FBI lays charges in connecting with 2016 ransomware attack on the U of C

By Matty Hume, December 4 2018 —

The Federal Bureau of Investigation has laid a handful charges against two Iranian men in connection with a complex ransomware operation that caused the University of Calgary to pay $20,000 in a 2016 attack. The attack affected faculty and staff IT accounts, but not student accounts.

According to a news release by the FBI, Faramarz Shahi Savandi and Mohammad Mehdi Shah Mansouri face a total of seven fraud and computer related charges.

The operation, which began in 2015 and continued through September 2018, infected over 230 entities worldwide, including the U of C, with “SamSam” ransomware. A total of $6 million in ransom payments was extorted, according to the FBI.

The FBI worked in conjunction with various law enforcement entities, including the Calgary Police Service. Linda Dalgetty, vice-president finance and services at the U of C said the university is thankful for law enforcement efforts and the support of the campus community.

“We are thankful that law enforcement agencies take such criminal acts very seriously and were able to locate the perpetrators and issue arrest warrants,” Dalgetty said in a written statement.  “Students, faculty and staff showed tremendous patience and understanding as the university worked through this challenging issue, and we hope they can take satisfaction in knowing that the suspected perpetrators are being charged.”

According to the FBI, the two men charged are currently in Iran and out of reach for American law enforcement.

“Although the alleged criminal actors are in Iran and currently out of the reach of U.S. law enforcement, they can be apprehended if they travel, and the United States is exploring other avenues of recourse,” read the FBI’s news release.