Overview
- A federal grand jury in the Eastern District of New York returned an indictment on Sept. 23 charging Zohar Pinhasi with one count of conspiracy to commit wire fraud and two counts of wire fraud, and he was arraigned, pleaded not guilty, and released on a $2 million bond.
- Prosecutors allege MonsterCloud lacked proprietary decryption tools and instead routinely contacted ransomware operators, paid them for decryptors, and used those keys to restore client data.
- The indictment says Pinhasi facilitated more than $8 million in ransom payments while billing customers over $19 million for recovery and remediation services.
- Prosecutors cite specific cases where small ransom payments produced much larger invoices, for example paying about $8,200 while charging roughly $150,000 and paying about $236,000 while charging about $380,000.
- U.S. and FBI officials say the scheme re-victimized clients and enriched the defendant, Pinhasi denies misleading customers, and the case could trigger legal and industry scrutiny of how incident response firms disclose payments and set fees.