Iranian Hackers Indicted in Ransomware Attacks in US, Israel, Europe

The US Justice Department has charged three Iranian nationals with allegedly trying to extort hundreds of thousands of dollars from organizations in the United States, the United Kingdom, Israel, Iran, and elsewhere, by hacking in to their computer systems and causing damage and losses and holding some systems for ransom. The indictment filed on Wednesday includes hacking attacks that began in October 2020 to the present.

The men charged in the indictment are Mansour Ahmadi, aka Mansur Ahmadi, 34; Ahmad Khatibi Aghda, aka Ahmad Khatibi, 45; and Amir Hossein Nickaein Ravari, aka Amir Hossein Nikaeen, aka Amir Hossein Nickaein, aka Amir Nikayin, 30. The indictment does not say whether the alleged hackers worked on behalf of the Iranian government, but a US Treasury Department statement said they were affiliated with the Islamic Revolutionary Guard Corps.

Ahmadi, Khatibi and Nickaein, all residents of Iran, are each charged with one count of conspiring to commit computer fraud and related activity in connection with computers; one count of intentionally damaging a protected computer; and one count of transmitting a demand in relation to damaging a protected computer. The remain at large, outside of the US. The face up to 5 years or 10 years in prison.

“The government of Iran has created a safe haven where cyber criminals acting for personal gain flourish and defendants like these are able to hack and extort victims, including critical infrastructure providers,” said Assistant Attorney General Matthew G. Olsen of the Justice Department’s National Security Division. “This indictment makes clear that even other Iranians are less safe because their own government fails to follow international norms and stop Iranian cyber criminals.”

The indicted men allegedly attacked a broad range of organizations, including small businesses, government agencies, nonprofit programs and educational and religious institutions, according to a statement from the Justice Department. Their victims also included multiple critical infrastructure sectors, including health care centers, transportation services and utility providers.