Iranian man pleads guilty in Robbinhood ransomware scheme

Sina Gholinejad pleaded guilty to two counts in a scheme that most visibly hit the city of Baltimore, causing $19 million in damages.

An Iranian man pleaded guilty Tuesday to participating in the Robbinhood ransomware scheme, which most notably afflicted the city of Baltimore in a costly 2019 attack.

Sina Gholinejad, 37, pleaded guilty to one count of computer fraud and abuse and one count of conspiracy to commit wire fraud. He faces up to 30 years in prison.

The indictment primarily implicates Gholinejad, also known as Sina Ghaaf, for conducting online research related to the deployment of Robbinhood, with unnamed co-conspirators carrying out other parts of the scheme.

The Robbinhood extortion scheme began in January 2019 and continued through at least March of last year, according to the indictment. 

Baltimore incurred more than $19 million in costs due to the Robbinhood attack, with other cities — Greenville, N.C., and Yonkers, N.Y., among them — also victimized. Other victims included a nonprofit and medical group.

“Gholinejad and his co-conspirators — all of whom were overseas — caused tens of millions of dollars in losses and disrupted essential public services by deploying the Robbinhood ransomware against U.S. cities, health care organizations, and businesses,” said Matthew Galeotti, head of the Justice Department’s Criminal Division.

The scheme operators set up virtual private networks and cryptocurrency wallets to receive extorted Bitcoin as part of their infrastructure, the indictment reads.

“Gholinejad and his co-conspirators attempted to launder the ransom payments through cryptocurrency mixing services and by moving assets between different types of cryptocurrencies, a practice known as chain-hopping,” according to a Justice Department news release. “They also hid their identities and activities through a number of technical methods, including the use of virtual private networks and servers that they operated.”

Authorities arrested Gholinejad in North Carolina in January.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure