Ransomware Recovery Firm Owner Charged with Fraud for Secretly Paying Attackers and Overcharging Clients
What Happened – The U.S. Department of Justice indicted Sinisa Markovic, owner of Florida‑based MonsterCloud, for wire‑fraud and conspiracy. Prosecutors allege he paid ransomware gangs on behalf of clients while billing them up to 18‑times the ransom amount, extracting more than $19 million from victims.
Why It Matters for Trust & Control Assurance
- The scheme exploited a lack of independent verification of a third‑party incident‑response provider’s methods, a classic gap that continuous vendor‑risk programs are built to close.
- Without auditable evidence of how a remediation service obtains decryption keys, organizations cannot demonstrate due‑diligence to regulators or insurers.
- The case illustrates why continuous monitoring of vendor claims and contractual controls is essential for a defensible audit trail.
Who Is Affected – Companies across all sectors that engage external ransomware‑remediation services, particularly small‑to‑mid‑size enterprises that lack in‑house incident‑response capability.
Recommended Actions
- Re‑evaluate contracts with any ransomware‑recovery or incident‑response provider; require documented proof of decryption methods and payment handling.
- Incorporate independent third‑party assessments and continuous monitoring into your vendor‑risk program to capture evidence of compliance.
- Update incident‑response playbooks to include verification steps for any external service that will interact with threat actors.
Technical Notes – The alleged fraud involved secret payments to ransomware gangs (e.g., an $8,200 payment in August 2023) and inflated client invoices (e.g., $150,000 billed for the same case). No specific vulnerability or malware was disclosed; the issue centers on fraudulent business practices within a ransomware‑remediation service. Source: Help Net Security