Overview
- Zohar Pinhasi was federally indicted in the Eastern District of New York and arraigned Wednesday in Brooklyn; he pleaded not guilty and was released on a $2 million bond.
- Prosecutors say Pinhasi ran MonsterCloud from 2018 to 2023 and often paid ransomware actors for decryption keys instead of using any proprietary tools he advertised.
- The charging documents cite examples where small ransom payments — roughly $8,200 in one case and $236,000 in another — were paired with customer bills of about $150,000 and $380,000.
- He faces one count of conspiracy to commit wire fraud and two counts of wire fraud, each carrying up to 20 years in prison if convicted, and the case remains in pretrial proceedings with reports of plea talks.
- The indictment echoes a 2019 ProPublica probe and highlights risks in the opaque ransomware-response market where intermediaries can exploit victims by secretly negotiating with attackers and marking up payments.