Iranian National Pleads Guilty in Robbinhood Ransomware Case

• An Iranian individual targeted governments, healthcare, and corporations across the U.S. with Robbinhood malware.
• These coordinated attacks resulted in tens of millions in losses and widespread disruption of essential public services.
• The individual faces up to 30 years in prison for the charges brought.

An Iranian man pleaded guilty on May 27, 2025, to participating in a significant ransomware scheme involving the Robbinhood variant to compromise network infrastructure, encrypt critical data, and extort ransom payments in cryptocurrency.

Sina Gholinejad, 37, and his co-conspirators, based overseas, targeted municipal governments, healthcare institutions, and corporations across the U.S., deploying Robbinhood ransomware, according to the U.S. Department of Justice (DoJ). 

Authorities reported that these coordinated attacks resulted in tens of millions of dollars in losses and widespread disruption of essential public services. 

Notably, the City of Baltimore suffered damages exceeding $19 million, severely impacting revenue-generating online services such as property tax processing, water billing, and parking citations for several months. 

The City of Greenville, North Carolina, was also among the affected institutions, and the indictment lists further victims, including the cities of Gresham, Oregon, and Yonkers, New York.

The cybercriminals engaged in sophisticated operational security measures to obfuscate their identities and illicit activities. These included the use of virtual private networks and self-operated servers, as well as attempts to launder extorted cryptocurrency by “chain-hopping” and utilizing mixing services to obscure transactional flows.

Gholinejad’s conviction represents a concerted effort by U.S. law enforcement to pursue and hold accountable threat actors regardless of their physical location. The individual faces up to 30 years in prison, with sentencing set for August.

The DoJ and the FBI, in collaboration with international partners, notably Bulgaria’s judicial and law enforcement agencies, coordinated to collect vital digital evidence, leading to Gholinejad’s apprehension and prosecution.