A 39-year-old Iranian man, named Sina Gholinejad (also known as “Sina Ghaaf”), has pleaded guilty to participating in one of the most notorious ransomware operations of recent years (Robbinhood).
According to a statement from the US Department of Justice , Gholinejad and his associates used Robbinhood ransomware from January 2019 to March 2024. Their goal was to compromise systems, steal data, and encrypt files , with the aim of demanding millions of dollars in ransom.
Victims included local governments, healthcare providers, and non-profit organizations. The attackers stole data and encrypted files. They then demanded a ransom in Bitcoin in exchange for a decryption tool and non-leakage of data.
See also: MathWorks: Ransomware attack behind service outage
Some of the cities targeted by Robbinhood ransomware included Baltimore, Greenville, North Carolina, Gresham, Oregon, and Yonkers, New York. In addition, hackers also targeted private organizations, such as Meridian Medical Group and Berkshire Farm Center.
The Robbinhood ransomware gang first gained notoriety in May 2019 when it crippled Baltimore’s IT systems for weeks, with severe operational and financial impacts. Over time, their strategy evolved to incorporate tactics extortion through data leaks – a method that became more widely established in the cybercrime underground scene.
Robbinhood: Ransomware weaponized with legitimate software
The group behind the Robbinhood ransomware was also notable for using a legitimate but vulnerable Gigabyte driver (gdrv.sys) in Bring Your Own Vulnerable Driver attacks. Through this tactic, cybercriminals were able to disable the antivirus of the targeted systems, paving the way for the ransomware to execute unhindered.
See also: Nova Scotia Power confirms Ransomware attack
The attacks were accompanied by ransom notes on the infected systems, leading victims to Tor websites, where the ransom payment.
The indictment also reveals that the perpetrators used advanced methods of concealing their identities, such as virtual private servers (VPS) in Europe, VPNs and crypto mixers, to avoid detection and prosecution by the authorities.
Defendant Sina Gholinejad pleaded guilty in federal court in North Carolina and faces up to 30 years in prison for a series of serious offenses, including conspiracy to commit fraud, computer hacking , racketeering and money laundering
See also: 3AM ransomware: Spoofed IT calls, email bombing to breach networks
Ransomware protection
- Stay up to date on the latest ransomware trends and tactics used by attackers
- Implement multi-factor authentication (MFA) for all user accounts
- Enable firewall on all devices connected to your network
- Keep sensitive data encrypted
- Update all your devices and systems with the latest security patches
- Conduct regular security audits and penetration testing
- Use strong, unique passwords and change them regularly.
- Limit user access to only necessary systems and information
- Consider using solutions email security for additional protection against phishing attacks
- Have a recovery plan to quickly restore systems in the event of an attack
- Enable the display of file extensions
- Invest in advanced protection solutions
- Use sandboxing for email attachments
- Keep backup copies of your data
Source: www.bleepingcomputer.com
☁️ Keep safe copies with Proton Drive
Encrypted cloud storage from Proton — protect your files from ransomware, corruption, and data loss with end-to-end encryption.
- ✔ End-to-end encrypted files & backups
- ✔ Version history — recover files after ransomware
- ✔ Free space — sync across all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
