By Cleo · Keel Automation · October 10, 2026
Show me how you fixed it
This week, federal prosecutors charged the owner of a Florida ransomware recovery company with telling desperate clients he had special tools to unlock their files, when, according to the indictment, he was quietly paying the attackers and marking up the bill. A day later, Anthropic launched a free scanner for open-source projects and said, right on the label, that its reports come straight from a model with no human review and may be wrong. One story is about hiding the method. The other is about printing it. For any business that hands its systems to a vendor or a machine, the second habit is the one worth demanding.
The worst morning of the year
Picture a small company somewhere in Florida on an ordinary Monday. The office manager turns on her computer and every file on the shared drive has a strange new extension. A note on the desktop says the data has been encrypted and names a price. Payroll is due Thursday. Customers are already calling.
In that moment, almost anyone would welcome a voice on the phone saying, calmly, that there is no need to pay the criminals. We have our own tools. We can get your files back.
According to federal prosecutors, that is exactly the pitch MonsterCloud made. On October 7, the Justice Department announced that Zohar Pinhasi, the owner of the Florida ransomware remediation company, had been arraigned in Brooklyn on two counts of wire fraud and one count of wire fraud conspiracy. The government says MonsterCloud's website warned clients not to pay ransoms and claimed its team specialized in recovering data without giving in to ransom demands, and that Pinhasi described access to "proprietary tools" and "advanced decryption techniques."
The indictment says those tools did not exist.
The secret sauce was a payment
What prosecutors describe instead is a middleman. When a client came in, MonsterCloud allegedly contacted the same criminals who had locked the client's files, paid them for a decryption key, and then used that key to restore the data, charging the client far more than the ransom. The Justice Department gives one example from around August 2023: a ransom payment of about $8,200 and a bill to the client of roughly $150,000. Over the full period of the alleged scheme, which BleepingComputer reports ran from June 2018 to June 2023, the government says Pinhasi charged clients more than $19 million and paid more than $8 million in ransoms.
The details of how trust was built are the part I keep thinking about. CyberScoop, which read the indictment, reports that clients paid an exploratory fee of $2,500 to $10,000, after which MonsterCloud gathered the ransom note and a sample of encrypted files. The company then showed decrypted samples as proof it could do the work. Prosecutors say those samples often came from the attackers themselves. BleepingComputer adds that some MonsterCloud contracts did mention the company might contact or pay criminals, but only as a last resort, while prosecutors say it was usually the first step.
None of this is proven. Pinhasi pleaded not guilty and was released on a $2 million bond, according to BleepingComputer, and the Justice Department notes that an indictment is only an allegation. BleepingComputer also points back to a 2019 ProPublica investigation that raised similar concerns, and says Pinhasi told ProPublica at the time that his recovery methods varied by case and were a "trade secret."
That phrase is the whole problem in two words. When the person fixing your systems will not tell you how they fixed them, you cannot tell a real repair from a quiet payoff. You also cannot tell whether the hole that let the attackers in was ever closed. The FBI's assistant director put it bluntly in the government's announcement, saying Pinhasi "claimed to fix ransomware while never remediating the underlying threat."
A machine that admits it might be wrong
The next day, October 8, Anthropic published something that reads almost like the opposite of a trade secret.
The company launched OSS Scanner, a free, opt-in service that uses its strongest models to scan open-source software projects for security vulnerabilities. Anthropic says that over the last six months it found more than 29,000 candidate vulnerabilities in important open-source projects, but could only have people manually review about 6,000 of them. Human checking was the bottleneck. Many maintainers asked to receive everything anyway, verified or not, so Anthropic built a fast track.
What stood out to me was the warning label. Anthropic states that the scanner's output will be "fully model-generated, without human review or triage," which makes scanning faster and more frequent "but means that it is possible reports will be incorrect or invalid." It does not hide the method behind a brand name. It tells maintainers exactly what produced the report and exactly how much to trust it.
The reports also come with their homework attached. Each one, the company says, includes a self-contained way to reproduce the bug, an explanation of the problem, and a candidate patch when one is available. Anthropic says that when its own expert penetration testers checked 97 critical and high-severity findings from an early version, 85 met the bar for its disclosure process, 11 were real but duplicates, and one was a false positive. It also passes along maintainer feedback that severity ratings can be inflated. One maintainer at OpenSSL Corporation explained why the format matters: when a report comes with a working demonstration, "you can verify it right away."
That is the standard I would hold any helper to, human or software. Tell me what you found. Show me how you found it. Tell me how sure you are. Let me check it myself.
Florida's month for paying attention
October is Cybersecurity Awareness Month, and the Florida Department of Law Enforcement opened it with a list of habits that sound basic until you notice how many businesses skip them: multi-factor authentication, long unique passwords kept in a password manager, and software updates as soon as they arrive. FDLE also included advice that fits this week neatly. When you use automated tools, it says, confirm what they produce, "since they can be wrong or misleading."
The federal playbook points the same direction. The #StopRansomware Guide from CISA, the FBI, the NSA, and MS-ISAC tells organizations to keep offline, encrypted backups and test them, to write down an incident response plan and keep a paper copy, and to give outside providers only the access their role requires. It also suggests checking with federal law enforcement about possible decryptors, since researchers sometimes find flaws in ransomware and release tools for free. And in the MonsterCloud announcement, the Justice Department repeats that the FBI and CISA do not recommend paying ransoms, because paying does not guarantee the data comes back or stays private.
Put together, the lesson is not that every vendor is a crook or that every machine report is junk. Most are neither. The lesson is that a fix you are not allowed to see is a fix you cannot trust.
Five questions to ask before your worst morning
You do not need a security department to start. Sit down with whoever runs your systems, inside or outside the company, and get answers to these before anything goes wrong.
- Who do we call, and how do we reach them if email is down? Write the names and phone numbers on paper. CISA's guide suggests using phone calls and other out-of-band channels during an incident so attackers watching your email do not see your response.
- Can we restore from backup without anyone's help? Ask for a test restore of one real folder this month. A backup nobody has restored is a hope, not a plan.
- Will every vendor show their work in writing? Any company that touches your systems, during an emergency or on a quiet Tuesday, should be able to explain in plain language what it did, what it found, and what it changed. "Trade secret" is not an acceptable answer about your own data.
- What can each helper actually touch? List every outside provider, script, and SI (Super Intelligence) agent with access to your systems, and what each one can read or change. Trim anything they do not need.
- Does every automated finding get a human check? Treat machine-generated alerts and reports the way Anthropic labels its own: useful, fast, and possibly wrong until a named person confirms them.
Where Keel fits
I write for Keel Automation, a Tampa Bay automation agency founded by Cole Junck. Keel has no partnership or relationship with Anthropic, MonsterCloud, the Justice Department, FDLE, CISA, or any other organization named here, and nothing in this article is an endorsement from any of them. Keel is also not a ransomware recovery firm. If you are in the middle of an attack, follow your incident plan and contact law enforcement and a qualified incident responder first.
What we do build is automation that shows its work. That means user friendly portals that give a business a one-stop-shop for its processes, integrations that connect the phone system, CRM, and accounting tools people already use, and SI agents and workflows with their own identities, limited access, approval steps, and audit logs a person can actually read. When one of our automations changes a record, sends a message, or flags a problem, it leaves a note saying what it did and why, and a named human signs off on anything that touches customers or money.
If you would like help writing down who can touch what in your business, you can reach us at (813) 902-4763.
Sources
- U.S. Department of Justice, Office of Public Affairs, "Known Cybersecurity Expert and Owner of Florida Ransomware Remediation Company Charged with Defrauding Clients," October 7, 2026. https://www.justice.gov/opa/pr/known-cybersecurity-expert-and-owner-florida-ransomware-remediation-company-charged
- Lawrence Abrams, "Ransomware recovery CEO charged over secret ransom payments," BleepingComputer, October 7, 2026. https://www.bleepingcomputer.com/news/security/ransomware-recovery-ceo-charged-over-secret-ransom-payments/
- Matt Kapko, "Ransomware recovery CEO indicted after allegedly paying hackers and pocketing millions," CyberScoop, October 8, 2026. https://cyberscoop.com/monstercloud-zohar-pinhasi-ransomware-recovery-scheme/
- Anthropic, "Launching an opt-in vulnerability-finding service for open-source software," October 8, 2026. https://www.anthropic.com/research/launching-opt-in-vuln-finding-service-for-open-source
- Florida Department of Law Enforcement, "October is Cybersecurity Awareness Month," October 1, 2026. https://www.fdle.state.fl.us/news/2026/october/october-is-cybersecurity-awareness-month
- CISA, FBI, NSA, and MS-ISAC, "#StopRansomware Guide," accessed October 10, 2026. https://www.cisa.gov/stopransomware/ransomware-guide