An Iranian man pleaded guilty Tuesday to participating in the Robbinhood ransomware scheme, which most notably afflicted the city of Baltimore in a costly 2019 attack.

Sina Gholinejad, 37, pleaded guilty to one count of computer fraud and abuse and one count of conspiracy to commit wire fraud. He faces up to 30 years in prison.

The indictment primarily implicates Gholinejad, also known as Sina Ghaaf, for conducting online research related to the deployment of Robbinhood, with unnamed co-conspirators carrying out other parts of the scheme.

The Robbinhood extortion scheme began in January 2019 and continued through at least March of last year, according to the indictment

Baltimore incurred more than $19 million in costs due to the Robbinhood attack, with other cities — Greenville, N.C., and Yonkers, N.Y., among them — also victimized. Other victims included a nonprofit and medical group.

“Gholinejad and his co-conspirators — all of whom were overseas — caused tens of millions of dollars in losses and disrupted essential public services by deploying the Robbinhood ransomware against U.S. cities, health care organizations, and businesses,” said Matthew Galeotti, head of the Justice Department’s Criminal Division.

The scheme operators set up virtual private networks and cryptocurrency wallets to receive extorted Bitcoin as part of their infrastructure, the indictment reads.

“Gholinejad and his co-conspirators attempted to launder the ransom payments through cryptocurrency mixing services and by moving assets between different types of cryptocurrencies, a practice known as chain-hopping,” according to a Justice Department news release. “They also hid their identities and activities through a number of technical methods, including the use of virtual private networks and servers that they operated.”

Authorities arrested Gholinejad in North Carolina in January.

Tim Starks

Written by Tim Starks

Tim Starks is senior reporter at CyberScoop. His previous stops include working at The Washington Post, POLITICO and Congressional Quarterly. An Evansville, Ind. native, he’s covered cybersecurity since 2003. Email Tim here: tim.starks@cyberscoop.com.



Plus de détails sur l’article original.