Two Iranian men have been charged with deploying a sinister type of ransomware that crippled the operations of hospitals, municipalities, public institutions, and other critical networks in the United States and Canada, officials from the Department of Justice and the FBI announced today.

Beginning in 2015 and continuing until September 2018, SamSam ransomware infiltrated computer networks in Atlanta, Newark, and San Diego, as well as those of major health care providers, the University of Calgary, and others. Once deployed, the malware encrypted data and files. The creators then demanded payment by virtual currency to restore access to affected systems, a crime Assistant Attorney General Brian A. Benczkowski called “21st century blackmail” during a press conference today at the Department of Justice in Washington, D.C.

The toll of these cyberattacks was staggering: more than 230 entities infected, $6 million in ransom payments extorted, and an estimated $30 billion in damages to the affected public and private institutions.

“The actions highlighted today, which represent a continuing trend of cyber criminal activity emanating from Iran, were particularly threatening, as they targeted public safety institutions, including U.S. hospital systems and governmental entities,” said Amy Hess, executive assistant director of the FBI’s Criminal, Cyber, Response, and Services Branch. “As cyber threats evolve and cyber criminals develop more sophisticated techniques, so do we.”

The case was investigated through a coordinated international effort between the FBI, the United Kingdom’s National Crime Agency and West Yorkshire Police, and Canada’s Calgary Police Service and Royal Canadian Mounted Police. Significant assistance was provided by the Justice Department’s National Security Division and the Criminal Division’s Office of International Affairs. The courage and the cooperation of the ransomware victims was also key to the successful investigation.

“Through our valued partnerships, not just with our great law enforcement partners in the U.S. and abroad but with our partners in private industry and with the victims of these crimes, we will find criminals and hold them accountable,” said Hess. “Through persistence and collaboration, we will disrupt not only the criminal activity but also the ill-gotten livelihood of these actors.”  

In the federal indictment unsealed in Newark, the U.S. Attorney for the District of New Jersey charged Faramarz Shahi Savandi and Mohammad Mehdi Shah Mansouri with one count of conspiracy to commit wire fraud, one count of conspiracy to commit fraud and related activity in connection with computers, two substantive counts of intentional damage to a protected computer, and two substantive counts of transmitting a demand in relation to damaging a protected computer.

Although the alleged criminal actors are in Iran and currently out of the reach of U.S. law enforcement, they can be apprehended if they travel, and the United States is exploring other avenues of recourse.

Victims were infected with the ransomware through vulnerabilities found in common software and network accesses points. Hess stressed the importance of computer security and hygiene for individuals and corporations. “We all need to do our part to make sure that our systems are as strong and secure and protected as possible,” she said.

Victims of ransomware or other cybercrimes are encouraged to contact their local FBI field office and file a complaint online with the Internet Crime Complaint Center (IC3).

Children and young adults seem particularly susceptible to sextortion—when a victim is threatened with the release of private and sensitive information unless sexual favors, nude photos, or other demands are met.

But two unrelated cyberstalking crimes committed months apart and hundreds of miles away from each other serve as a reminder of the dangers of compromising personal photos being in the wrong hands, no matter the age of the victim.

In Houston, Heriberto Latigo repeatedly used nude photos of his ex-girlfriend to coerce her to have sex with him. In Crescent, Oklahoma, Troy Allen Martin similarly blackmailed his victim for $50,000.

Both men were eventually convicted and sentenced to prison for their crimes under federal cyberstalking statutes. The harm they caused their victims, however, may never be undone. Such crimes are occurring more frequently, especially among younger victims.

Latigo not only demanded sex, he also sent his victim horrible images and threatening messages. He sent the nude photos to the victim’s sister and male co-workers, and created a disturbing Facebook page that included deeply personal information about the victim.

“It’s a violent crime; he just used cyber tools to carry it out,” said Special Agent Christopher Petrowski of the FBI’s Houston office, who worked the Latigo case.

Latigo’s victim approached local police several times. The case was complicated and the victim’s story changed a number of times, in part because of pressure from Latigo, Petrowski said, making it difficult for local authorities to help effectively. She turned to the FBI, visiting the Houston office in person in spring 2015.

“When someone walks in with a story like that, it’s very emotional and difficult to figure out right away,” Petrowski said. “They’re hurting. This went on for more than a year.”

It took some time for the FBI and federal prosecutors to determine that Latigo had likely violated federal cyberstalking laws. The FBI sent letters to social media companies to preserve certain records in order to prevent Latigo from covering his tracks. Agents also served search warrants, seizing computer equipment from his home.

Members of Houston’s Innocent Images Task Force—which investigates child pornography—helped search Latigo’s electronics. They uncovered photos and were able to document that Latigo accessed social media sites from the machines.

During the course of the investigation, Petrowski discovered that other victims had filed similar complaints with local police. Although Latigo wasn’t charged in other cases, it was important to the investigation that his name was mentioned in other police reports, Petrowski said. “These other victims, who did not know each other and have never met, effectively corroborated this pattern of behavior,” he said.

Latigo was arrested in June 2015 and convicted on a federal stalking charge—using the Internet to cause substantial emotional distress—in October 2017. He was sentenced to 60 months in prison in March.

“This guy is a predator, and he targeted her from the first time they met. He had a pattern,” Petrowski said. “By taking this one guy off the street, we may have prevented countless future sexual assaults. We also gave past victims some closure, which local authorities legitimately couldn’t do.”

The FBI got involved in the Oklahoma case after bank employees in Ardmore noted concerning behavior surrounding the victim's attempt to wire Martin $40,000.

The victim was on the phone with Martin when she arrived at the bank. When asked for a destination bank for the wire transfer, Martin refused to tell his victim and insisted on speaking to the teller instead. The bank refused to handle the transaction.

When the wire transfer was denied, Martin told his victim to withdraw $50,000 in cash. The bank complied with the victim’s request, but urged her to speak to police about the obvious coercion.

“That’s a significant amount of money,” said Special Agent Ken Western, who worked the case from the FBI’s Oklahoma City office. “The bank thought if he was requesting money by phone, maybe it was a threatening communication. So they reported it.”

The FBI reached out to the victim, who showed agents numerous text messages and played voicemails from Martin. He repeatedly said he would share nude photos he had taken of her unless she gave him money. Despite receiving $50,000, Martin also demanded a relationship and sex with the victim.

“He was just harassing this lady, causing severe emotional distress. He was relentless,” Western said.

As in the Latigo case, Martin had other victims as well. He even sent the nude photos of his victim to another victim to show he was serious.

Investigators found victims through protection orders that had been filed against Martin. That information helped show a pattern of behavior. Martin found several of his victims through a dating site for divorced adults.

Martin pleaded guilty to one count of cyberstalking in October 2017. A federal judge sentenced him to 33 months’ imprisonment in April.

“This goes on a lot,” Western said, adding that people should not share intimate photos over the Internet or social media sites. “This lady lost $50,000, and she was extremely distressed. I hope other people will think twice about it.”

Victims in both cases received support through the FBI’s Victim Services Division.

At around 8:30 p.m. on November 2, 1988, a maliciously clever program was unleashed on the Internet from a computer at the Massachusetts Institute of Technology (MIT).

This cyber worm was soon propagating at remarkable speed and grinding computers to a halt. “We are currently under attack,” wrote a concerned student at the University of California, Berkeley in an email later that night. Within 24 hours, an estimated 6,000 of the approximately 60,000 computers that were then connected to the Internet had been hit. Computer worms, unlike viruses, do not need a software host but can exist and propagate on their own.

Berkeley was far from the only victim. The rogue program had infected systems at a number of the prestigious colleges and public and private research centers that made up the early national electronic network. This was a year before the invention of the World Wide Web. Among the many casualties were Harvard, Princeton, Stanford, Johns Hopkins, NASA, and the Lawrence Livermore National Laboratory.

The worm only targeted computers running a specific version of the Unix operating system, but it spread widely because it featured multiple vectors of attack. For example, it exploited a backdoor in the Internet’s electronic mail system and a bug in the “finger” program that identified network users. It was also designed to stay hidden.

The worm did not damage or destroy files, but it still packed a punch. Vital military and university functions slowed to a crawl. Emails were delayed for days. The network community labored to figure out how the worm worked and how to remove it. Some institutions wiped their systems; others disconnected their computers from the network for as long as a week. The exact damages were difficult to quantify, but estimates started at $100,000 and soared into the millions.

As computer experts worked feverishly on a fix, the question of who was responsible became more urgent. Shortly after the attack, a dismayed programmer contacted two friends, admitting he’d launched the worm and despairing that it had spiraled dangerously out of control. He asked one friend to relay an anonymous message across the Internet on his behalf, with a brief apology and guidance for removing the program. Ironically, few received the message in time because the network had been so damaged by the worm.

Independently, the other friend made an anonymous call to The New York Times, which would soon splash news of the attack across its front pages. The friend told a reporter that he knew who built the program, saying it was meant as a harmless experiment and that its spread was the result of a programming error. In follow-up conversations with the reporter, the friend inadvertently referred to the worm’s author by his initials, RTM. Using that information, The Times soon confirmed and publicly reported that the culprit was a 23-year-old Cornell University graduate student named Robert Tappan Morris.

Morris was a talented computer scientist who had graduated from Harvard in June 1988. He had grown up immersed in computers thanks to his father, who was an early innovator at Bell Labs. At Harvard, Morris was known for his technological prowess, especially in Unix; he was also known as a prankster. After being accepted into Cornell that August, he began developing a program that could spread slowly and secretly across the Internet. To cover his tracks, he released it by hacking into an MIT computer from his Cornell terminal in Ithaca, New York.

After the incident became public, the FBI launched an investigation. Agents quickly confirmed that Morris was behind the attack and began interviewing him and his associates and decrypting his computer files, which yielded plenty of incriminating evidence.

But had Morris broken federal law? Turns out, he had. In 1986, Congress had passed the Computer Fraud and Abuse Act, outlawing unauthorized access to protected computers. Prosecutors indicted Morris in 1989. The following year, a jury found him guilty, making him the first person convicted under the 1986 law. Morris, however, was spared jail time, instead receiving a fine, probation, and an order to complete 400 hours of community service.

The episode had a huge impact on a nation just coming to grips with how important—and vulnerable—computers had become. The idea of cybersecurity became something computer users began to take more seriously. Just days after the attack, for example, the country’s first computer emergency response team was created in Pittsburgh at the direction of the Department of Defense. Developers also began creating much-needed computer intrusion detection software.

At the same time, the Morris Worm inspired a new generation of hackers and a wave of Internet-driven assaults that continue to plague our digital systems to this day. Whether accidental or not, the first Internet attack 30 years ago was a wake-up call for the country and the cyber age to come.

Seven Russian government operatives have been charged with hacking into the computer networks of organizations working to investigate and stop Russian athletic doping, just after Russia was banned from the Olympics due to state-sponsored doping revelations. The hackers also allegedly targeted other international entities seen as thwarting Russia’s strategic interests.

According to an indictment unsealed today in federal court in Pittsburgh, beginning in 2014, the defendants, who worked in Russia’s Main Intelligence Directorate (GRU), engaged in “persistent and sophisticated criminal cyber intrusions.” The GRU operatives hacked U.S. and international anti-doping agencies, anti-doping officials, other international organizations, and one major corporation. The charges against the defendants include conspiracy to commit computer fraud, conspiracy to commit wire fraud, wire fraud, aggravated identity theft, and conspiracy to commit money laundering.

After Russia was found to have engaged in state-sponsored doping during the 2014 Sochi Winter Games, the International Olympic Committee limited Russian athletes’ participation in the 2016 Games. The IOC also banned Russia from the 2018 Olympics, though some Russian athletes, who were not doping, were allowed to participate under the Olympic flag.

When anti-doping organizations began investigating and speaking out publicly against Russia’s actions, the hackers began intruding into their networks, according to the indictment. The FBI investigation found that these hackers worked remotely from Russia as well as on the ground in several other countries.

For example, during the 2016 Summer Games in Rio de Janeiro, Brazil, the GRU agents sent spear-phishing e-mails that enabled them to find the credentials of an anti-doping official, providing access to sensitive databases. Additionally, coordinating with hackers back in Russia, two members of the group traveled to Rio on another occasion to engage in “close access” cyber operations on a hotel Wi-Fi network that anti-doping officials were using. This gave them access to an anti-doping official’s e-mail account with sensitive information in it.

The hacks were conducted as part of an influence and disinformation campaign designed to undermine and delegitimize organizations that exposed Russia’s state-sponsored doping, expose private health information about athletes from other countries, and damage the reputations of other international athletes by falsely claiming they were using banned substances.

After the 2016 Olympics, according to the indictment, the Russians published the private information they stole—including nearly 250 athletes’ personal medical information—using the Fancy Bears hacktivist group website and social media accounts. In some cases, the Russians modified the information to make it look as though non-Russian athletes were doping who were not actually doing so.

“This began with a disclosure of a Russian state-sponsored doping program for its athletes. In other words, Russia cheated,” said U.S. Attorney Scott W. Brady of the Western District of Pennsylvania at a news conference today at the Department of Justice in Washington, D.C. “They cheated; they got caught. They were banned from the Olympics. They were mad, and they retaliated. And in retaliating, they broke the law—so they are criminals.”

The indictment describes a variety of tactics used by the Russian hackers during this campaign, including spear-phishing, distributed denial of service attacks, spoofing legitimate web domains, and using cryptocurrencies to cover their tracks.

As a result of the indictment, the operatives, all of whom are Russian citizens and are believed to be living in Russia, will no longer have the benefit of anonymity—which is prized among state-sponsored cyber criminals. Publicly identifying the hackers in an indictment, known as “naming and shaming,” hampers their ability to operate, particularly in traveling outside Russia.

“These activities by Russian GRU officers move well beyond acceptable government intelligence operations. The GRU is breaking traditional international norms—and the law—in using cyber tools and resources in the fashion that they have,” said FBI Cyber Division Deputy Assistant Director Eric Welling. “The FBI considers any criminal activity conducted by nation-state actors, especially those leading to the violation of Americans’ privacy or interference in our economy, to be a matter of national security.”

In addition to the sports-related hacking, beginning in 2014, the Russian conspirators allegedly targeted, via spear-phishing attacks, a Pittsburgh-based nuclear energy company that provides nuclear fuel to Ukraine. The Russians also allegedly targeted an anti-chemical weapons organization in the Netherlands, and later planned to target a Swiss chemical laboratory, but they were disrupted by Dutch authorities.

The FBI investigated the intrusions in close partnership with the United Kingdom National Security and Intelligence Agencies, the Defense Intelligence and Security Service of the Netherlands, the Royal Canadian Mounted Police, and the Office of the Attorney General of Switzerland.