Loading story…
U.S. prosecutors charged MonsterCloud owner Zohar Pinhasi with allegedly defrauding ransomware victims by claiming his company recovered encrypted files using proprietary technology without paying attackers. According to the indictment, the Florida company instead secretly purchased decryptors from ransomware operators between June 2018 and June 2023, using clients’ fees to fund ransom payments while retaining substantial markups. Prosecutors allege MonsterCloud charged hundreds of businesses in the United States and Canada more than $19 million for recovery and remediation services and facilitated more than $8 million in ransom payments.
In one alleged instance, MonsterCloud charged a client $150,000 to resolve an $8,200 ransom demand. Pinhasi faces two counts of wire fraud and one count of wire fraud conspiracy, each carrying a potential 20-year prison sentence if convicted. He pleaded not guilty and was released on a $2 million bond. The FBI is investigating, and the indictment alleges participation by employees, contractors and other co-conspirators. A 2019 ProPublica investigation previously raised similar concerns, which Pinhasi disputed. Organizations hiring ransomware recovery providers should require explicit disclosure of any attacker negotiations or payments and independently verify claims of proprietary decryption capabilities.
See the reporting duties and controls this puts on the clock.
7 events from the most recent confirmed update back to the earliest known activity.
According to the U.S. Attorney's Office, Pinhasi surrendered on Wednesday and was arraigned in federal court in Brooklyn. He pleaded not guilty and was released on a $2 million bond.
A federal grand jury in the Eastern District of New York indicted Pinhasi on September 23 on one count of conspiracy to commit wire fraud and two counts of wire fraud. The charges concern alleged deception of ransomware victims seeking MonsterCloud's recovery services.
In an August 2023 case, Pinhasi allegedly paid approximately $8,200 to a ransomware threat actor and billed the MonsterCloud client approximately $150,000.
In May 2019, a paid MonsterCloud spokesperson questioned Pinhasi about the company's business practices and decryption software. According to the indictment, Pinhasi acknowledged that MonsterCloud did not possess proprietary technology to decrypt ransomware-encrypted data.
A 2019 ProPublica investigation reported that MonsterCloud sometimes paid ransomware operators while presenting itself as an alternative to paying attackers. Researchers posing as victims traced ransom-payment offers to recovery firms, including MonsterCloud, using attacker email addresses they controlled.
Prosecutors allege that from June 2018 through June 2023, Zohar Pinhasi and co-conspirators secretly bought ransomware decryptors while claiming to use proprietary recovery technology. The alleged scheme collected more than $19 million from hundreds of U.S. and Canadian companies and facilitated more than $8 million in ransom payments.
Pinhasi denied misleading customers and disputed that MonsterCloud had promised decryption in advance. He described the company's case-dependent recovery methods as a trade secret.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
7 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcehelpnetsecurity.com
Open sourcethehackernews.com
Open sourcejustice.gov
Open sourcetheregister.com
Open sourcebleepingcomputer.com
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. prosecutors said **Evgenii Ptitsyn**, a 43-year-old Russian national described as an administrator/leader behind the **Phobos** ransomware operation, pleaded guilty to **wire fraud conspiracy** tied to a global ransomware-and-extortion scheme. Court filings and DOJ statements cited in reporting say Phobos and its affiliates victimized **more than 1,000 organizations** worldwide and extorted **over $39 million**, with victims including U.S. healthcare providers, hospitals, educational institutions, and other essential services. Ptitsyn was arrested in **South Korea** and later extradited to the United States; he faces a **maximum of 20 years** in prison. Authorities described Phobos as an affiliate-driven operation in which administrators developed and distributed the ransomware, coordinated sales via a **darknet site**, and advertised services on criminal forums/messaging platforms, while affiliates typically gained access to victim networks—often using **stolen credentials**—to steal and encrypt data and then demand payment for decryption. Reporting also described a fee/revenue model in which affiliates paid administrators for **unique decryption keys** and administrators took a cut of proceeds; Ptitsyn agreed to forfeit **$1.77 million** and pay at least **$39.3 million** in restitution. Additional context in coverage linked Phobos to related activity (including the **8Base** strain) and noted prior law-enforcement actions against other alleged members, as well as the release of a **free Phobos decryption tool** by Japanese authorities.
Jun 29, 2026
U.S. authorities secured guilty pleas in two separate cyber-enabled criminal cases: a Ghana-based fraud ring that stole more than **$100 million** via **business email compromise (BEC)** and romance scams, and a **Phobos** ransomware administrator tied to a global extortion operation. The cases highlight parallel monetization paths—social engineering and payment redirection in BEC/romance schemes versus data encryption and extortion in ransomware-as-a-service (RaaS)—and both involve international arrests/extraditions to the United States. In the fraud case, **Derrick Van Yeboah** (40) pleaded guilty to conspiracy to commit wire fraud and agreed to pay **over $10 million** in restitution for his role in a Ghana-based operation that targeted U.S. victims from 2016 to May 2023, using spoofed emails to impersonate customers/employees and laundering proceeds through U.S. intermediaries before sending funds to coordinators in West Africa. Separately, **Evgenii Ptitsyn** (43) pleaded guilty to wire fraud conspiracy for helping develop, sell, distribute, and operate the **Phobos** ransomware platform, which the U.S. DoJ says hit **1,000+** entities and extorted **$16+ million**; he was arrested in South Korea in 2024, extradited to the U.S., and faces up to **20 years** in prison, with sentencing scheduled for July 15.
Jun 29, 2026
Three former employees of cybersecurity firms DigitalMint and Sygnia have been indicted for orchestrating a series of BlackCat (ALPHV) ransomware attacks against five U.S. companies between May and November 2023. The accused, including Kevin Tyler Martin and Ryan Clifford Goldberg, allegedly abused their positions as incident response professionals to gain unauthorized access to victim networks, deploy ransomware, steal sensitive data, and demand cryptocurrency ransoms ranging from $300,000 to $10 million. The Department of Justice and FBI state that the group operated as BlackCat affiliates, with at least one successful extortion resulting in a $1.27 million payment from a Tampa medical device manufacturer after its servers were encrypted. The indictment details additional targets, including a Maryland pharmaceutical company, a California doctor's office, a California engineering firm, and a Virginia drone manufacturer, though it is unclear if further ransom payments were made. DigitalMint and Sygnia have both denied organizational involvement, terminated the implicated employees, and are cooperating with law enforcement. The case highlights the risk of insider threats within cybersecurity firms and the sophisticated tactics used by ransomware operators to exploit trusted access for criminal gain.
Jun 29, 2026