Indictments Returned On Two Iranians In Atlanta Cyberattack

ATLANTA, GA - A federal grand jury has returned an indictment charging Faramarz Shahi Savandi and Mohammed Mehdi Shah Mansouri with committing a sophisticated ransomware attack on the city of Atlanta earlier this year. This follows a similar indictment last month in Newark, N.J., charging Savandi, 34, and Mansouri, 27, both of Iran, in a 34-month-long international computer hacking and extortion scheme involving the deployment of sophisticated ransomware.

“In March 2018, a devastating ransomware attack interrupted city of Atlanta government functions and disrupted our community,” said U.S. Attorney Byung J. “BJay” Pak. “In the days following the attack, local law enforcement officials worked tirelessly to respond to the incident and collect investigative information that was passed on to our counterparts leading the groundbreaking investigation into the SamSam ransomware attacks."

The attack was executed by the use of a type of malware or “ransomware” referred to as “SamSam Ransomware,” which infected approximately 3,789 computers belonging to the city of Atlanta, including servers and workstations. Once deployed, the ransomware encrypted the files associated with each infected computer and displayed a ransom note.

According to the indictment, Savandi and Mansouri would then extort victim entities by demanding a ransom paid in the virtual currency Bitcoin in exchange for decryption keys for the encrypted data, collecting ransom payments from victim entities that paid the ransom, and exchanging the Bitcoin proceeds into Iranian rial using Iran-based Bitcoin exchangers. The indictment alleges that, as a result of their conduct, Savandi and Mansouri have collected over $6 million in ransom payments to date, and caused over $30 million USD in losses to victims.

“This investigation and subsequent indictment demonstrates the Secret Service’s commitment to safeguarding our financial institutions, our communities, our homeland,” said Kimberly A. Cheatle, Special Agent in Charge of the U.S. Secret Service, Atlanta Field Office. “The virus causing the disruption of service to the city of Atlanta was triaged by cyber investigative experts at the Secret Service in conjunction with other federal law enforcement partners."

SEE ALSO: Two Iranians Indicted For Cyberattack On Atlanta

(For more news like this, find your local Patch here. If you have an iPhone, click here to get the free Patch iPhone app; download the free Patch Android app here.)

Images FBI