The US is blaming two Iranians for developing the SamSam ransomware strain, which hit more than 200 known victims across the country, including government offices and hospitals.
On Wednesday, the US Justice Department unsealed an indictment against 34-year-old Faramarz Shahi Savandi and 27-year-old Mohammad Mehdi Shah Mansouri, who are charged with computer hacking crimes.
"The Iranian defendants allegedly used hacking and malware to cause more than $30 million in losses to more than 200 victims," Deputy Attorney General Rod Rosenstein said in a statement.
According to federal investigators, the two Iranians have been launching SamSam ransomware attacks for almost three years. Among the victims are the city of Atlanta, the city of Newark, and the Port of San Diego, Six healthcare-related groups, including clinical lab testing company LabCorp, were also hit.
The Windows-based SamSam ransomware functions like piece of malware, but its primary purpose is to hold your machine hostage. It does this by encrypting all the data on a machine, and then demanding a payment in Bitcoin for the system to be released. Victims who don't pay up will have all their data erased.
To deliver the malicious code, the Iranians allegedly breached the online servers their victims were using by exploiting known vulnerabilities in the software. Once inside, the Iranians then spread the SamSam ransomware to as many machines as possible, sometimes within hours of breaching the network.
According to indictment, the Iranians conducted online research to identify potential victims. They also made sure to spread the ransomware outside normal business hours when employees were off work. The attacks were so successful that federal investigators claim the Iranians extorted more than $6 million in Bitcoin from victims.
So far, it isn't clear how the US identified Mansouri and Savandi as the suspected authors of the SamSam ransomware. Both suspects also reside in Iran, making chances of extradition low. If the two were indeed behind the ransomware strain, then they can continue to launch their attacks.
However, the Justice Department said Wednesday's indictment was intended to name and shame the suspected hackers, whose identities remained a mystery until today.
On the same day, the US Treasury Department also sanctioned two other Iranians for aiding the SamSam ransomware scheme. According to the Treasury Department, Ali Khorashadizadeh and Mohammad Ghorbaniyan helped SamSam's authors exchange their Bitcoin ransoms into Iran's local currency.