Decryption - GoKawiil

Ransomware recovery firm accused of paying hackers and profiting from clients' fees

The US Department of Justice has charged Zohar Pinhasi, operating MonsterCloud, with fraud for allegedly deceiving clients by claiming to decrypt files without paying ransom. Instead, the company reportedly paid hackers a portion of the fees and kept the rest, charging over $19 million in total while paying just over $8 million in ransom payments. Evidence suggests MonsterCloud used samples from ransomware operators as proof of decryption ability, despite not having proprietary tools.

techspot.com · 2026-10-08

MonsterCloud CEO Zohar Pinhasi charged with secretly paying ransomware attackers

Zohar Pinhasi, owner of Florida-based ransomware recovery firm MonsterCloud, was indicted on charges of conspiracy and wire fraud for allegedly paying cybercriminals for decryption keys while claiming to use proprietary technology. He surrendered to authorities, pleaded not guilty, and was released on a $2 million bond. Prosecutors assert that MonsterCloud's claims of decrypting data without paying ransom were false, and that the company often paid attackers directly to restore clients' files.

bleepingcomputer.com · 2026-10-07