MonsterCloud Owner Charged with $19M Wire Fraud for Secret Ransom Payments to Threat Actors

Pinhasi marketed MonsterCloud as possessing proprietary decryption tools that avoided ransom payments, directing victims away from direct negotiations. In documented instances he paid threat actors $8,200 and $236,000 respectively, then invoiced the same clients $150,000 and $380,000. Total alleged overbilling exceeds $19 million across multiple incidents between 2021 and 2023.

Court filings cite MonsterCloud's own website language claiming advanced techniques while internal records show repeated direct payments to perpetrators. The scheme re-victimized organizations already under ransomware pressure by layering inflated service fees atop the original extortion. This matches patterns seen in prior incident-response contractor disputes where disclosure obligations were evaded.

The case exposes systemic opacity in the ransomware response market, where clients lack visibility into whether recovery stems from technical capability or negotiated settlements. Procurement records and service contracts rarely require line-item ransom accounting, enabling margin inflation that erodes institutional trust in third-party defenders.

EDNY prosecutors will seek asset forfeiture and trial is scheduled within 12 months; parallel civil suits from affected clients are expected to surface additional billing records.