire-fraud charges over a ransomware-recovery business first investigated by ProPublica in 2019. Prosecutors allege that MonsterCloud told victims it could restore encrypted files with proprietary technology and without rewarding the attackers. Behind the scenes, it allegedly negotiated with the ransomware operators, bought their decryption keys and billed clients far more.

The scale makes the intermediary business visible. According to the indictment, MonsterCloud collected more than $19mn from hundreds of clients and sent more than $8mn to hackers. In one alleged transaction, it paid approximately $8,200 for a key and charged the victim $150,000. Customers were harmed first by the intrusion and then by an adviser whose supposed alternative to paying the ransom was secretly a marked-up ransom payment.

ProPublica’s earlier investigation described this as a broader industry rather than a single company’s trick. Recovery firms could present themselves as technical specialists while using the same decryptors a victim could obtain from the attacker. Insurers and consultants made payment operationally easier, helping ransomware become a service economy with negotiators, brokers and recovery vendors around the criminals. The new indictment is notable because prosecutors have adopted the factual structure the newsroom documented seven years ago.

An indictment is an allegation, not a conviction. Pinhasi was arraigned on October 7 and is entitled to contest the government’s account. It also remains true that some victims have no viable recovery path other than payment, particularly when backups fail and public services are at stake.

The policy lesson is disclosure. A recovery firm should have to state whether it intends to pay, identify the ransom and its own fee separately, document sanctions screening and preserve the client’s informed choice. The fraud risk grows when “technical recovery” is a black box and desperation prevents comparison shopping.