By David Pendered
The cyber attack that crippled the City of Atlanta starting in March was part of a assault on more than 200 public entities in the United States and Canada conducted by two men based in Iran who demanded payment in Bitcoins in exchange for keys to unlock ransomware they had installed in victims’ computer systems, according to a federal indictment released Wednesday in New Jersey.
Atlanta Mayor Keisha Lance Bottoms released the following statement Wednesday afternoon:
- “The City of Atlanta is aware of the U.S. Department of Justice’s indictment related to the March cyber-attack against the City. We are grateful for all our federal partners who have assisted with identifying the perpetrators and bringing them to justice. The Administration remains committed to ensuring the ongoing safety and security of the City’s cyber-infrastructure, as well as that of the people of Atlanta.”
Prosecutors did not cite any local law enforcement agencies in the United States for working on the case. Agencies that were cited include the Justice Department, two British agencies, and Canada’s Calgary Police Service and Royal Canadian Mounted Police, according to remarks prepared for delivery by Assistant Attorney General Brian A. Benczkowski.
Atlanta was of two major cities that were targeted in the scheme, according to remarks prepared for delivery by Deputy Attorney General Rod J. Rosenstein:
- “The victims included two major municipalities – the City of Atlanta, Georgia and the City of Newark, New Jersey. The defendants also sought to interrupt critical transportation infrastructure by infiltrating the Port of San Diego, California, and the Colorado Department of Transportation.”
Atlanta did not pay a ransom and the attack was estimated to cost the city up to $17 million.
Rosenstein said the defendants focused on public entities because, “they knew that shutting down those computer systems could cause significant harm to innocent victims.”
Their scheme involved installing the malware and demanding payment to provide decryption keys needed to unlocked the computers, and a threat to delete the decryption keys if the ransom demand was not paid, according to the indictment that was filed Monday and the subject of a briefing Wednesday.
The two defendants have not been arrested and now are fugitives. The FBI’s executive assistant director, Amy Hess, said in a statement the indictment shows the U.S. district attorney’s office in New Jersey will pursue such criminals, “no matter where in the world they may seek to hide.”
The indictment charges Faramarz Shahi Savandi, 34, and Mohammad Mehdi Shah Mansouri, 27, both of Iran.
- Conspiracy to commit fraud and related activity in connection with computers;
- Conspiracy to commit wire fraud;
- Intentional damage to a protected computer;
- Transmitting a demand in relation to damaging a protected computer.
The two men allegedly conducted a 34-month-long international computer hacking and extortion scheme involving a malware they wrote. The “SamSam Ransomware,” was capable of forcibly encrypting data on the computers of victims, according to a statement by the Justice Department.
The hackers first created SamSam in December 2015 and created updates in June and October 2017, according to a statement. To commit their attacks, the two hackers used Bitcoin exchangers in Iran, and also overseas computer infrastructures, according to the statement.