Fake Ransomware “Rescue” Firm Allegedly Took Millions

U.S. prosecutors say the owner of MonsterCloud told ransomware victims he could recover data with proprietary tools and avoid paying criminals, but instead allegedly paid the ransom and charged clients far more. The scheme reportedly used a paid “analysis” step where clients shared the ransom note and encrypted files, then were shown “proof” that recovery was possible. Authorities say this re-victimized organizations already hit by ransomware.

Key findings

• Prosecutors allege MonsterCloud claimed to use “specialized, proprietary tools” to decrypt files without paying criminals, but “no such tool existed.”
• The owner allegedly used client fees to pay cybercriminals while not telling clients that ransom payments were made on their behalf.
• Clients were allegedly drawn in with an initial “exploratory fee” ($2,500–$10,000), then asked for the ransom note and samples of encrypted files.
• Prosecutors say “proof” of decryption was sometimes obtained by sharing samples with the ransomware actors and getting decrypted samples back.
• An example cited: a client was charged about $150,000 while an alleged ransom payment was about $8,200.
• The accused allegedly used aliases (“Zack Silver” and “Zack Green”) in communications with cybercriminals.

Who’s being targeted

• Commonly targeted roles: IT, Security/Incident Response, Procurement/Vendor Management, Legal/Compliance, Finance (approving emergency payments), Executive leadership.
• Affected industries: Multiple industries (ransomware victims across the U.S. and Canada; not specified).
• Attack channels: website.
• Impersonated: Third-party ransomware remediation / data recovery firm.

Awareness takeaways

• Treat “ransomware recovery” vendors as high-risk during crises: require written disclosure and approval for any contact with criminals and any ransom payment (direct or indirect).
• Be cautious of vendors who use a paid ‘analysis’ step to collect ransom notes and encrypted file samples, then claim this proves they have proprietary tools.
• Insist on transparency about how ‘proof of decryption’ was obtained and whether any third party (including the attacker) was involved.
• Train incident leaders to watch for crisis-time profiteering, attackers aren’t only the ransomware gang; opportunistic ‘helpers’ may exploit urgency and fear.

Red flags to watch for

• Guarantees decryption/restore without clearly explaining method or limits
• Requests upfront fees before transparent scope and disclosure of whether negotiation/payment may occur
• Provides “proof” of decryption without disclosing third-party involvement or the exact source of decrypted samples