Skip to main content

US indicts Iranians who hacked power company, women's shelter

This handout image by the US State Department shows Iranian cyber actors wanted for their alleged involvement in a coordinated campaign to hack and extort hundreds of computer networks and organizations in the United States and abroad
— Washington (AFP)

The US Department of Justice announced an indictment Wednesday against three Iranian hackers who used ransomware to extort a battered women's shelter and a power company.

Authorities said the trio launched ransomware attacks at "hundreds" of victims, including inside Britain, Australia, Iran, Russia and the United States, saying they extorted money "largely" for their own accounts, and not for the Iranian government.

But a separate US Treasury announcement of sanctions said the three were part of a larger hacking group tied to Iran's powerful Islamic Revolutionary Guard Corps (IRGC), and the US State Department has offered a $10 million reward for information on them.

The indictment identified the three as Mansour Ahmadi, Ahmad Khatibi Aghda, and Amir Hossein Nikaeen Ravari.

It said that between October 2020 and August 2022, the men used known vulnerabilities in computer systems to attack multiple targets in the United States, stealing their data and demanding up to hundreds of thousands of dollars to have it returned.

Those included local governments, a shelter for victims of domestic violence, a children's hospital in Boston, accounting firms and electricity generating companies.

The victims were not methodically chosen but were "targets of opportunity" whose computer systems were vulnerable to hacking, officials said.

"The indictment does not allege that these actors undertook these actions on behalf of the Government of Iran," a senior Justice Department official told reporters.

The three "engaged in a pattern of hacking, cyber-theft, and extortion largely for personal gain," FBI Director Chris Wray said in a separate statement.

But a concurrent announcement by the US Treasury said the three were part of a group of 10 Iranian hackers targeted with sanctions that was backed by the Revolutionary Guards.

"This IRGC-affiliated group is known to exploit software vulnerabilities in order to carry out their ransomware activities, as well as engage in unauthorized computer access, data exfiltration, and other malicious cyber activities," the Treasury said.

Their actions align with those of known Iranian cyberattack operations which private cyber security groups have dubbed "APT35," "Charming Kitten" and "Phosphorous," Treasury added.

Join hundreds of Middle East professionals with Al-Monitor PRO.

Business and policy professionals use PRO to monitor the regional economy and improve their reports, memos and presentations. Try it for free and cancel anytime.

Free

The Middle East's Best Newsletters

Join over 50,000 readers who access our journalists dedicated newsletters, covering the top political, security, business and tech issues across the region each week.
Delivered straight to your inbox.

Free

What's included:
Our Expertise

Free newsletters available:

  • The Takeaway & Week in Review
  • Middle East Minute (AM)
  • Daily Briefing (PM)
  • Business & Tech Briefing
  • Security Briefing
  • Gulf Briefing
  • Israel Briefing
  • Palestine Briefing
  • Turkey Briefing
  • Iraq Briefing
Expert

Premium Membership

Join the Middle East's most notable experts for premium memos, trend reports, live video Q&A, and intimate in-person events, each detailing exclusive insights on business and geopolitical trends shaping the region.

$25.00 / month
billed annually

Become Member Start with 1-week free trial

We also offer team plans. Please send an email to pro.support@al-monitor.com and we'll onboard your team.

What's included:
Our Expertise AI-driven

Memos - premium analytical writing: actionable insights on markets and geopolitics.

Live Video Q&A - Hear from our top journalists and regional experts.

Special Events - Intimate in-person events with business & political VIPs.

Trend Reports - Deep dive analysis on market updates.

All premium Industry Newsletters - Monitor the Middle East's most important industries. Prioritize your target industries for weekly review:

  • Capital Markets & Private Equity
  • Venture Capital & Startups
  • Green Energy
  • Supply Chain
  • Sustainable Development
  • Leading Edge Technology
  • Oil & Gas
  • Real Estate & Construction
  • Banking

Start your PRO membership today.

Join the Middle East's top business and policy professionals to access exclusive PRO insights today.

Join Al-Monitor PRO Start with 1-week free trial