Skip to content
HACKTECH
Ransomware & extortionReported Published 3 sources

Owner of ransomware recovery firm MonsterCloud charged over undisclosed ransom payments

The US Justice Department said on 7 October 2026 that the owner of MonsterCloud, a Florida-based ransomware remediation company, had been arraigned in the Eastern District of New York on two counts of wire fraud and one count of wire fraud conspiracy. According to the indictment, the company told clients it could recover data without paying ransoms, but the owner allegedly paid the attackers for decryption keys without telling clients and charged them substantially more than the ransom. Prosecutors allege he charged clients more than $19 million and paid more than $8 million in ransom payments over the course of the scheme.

  • MonsterCloud
  • ransomware recovery
  • wire fraud
  • US Justice Department
  • vendor due diligence
  • ransom payments

What the sources report

  • The Justice Department said MonsterCloud's website cautioned clients not to pay the ransom and claimed its team specialised in recovering data without succumbing to ransom demands; Help Net Security reported the site also claimed to use advanced decryption techniques and the latest technology.
  • Prosecutors allege the owner had no special technology to decrypt data and instead paid the attackers for a decryption key; in one example from around August 2023, about $8,200 was paid to a cybercriminal and the client was charged about $150,000.
  • CyberScoop reported the alleged scheme involved hundreds of clients over a five-year period ending in 2023, with initial exploratory fees of $2,500 to $10,000.
  • The Justice Department said each of the three counts carries a maximum penalty of 20 years; CyberScoop reported the defendant pleaded not guilty in federal court in Brooklyn and was released on a $2 million bond.
  • An FBI assistant director said in the Justice Department announcement that the defendant 'claimed to fix ransomware while never remediating the underlying threat'.

What it means for your organisation

Organisations hire recovery firms when they are most exposed, and this case alleges a provider sold a no-ransom service while secretly paying attackers and, according to the FBI, never remediating the underlying threat. A payment made on a client's behalf without its knowledge takes the decision, and the legal and regulatory checks that go with it, out of the client's hands. Vet incident response and recovery vendors before an incident, and write into the contract that they must disclose any contact with, negotiation with or payment to a threat actor.

What we check

  • Review incident response retainers and vendor contracts for mandatory disclosure of any threat-actor contact, negotiation or payment.
  • Before engaging a recovery vendor, confirm it can show how it decrypts data and that any proprietary-decryption claim is backed by evidence.
  • Confirm that sanctions screening and legal sign-off are required for any payment made on the organisation's behalf.
  • Verify that remediation scope includes root-cause analysis and eradication, not only data recovery.
  • Test backup restoration so recovery does not depend on a third party's decryption claims.

Sources

Services that cover these checks

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • Threat modelling

    Facilitated workshops that map how a system or feature could be attacked before it is built or shipped. We draw the data flows with your engineers, walk them with STRIDE, rank the threats by likelihood and impact, and turn the result into backlog items and test cases your team owns.

    Duration: 2 to 5 days per system, remote or on site

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow incident response works