Iranian National Pleads Guilty in U.S. Ransomware Scheme Targeting Cities, Causing Millions in Damages A 37-year-old Iranian national, Sina Gholinejad, pleaded guilty in a North Carolina federal court on Tuesday to charges tied to a ransomware and extortion operation that disrupted city governments and businesses across the U.S. Gholinejad admitted to one count of computer fraud and abuse and one count of conspiracy to commit wire fraud, facing up to 30 years in prison. His sentencing is scheduled for August. Prosecutors revealed that Gholinejad and unidentified coconspirators deployed the RobbinHood ransomware variant to encrypt files on targeted networks, demanding ransom payments in exchange for decryption. Among the victims were the city governments of Greenville, North Carolina (April 2019) and Baltimore (May 2019), as well as other municipalities, including Gresham, Oregon, and Yonkers, New York, along with private entities. The attack on Baltimore proved particularly costly. Hackers demanded $76,000 in Bitcoin, which city officials refused to pay. The breach resulted in over $19 million in damages, crippling critical services for months, including online processing of property taxes, water bills, and parking citations. Prosecutors noted that the conspirators later used the damage inflicted on Baltimore to intimidate other victims. The scheme began in January 2019, when attackers infiltrated victim networks, exfiltrating data to private servers under their control. Gholinejad was initially charged in a sealed April 2024 indictment, unsealed during Tuesday’s hearing. While the plea agreement details remain undisclosed, the case highlights the FBI’s efforts to dismantle transnational cybercrime operations. The investigation involved the FBI’s Charlotte and Baltimore field offices, the Justice Department’s National Security Cyber Section, and the National Security Division, underscoring the severity of ransomware attacks as a threat to public infrastructure. Acting U.S. Attorney Daniel Bubar emphasized that such crimes "are not victimless" but directly harm communities.

The City of Yonkers has been the victim of a ransomware attack. The attack caused City Hall and its employees to remain without their computers for a period of five days. The city decoded not to pay a requested ransom to unlock their computer servers, and instead has spent the past week trying to upload as much data as possible from their backups.