The indictment, filed by a grand jury in the Eastern District of New York on Sept. 23, charged Pinhasi with two counts of wire fraud and a conspiracy charge. The court papers say he used MonsterCloud’s website to promise clients a proprietary decryption solution, while actually paying attackers.
Prosecutors detail an August 2023 episode in which Pinhasi allegedly paid $8,200 to a hacker for a decryption key and billed a client $150,000 for the service, marking a markup of more than 1,800 percent. The DOJ’s Computer Crime and Intellectual Property Section said a paid spokesperson in May 2019 confirmed that MonsterCloud lacked any proprietary decryption tools.
U.S. Attorney Robert W. Heller, speaking on condition of anonymity, said the scheme “is a clear example of fraud that exploits the desperation of ransomware victims.” The FBI’s New York field office is co‑investigating, and the case has been flagged as a high‑priority cyber‑crime investigation.
If convicted, each wire‑fraud count carries up to 20 years in prison, and the conspiracy charge adds another potential 20 years. The DOJ plans to seek a pre‑trial order on the case, and the federal court is slated to hear arguments in January 2025.
One client, a mid‑size manufacturing firm in Brooklyn, reported that its data remained inaccessible after paying MonsterCloud’s $150,000 fee, a claim that the firm says the company never fulfilled.
The trial will test the limits of federal fraud law against the rapidly evolving ransomware market, and a verdict could set a precedent for how cybersecurity firms are regulated.