Iranian Man Pleads Guilty in Robbinhood Ransomware Scheme That Cost Baltimore More Than $19 Million
The Justice Department announced on May 27, 2025, that Sina Gholinejad, 37, an Iranian national, pleaded guilty in federal court to participating in an international ransomware and extortion scheme involving the Robbinhood ransomware. According to court documents, from January 2019 through March 2024, Gholinejad and his co-conspirators, all of whom were overseas, compromised the computer networks of cities, corporations, health care organizations, and other entities around the United States, copied information from the infected networks to virtual private servers they controlled, and encrypted the victims' files with the Robbinhood ransomware variant to extort Bitcoin ransom payments in exchange for the decryption keys.
The City of Baltimore, Maryland, was among the hardest hit. Matthew R. Galeotti, head of the Justice Department's Criminal Division, said the ransomware attack on Baltimore forced the city to take hundreds of computers offline and prevented it from performing basic functions for months. The department said Baltimore lost more than $19 million from the damage to its computer networks and the resulting disruption to essential city services, including online services for processing property taxes, water bills, and parking citations, which lasted many months, and that the conspirators used the damage they caused these cities to threaten subsequent victims. The indictment identifies additional victims including the City of Greenville, North Carolina, the City of Gresham, Oregon, and the City of Yonkers, New York, and the losses across all victims ran to tens of millions of dollars.
Prosecutors said the conspirators attempted to launder the ransom payments through cryptocurrency mixing services and by moving assets between different types of cryptocurrencies, a practice known as chain-hopping, and hid their identities and activities through virtual private networks and servers they operated.
Gholinejad pleaded guilty to one count of computer fraud and abuse and one count of conspiracy to commit wire fraud, and faces a maximum penalty of 30 years in prison. He was scheduled to be sentenced in August 2025, with the sentence to be determined by a federal district court judge under the U.S. Sentencing Guidelines and other statutory factors. Acting U.S. Attorney Daniel P. Bubar for the Eastern District of North Carolina said cybercrime is not a victimless offense but a direct attack on communities. James C. Barnacle Jr., Acting Special Agent in Charge of the FBI's Charlotte Field Office, said the actors had leveraged sophisticated tools and tradecraft while believing they could operate safely from overseas.
The FBI's Charlotte Field Office investigated the case, with substantial assistance from the FBI's Baltimore Field Office. The Justice Department thanked its international judicial and law enforcement partners in Bulgaria for assistance in collecting evidence, and the department's Office of International Affairs also provided substantial assistance. The prosecution team includes Senior Counsels Aarash A. Haghighat and Ryan K. J. Dickey of the Criminal Division's Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Bradford DeVoe for the Eastern District of North Carolina. (Source: U.S. Department of Justice)
Source: U.S. Department of Justice
Published by GSM · USA (original Chinese edition)
Photo: 图：马里兰州巴尔的摩市政厅（资料图，2025年1月摄）。巴尔的摩是 Robbinhood 勒索软件攻击中受害最深的城市，损失逾1900万美元。Jonmallard 摄，CC BY 4.0，经 Wikimedia Commons。 / Photo: Baltimore City Hall in Maryland (file photo, January 2025). Baltimore was the hardest-hit city in the Robbinhood ransomware attacks, losing more than $19 million. By Jonmallard, CC BY 4.0, via Wikimedia Commons.
