伊朗男子承认参与 Robbinhood 勒索软件攻击：巴尔的摩损失逾1900万美元、市政服务瘫痪数月
美国司法部2025年5月27日宣布，37岁的伊朗公民 Sina Gholinejad 已在联邦法院认罪，承认参与使用 Robbinhood 勒索软件的跨国勒索计划。检方指，他与身在海外的同伙在2019年1月至2024年3月间侵入美国多座城市、企业与医疗机构的计算机网络，复制数据、用勒索软件加密文件，再索要比特币赎金换取解密密钥。
受害最深的是马里兰州的巴尔的摩（Baltimore）。司法部刑事司司长 Matthew R. Galeotti 说，这次攻击迫使巴尔的摩市把数百台计算机下线，数月间无法办理基本市政业务。司法部称，单是巴尔的摩一市，网络损坏与房产税、水费、停车罚单等线上服务长期中断造成的损失就逾1,900万美元；同伙还拿对这些城市造成的破坏去恐吓后续受害人。起诉书列名的其他受害城市包括北卡罗来纳州的 Greenville、俄勒冈州的 Gresham 与纽约州的 Yonkers，受害对象还包括企业与医疗机构，全案损失达数千万美元。
司法部称，这伙人先取得并维持对受害网络的未授权访问，把感染网络里的信息复制到自己控制的虚拟私人服务器上，再部署 Robbinhood 勒索软件加密文件。赃款则通过加密货币混币服务洗白、在不同种类的加密货币之间反复转换（即所谓的「跳链」），并用虚拟私人网络与自营服务器隐藏身份与行踪。
Gholinejad 承认一项计算机欺诈与滥用罪和一项共谋电汇诈骗罪，最高可判30年监禁，量刑定于2025年8月进行，具体刑期将由联邦地区法院法官按量刑指南与其他法定因素决定。北卡罗来纳东区代理联邦检察官 Daniel P. Bubar 说，网络犯罪不是没有受害人的犯罪，而是对社区的直接攻击。联邦调查局 Charlotte 外勤办公室代理特别探员主管 James C. Barnacle Jr. 说，这伙人用了老练的工具与手法，自以为躲在海外就能逍遥法外。
本案由联邦调查局 Charlotte 外勤办公室调查，Baltimore 外勤办公室提供重大协助，保加利亚的司法与执法伙伴协助收集证据，司法部国际事务办公室也提供了重大协助。承办检察官包括刑事司计算机犯罪与知识产权科资深检察官 Aarash A. Haghighat 与 Ryan K. J. Dickey、北卡罗来纳东区助理联邦检察官 Bradford DeVoe 等。（来源：美国司法部）
Iranian Man Pleads Guilty in Robbinhood Ransomware Scheme That Cost Baltimore More Than $19 Million
The Justice Department announced on May 27, 2025, that Sina Gholinejad, 37, an Iranian national, pleaded guilty in federal court to participating in an international ransomware and extortion scheme involving the Robbinhood ransomware. According to court documents, from January 2019 through March 2024, Gholinejad and his co-conspirators, all of whom were overseas, compromised the computer networks of cities, corporations, health care organizations, and other entities around the United States, copied information from the infected networks to virtual private servers they controlled, and encrypted the victims' files with the Robbinhood ransomware variant to extort Bitcoin ransom payments in exchange for the decryption keys.
The City of Baltimore, Maryland, was among the hardest hit. Matthew R. Galeotti, head of the Justice Department's Criminal Division, said the ransomware attack on Baltimore forced the city to take hundreds of computers offline and prevented it from performing basic functions for months. The department said Baltimore lost more than $19 million from the damage to its computer networks and the resulting disruption to essential city services, including online services for processing property taxes, water bills, and parking citations, which lasted many months, and that the conspirators used the damage they caused these cities to threaten subsequent victims. The indictment identifies additional victims including the City of Greenville, North Carolina, the City of Gresham, Oregon, and the City of Yonkers, New York, and the losses across all victims ran to tens of millions of dollars.
Prosecutors said the conspirators attempted to launder the ransom payments through cryptocurrency mixing services and by moving assets between different types of cryptocurrencies, a practice known as chain-hopping, and hid their identities and activities through virtual private networks and servers they operated.
Gholinejad pleaded guilty to one count of computer fraud and abuse and one count of conspiracy to commit wire fraud, and faces a maximum penalty of 30 years in prison. He was scheduled to be sentenced in August 2025, with the sentence to be determined by a federal district court judge under the U.S. Sentencing Guidelines and other statutory factors. Acting U.S. Attorney Daniel P. Bubar for the Eastern District of North Carolina said cybercrime is not a victimless offense but a direct attack on communities. James C. Barnacle Jr., Acting Special Agent in Charge of the FBI's Charlotte Field Office, said the actors had leveraged sophisticated tools and tradecraft while believing they could operate safely from overseas.
The FBI's Charlotte Field Office investigated the case, with substantial assistance from the FBI's Baltimore Field Office. The Justice Department thanked its international judicial and law enforcement partners in Bulgaria for assistance in collecting evidence, and the department's Office of International Affairs also provided substantial assistance. The prosecution team includes Senior Counsels Aarash A. Haghighat and Ryan K. J. Dickey of the Criminal Division's Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Bradford DeVoe for the Eastern District of North Carolina. (Source: U.S. Department of Justice)
来源：美国司法部
发布：GSM·美国（发布链接）
图片来源：图：马里兰州巴尔的摩市政厅（资料图，2025年1月摄）。巴尔的摩是 Robbinhood 勒索软件攻击中受害最深的城市，损失逾1900万美元。Jonmallard 摄，CC BY 4.0，经 Wikimedia Commons。 / Photo: Baltimore City Hall in Maryland (file photo, January 2025). Baltimore was the hardest-hit city in the Robbinhood ransomware attacks, losing more than $19 million. By Jonmallard, CC BY 4.0, via Wikimedia Commons.
GSM Global · 本篇英文版 English edition of this story
