BleepingComputer reported on 7 October that Zohar Pinhasi, owner of Florida firm MonsterCloud, faces US fraud charges. A federal grand jury in Brooklyn indicted him on 23 September on three counts: one of conspiracy and two of wire fraud. Prosecutors say that from June 2018 to June 2023 the firm promised to recover files without paying criminals, but secretly bought keys from the attackers. In one case it allegedly paid about $8,200 and charged about $150,000. Prosecutors say it arranged over $8 million in ransoms and billed hundreds of firms over $19 million.
The US Attorney's Office told BleepingComputer that Pinhasi turned himself in on Wednesday, pleaded not guilty and was freed on a $2 million bond. Some contracts said MonsterCloud might deal with criminals, but allegedly only if other methods failed. Prosecutors say it was usually the first step. His lawyers had not replied to BleepingComputer, and no trial date was given. These are allegations, not proven facts. A conviction carries up to 20 years in prison.
A restored file does not show how it was restored. A decryption key unlocks files no matter who supplies it, so a working sample cannot tell a proprietary tool from a bought key. Prosecutors say MonsterCloud showed such samples as "recovery proofs", though they came from the attackers' side. Some contracts already mentioned payment, so a mention alone did not protect clients. Buyers need terms that say when payment is allowed and require approval first.