Iranian Man Pleads Guilty to Role in Baltimore Ransomware Attack

An Iranian national has admitted in US federal court that he helped run the Robbinhood ransomware crew behind a series of extortion attacks that crippled city halls, hospitals and private companies across the country. 

The Justice Department said Sina Gholinejad pleaded guilty on Tuesday to computer-fraud and wire-fraud-conspiracy charges, acknowledging that he and unnamed partners broke into dozens of networks, locked up data with the Robbinhood malware and demanded Bitcoin ransoms. 

Gholinejad faces as much as 30 years in prison when he is sentenced in August.

Robbinhood’s best-known hit was the May 2019 attack on Baltimore that forced the city to disconnect hundreds of PCs and knocked out online payment portals for water bills, property taxes and parking tickets. 

The city of Baltimore ultimately spent more than $19 million on recovery and lost revenue; additional Robbinhood ransomware victims were also reported in North Carolina, Oregon, New York and New Jersey. 

Prosecutors say the Robbinhood gang worked like a modern ransomware-as-a-service shop with operations dating back to early 2019. Ransom notes left behind at infected organizations steered victims to Tor-hosted negotiation sites and demanded payment in Bitcoin. 

Once a ransom is paid, the Justice Department said the gang “chain-hopped” the coins through mixers and other cryptocurrencies to hide their tracks, masking logins behind layers of VPNs. 

“Cybercrime is not a victimless offense. It is a direct attack on our communities,” said US Attorney Daniel Bubar. “Gholinejad and his co-conspirators orchestrated a ransomware scheme that disrupted lives, businesses, and local governments, and resulted in losses of tens of millions of dollars from unsuspecting victims and institutions.”

Related: The Growing Threat of Targeted Ransomware

Related: Russian Ransomware Gang Exploited Windows Zero-Day Before Patch

Related: Chinese APT Tools Found in Ransomware Schemes, Blurring Attribution Lines

Related: US Gov Disrupts BlackCat Ransomware Operation

Related: Baltimore to Buy $20M in Cyber Insurance Months After Attack