Iranian pleads guilty to RobbinHood ransomware attacks, faces 30 years

An Iranian national, Sina Gholinejad, pleaded guilty for participation in the Robbinhood ransomware operation that from 2019–2024 targeted U.S. local governments, healthcare providers, and nonprofits—encrypting files, stealing data, and extorting victims for Bitcoin. The actors leveraged administrator access and exploited a legitimate but vulnerable Gigabyte driver (gdrv.sys) in BYOVD attacks to disable antivirus, deployed ransomware manually, and used Tor, VPNs, VPSs, and mixers to coordinate and launder payments; notable victims included Baltimore and several U.S. cities and organizations.