Your Ransomware “Rescuer” Might Be Part of the Problem – BCPs from the MonsterCloud Indictment

Ransomware is not a hurricane. It is not an earthquake. It is not “weather.” It is a human-built criminal economy – and like any economy, it runs on money, incentives, and people who profit from keeping the engine running.

The September 2026 indictment of Zohar Pinhasi and his firm MonsterCloud LLC is a wake-up call for every CEO, CISO, general counsel, and incident response lead. Prosecutors allege that from 2018 to 2023, MonsterCloud billed hundreds of victim organizations more than $19 million for “proprietary” ransomware recovery – while quietly paying more than $8 million to the criminals for the decryption keys. In one documented case, an $8,200 ransom became a $150,000 invoice. (As of 2026-10-12, Pinhasi has pleaded not guilty. The case still needs to run its course in court.)

The allegations are not the most uncomfortable part. The most uncomfortable part is that the community saw this coming. Fabian Wosar’s sting was in 2016. Coveware warned about “ransomware payment mills” in 2018. ProPublica published The Trade Secret in 2019. The alleged scheme kept running until 2023. Why? Because the post-breach market – NDAs, privilege, insurance reimbursement, and victims who just want to be back online – rewarded silence.

I use my LLM “dog pack” to curate and pull together a deep-dive paper that walks through the case, the economics, and what organizations can do about it:

Anatomy of Ransomware Remediation Fraud: The MonsterCloud Indictment and the Extractive Cyber Extortion Ecosystem (v4.0)

It covers how the scheme worked (including how attackers’ free “test decryptions” were turned into fake proof of proprietary technology), why blockchain analytics alone could not see the fraud, the related DigitalMint/BlackCat and CYPFER/ShinyHunters cases, and how operations like Hive, Cronos, and Endgame show a better path.

This post is the short version – the Best Common Practices (BCPs) you can put to work this week.

Ransomware BCPs – What Your Organization Should Do Now

Peacetime Preparation (Before the Bad Day)

• Vet your incident response, recovery, and negotiation vendors now – not during the crisis. MonsterCloud captured victims through search ads when they were panicking. Have your retainers signed before you need them.
• Build your plan on established doctrine. NIST SP 800-61, NIST SP 1800-25, CISA’s #StopRansomware Guide, and the CISA KEV Catalog are free.
• Talk to your cyber insurance carrier and breach counsel ahead of time. Know the approved panel, the notification steps, and what happens if a vendor outside the panel is engaged.
• Test your backups and restoration – for real. The best defense against a predatory “rescuer” is not needing one.
• Know your free recovery resources. Check No More Ransom and ID Ransomware before engaging any commercial negotiator. Law enforcement may already hold keys (Hive: 1,300+ keys; Cronos: 1,000+ keys).

Vendor Red Flags (Walk Away If You See These)

• Guarantees of 100% recovery from modern ransomware without paying the attackers.
• “Trade secrets” or “proprietary algorithms” with no peer-reviewable technical explanation.
• Pricing tied to a percentage or multiple of the ransom demand instead of labor.
• Decrypted sample files delivered within hours on ciphers with no known flaws (that is most likely the attacker’s free test decryption).
• Aliases, personal email accounts, inflated titles, or references that do not check out.

Contracts and Payment Transparency

• No contact with the threat actor without prior written approval from the board, general counsel, and compliance.
• Separate forensics from negotiation. The firm doing root-cause analysis and restoration should be commercially independent of the firm negotiating or paying. An independent team should verify any decryptor before it runs on your network.
• Demand full payment transparency – wallet addresses, transaction hashes, exchange rates and fees with third-party receipts, and pass-through of any attacker “discounts.” No markups.
• Require documented OFAC/AML sanctions screening before any payment. Your organization carries the liability even if the vendor hides the payment.
• Keep the unedited negotiation transcripts for law enforcement.
• Two-person authorization on any payment wallet to block insider schemes like the DigitalMint/BlackCat case.

During and After an Incident

• Report to law enforcement and your National CSIRT. Prepare for the CIRCIA 72-hour incident and 24-hour ransom payment reporting rules in the US, and similar rules in Australia, the UK, and the EU.
• Ask the question before you pay: Does law enforcement already have a key for this strain?
• Feed what you learned back to the community – IOCs, attacker infrastructure, and wallets – through your ISAC, National CSIRT, and trusted peer groups. Silence protects the criminals.

You Do Not Have to Do This Alone – Join the Community

Ransomware cannot be solved by a single stakeholder, country, or organization. Criminals keep succeeding because they profit without consequence. Changing that takes persistent, coordinated, multi-stakeholder action over the long term. Two places to start:

1. FIRST’s Multi-Stakeholder Ransomware SIG

If you are looking for a safe community of peers focused on ransomware, join FIRST.org’s Multi-Stakeholder Ransomware SIG – our ransomware task force. I co-chair the group with Nadia Meichtry and Rick Logan-Stanford.

The SIG brings together FIRST teams, peer organizations, and allied efforts such as M3AAWG and APWG to work on ransomware response, mitigation, remediation, investigation, and prevention. Our work streams include:

• A “check first” ransomware resource center so organizations can find the best help in one place.
• Collective action and data analytics to measure impact, consequences, and loss – facts, not InfoSec propaganda.
• International policy recommendations that empower FIRST members to engage their own governments.
• “Giving voice” sessions with law enforcement investigators and other stakeholders about what is working and what is not.

We meet virtually and at the FIRST Annual Conference. Request to join here.

2. Shadowserver’s Free Daily Network Reports

Many of the initial entry vectors that ransomware threat actors use are visible from the outside – and the Shadowserver Foundation reports them to you every day, for free. That includes:

• Exposed and vulnerable edge devices – VPNs, firewalls, remote access, and management interfaces (many tagged with the exploited CVEs).
• Exposed services that should never be on the Internet (RDP, SMB, admin panels, and more).
• Compromised hosts calling home to sinkholed botnets, droppers, loaders, and infostealers – the stuff that comes before the ransomware.
• Special Reports from law enforcement operations, including the multiple seasons of Operation Endgame. Data seized from criminal backends (IcedID, SystemBC, Latrodectus, Rhadamanthys, and others) was shared with Shadowserver to reach 201 National CSIRTs in 175 countries and over 10,000 network owners.

Here is a practical tip: if you were not a subscriber when a Special Report went out, subscribe now and ask for the recent Special Reports. Shadowserver will regenerate them for your network at no cost.

Sign up for your network’s reports here: https://www.shadowserver.org/what-we-do/network-reporting/get-reports/

Then build it into your daily healthy cyber habits. Read the report. Fix what it shows. Every exposed system you close shrinks the space the criminals can operate in.

Prevention, Resiliency, Community Action, and Disruption – Together

These are not separate efforts. They are parts of the same community:

• Prevention – Shadowserver reports help you close the doors before the initial access brokers sell them.
• Resiliency – Peacetime vendor vetting, tested backups, and clean contracts mean you recover on your terms, not the criminals’ terms.
• Community Action – The FIRST Multi-Stakeholder Ransomware SIG connects you with peers, data, and policy work across borders.
• Disruption and Suppression – Operations like Endgame, Cronos, and Hive prove that public-private partnerships lead to seized servers, frozen crypto, arrests, and free decryption keys. Your reports, your telemetry, and your participation feed that work.

When local remediation and international disruption work together, the ransomware economy loses its fuel.

A Question Worth Asking Your Board

Your organization is probably spending money on ransomware already – insurance premiums, retainers, tools, and maybe one day a recovery invoice. How much of that spend goes to the people and infrastructure that actually take ransomware crews off the Internet?

Don’t be paralyzed. Take small actions every day:

• Read the full paper: Anatomy of Ransomware Remediation Fraud
• Review your IR and recovery retainers against the BCPs above.
• Join the FIRST Multi-Stakeholder Ransomware SIG
• Subscribe to Shadowserver’s free daily reports – and request the Operation Endgame Special Reports.

Questions or ideas? Reach out at bgreene@senki.org or connect with me on LinkedIn.