The man advertised his bomb threat "services" through a major so-called "Dark Web" marketplace recently shutdown by the Justice Department, according to court records.
Michael Kadar, a dual American-Israeli citizen, was arrested in March and later charged
for his alleged involvement in the wave of bomb and active shooter threats that rattled Jewish community centers, schools and other institutions across the United States and abroad.
Federal authorities said in April that their investigation was ongoing, and unsealed court records -- first noted on Twitter
by Seamus Hughes, deputy director of the Program on Extremism at George Washington University -- now claim that Kadar was running an online threat-for-hire service and show prosecutors may try to pursue criminal charges against one of his buyers.
"That ongoing investigation has identified a suspect believed to have ordered and paid for at least [sic] of the bomb threats made by Kadar," federal prosecutors explained in one court filing. "The FBI and local authorities in California intend to pursue criminal charges against the suspect."
The Justice Department declined to comment on the investigation.
Kadar's attorney was not immediately reached for comment.
New details on Kadar's "possible co-conspirators" only came to light in July after a federal judge in Washington agreed to unseal the search warrant application describing how the FBI reviewed emails, call records and other images found on a thumb drive found among his belongings at home. Federal prosecutors explained in the court filing that authorities needed the warrant unsealed because they may now need it to pursue the California suspect.
The FBI warrant also provides a glimpse into how federal authorities believe Kadar marketed his services on AlphaBay -- a massive underground marketplace shutdown
in July, which Attorney General Jeff Sessions called "likely one of the most important criminal investigations of the year."
Authorities described uncovering on Kadar's thumb drive an AlphaBay advertisement for a "School Email Bomb Threat Service," posted by a vendor believed to be Kadar, offering to email a bomb threat to a school for $30 and adding another $15 to "frame someone for it," according to the search warrant.
At least one user posted the following feedback on the vendor's profile: "Amazing on time and on target. We got evacuated and got the day cut short."
The date and time stamp of the user's posting matched media reports about the evacuation of a school in March, according to the warrant.
The public court docket shows the search warrant -- which sought permission to employ a remote search of computer servers hosting the AlphaBay's market and certain vendor accounts -- was executed in the spring.
While prosecutors have not alleged that any of Kadar's threats were carried out, the federal complaints against him in the US say that the calls and emails prompted evacuations or lockdowns of the targeted facilities.
Kadar remains in custody in Israel pending trial.