A 29-year-old Iranian national is behind this summer's HBO hack, which exposed confidential data about upcoming episodes of Game of Thrones, according to the FBI.
On Tuesday, US authorities indicted Behzad Mesri and charged him with wire fraud, computer hacking, aggravated identity theft, and other crimes. Mesri, who once worked for the Iranian military, was also placed on the FBI's most wanted list for cybercrimes.
"Although not arrested today, he will forever have to look over his shoulder until he is made to face justice," acting Manhattan US Attorney Joon Kim said in a statement.
The HBO hack came to light in July, after a mysterious hacker began posting unaired TV episodes from various HBO series as well as a script for an upcoming Game of Thrones episode. On Tuesday, the FBI blamed Mesri, who the agency says demanded $6 million in bitcoin from HBO in exchange for the stolen files.
Mesri's scheme dates back to May, when he began studying how to penetrate HBO's network; he eventually compromised online accounts belonging to several HBO employees and other authorized users, the FBI says. He then stole the company's files, including unaired TV episodes of HBO series Ballers, Curb your Enthusiasm, and Room 104, in addition to financial documents and confidential cast and crew contact lists.
In late July, Mesri sent threatening email messages to HBO executives and employees, demanding they give into his ransom demands. To compel payment, Mesri contacted journalists and leaked portions of the stolden data online.
The unsealed indictment doesn't mention how US investigators identified Mesri as the mastermind behind the HBO hack, but he resides in Iran, and goes by the hacker name "Skote Vahshat," according to the FBI.
In a taped press conference, Kim declined to comment if Mesri hacked HBO on behalf of the Iranian military. His work there targeted military systems, including nuclear software systems and Israeli infrastructure. At times, Mesri has also been a member of an Iranian hacking group called Turk Black Hat Security team, which has defaced hundreds of websites.
The US could have kept the indictment sealed, but decided Mesri's capture at this point is unrealistic, so decided to issue a public message instead, Kim said at Tuesday's press conference.