An Iranian national has pleaded guilty to charges related to a sophisticated ransomware operation that caused millions in damages to U.S. organizations. Sina Gholinejad, also known as Sina Ghaaf, admitted to participating in an international extortion scheme using the Robbinhood ransomware.

The 37-year-old defendant, arrested in North Carolina in January, pleaded guilty to computer fraud and abuse and conspiracy to commit wire fraud charges. He faces up to 30 years in prison, with sentencing scheduled for August 2025.

According to the Department of Justice, the cyberattacks significantly disrupted operations and caused tens of millions in losses. Notable victims included the City of Baltimore, which suffered over $19 million in damages and experienced months-long disruptions to essential services including tax processing, water billing, and other revenue-generating functions.

Court documents reveal that between January 2019 and March 2024, Gholinejad and his co-conspirators:
– Infiltrated victim computer networks
– Exfiltrated sensitive data to private servers
– Deployed Robbinhood ransomware to encrypt files
– Demanded Bitcoin payments for decryption
– Laundered proceeds through cryptocurrency mixing services and chain-hopping

The Robbinhood operation employed sophisticated techniques, including a “bring your own vulnerable driver” (BYOVD) attack using a legitimate but vulnerable Gigabyte driver to bypass security measures. The attackers also concealed their identities using virtual private networks and servers.

“Cybercrime is not a victimless offense – it is a direct attack on our communities,” stated acting U.S. Attorney Daniel P. Bubar, highlighting the real-world impact of these digital crimes.