U.S. indicts two over SamSam ransomware attacks that hit Atlanta, other cities

The indictment includes notable cases like the attacks on the city of Atlanta, the city of Newark and the Port of San Diego.

The Department of Justice unsealed indictments Wednesday against two Iranian men for conducting ransomware attacks against more than 200 organizations inside the United States, including municipalities, government agencies and hospitals.

Prosecutors say that Faramarz Shahi Savandi, 34, and Mohammad Mehdi Shah Mansouri, 27, used SamSam ransomware to lock the victims’ systems and demand bitcoin in order to decrypt their data. Savandi and Masouri racked up more than $6 million in ransom payments and caused more than $30 million in damages, according to the indictment issued by a grand jury in New Jersey.

SamSam’s damage has been a public ordeal. The indictment includes notable cases like the attacks on the city of Atlanta, the city of Newark, the Port of San Diego, the Colorado Department of Transportation, and others. Six of the victims were health care-related organizations, prosecutors said.

“Many of the victims were public agencies with missions that involve saving lives and performing other critical missions for the American people,” Deputy Attorney General Rod Rosentstein said at a press conference Wednesday.

Rosentstein said the defendants, acting from inside Iran over the past three years, “gained access to victims’ computers by exploiting cybersecurity weaknesses” in order to install the ransomware. The indictment alleges that they used tools like the Tor network to anonymize their activity.

Rosenstein took the opportunity to dig at the use of popular of encryption services, saying that it makes criminal investigations more challenging.

“Sophisticated encryption technologies like the Tor network are used by cybercriminals to commit serious offenses. Those sophisticated technologies pose a real threat to the government’s ability to keep people safe and to ensure the criminals and terrorists are caught and brought to justice,” Rosenstein said.

Authorities say that that Savandi and Mansouri was deliberately targeted. Brian Benczkowski, the assistant attorney general in charge of DOJ’s criminal division, cited the 2016 SamSam attack on the Kansas Heart Hospital.

“According to the indictment, the defendants conducted online searches concerning the hospital and access its website a few days before the attack,” Benczkowski said. “These defendants didn’t just indiscriminately cross their fingers and hope their ransomware randomly compromised just any computer system. Rather, they deliberately engaged in an extreme form of 21st century digital blackmail attacking and extorting vulnerable victims like hospitals and schools, victims they knew would be willing and able to pay.”

The whereabouts of the defendants is not clear, but indictments against foreign-based defendants often makes it difficult for them to travel because of the extradition risk.

“Publicly revealing this nefarious hacking scheme will make it harder for the perpetrators and others like them to do business in the future. As a result of the indictment, these defendants are now fugitives from American justice,” Rosenstein said.

You can read the full indictment below.

[documentcloud url=”http://www.documentcloud.org/documents/5316844-Savandi-and-Mansouri-Indictment-11-26-18-2-0.html” responsive=true sidebar=false]

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure