US Charges Three Iranians for Ransomware Attacks on Women’s Shelter, Businesses

A silhouetted Iranian woman walks past an anti-US wall painting on the wall of former US embassy in the capital city of Tehran, Iran, 05 September 2022. (EPA)
A silhouetted Iranian woman walks past an anti-US wall painting on the wall of former US embassy in the capital city of Tehran, Iran, 05 September 2022. (EPA)
TT

US Charges Three Iranians for Ransomware Attacks on Women’s Shelter, Businesses

A silhouetted Iranian woman walks past an anti-US wall painting on the wall of former US embassy in the capital city of Tehran, Iran, 05 September 2022. (EPA)
A silhouetted Iranian woman walks past an anti-US wall painting on the wall of former US embassy in the capital city of Tehran, Iran, 05 September 2022. (EPA)

Three Iranians have been charged with trying to extort hundreds of thousands of dollars from organizations in the United States, Europe, Iran and Israel, including a domestic violence shelter, by hacking in to their computer systems, US officials said on Wednesday.

Other targets included local US governments, regional utilities in Mississippi and Indiana, accounting firms and a state lawyers' association, according to charges filed by the US Justice Department.

While the criminal charges do not say whether the alleged hackers worked for the Iranian government, a separate US Treasury Department statement said they were affiliated with the Iranian Revolutionary Guard Corps, an Iranian intelligence and security force.

A senior Justice Department official said the Iran government does not discourage residents from engaging in hacking, as long as it is directed outside the country.

Iran's mission to the United Nations in New York did not immediately respond to a request for comment.

The defendants, named Mansour Ahmadi, Ahmad Khatibi and Amir Hossein Nikaein, are citizens of Iran who own or are employed by private technology companies in the country.

The Treasury Department also imposed sanctions on the three Iranians, as well as several other individuals and two organizations they said were part of Tehran's "malicious" cyber and ransomware activity.

The alleged hackers face little chance of being arrested, as they are believed to be living freely in Iran. But officials said the charges will make it difficult for them to travel or find work outside the country, as is the preference of many educated Iranians.

According to the charges, the three men infiltrated the computer systems of a wide range of businesses and governments between October 2020 and August 2022, encrypted their data and demanded bitcoin payments of up to hundreds of thousands of dollars.

Some victims, including the domestic violence shelter, opted to pay the ransom to recover their data.

Such ransomware attacks have skyrocketed over the past decade, damaging scores of US companies and other organizations around the globe.

In June last year, the Justice Department said it was elevating ransomware investigations to a similar priority as terrorism in the wake of a major, disruptive attack on a US pipeline company, which led to localized gas shortages on the US East coast.



Satellite Images Suggest North Korea Expanding Missile Plant, Researchers Say

A satellite image shows a suspected missile assembly building under construction (lower center of photo) at the "February 11 Plant" near Hamhung, North Korea in this handout image obtained by Reuters on November 20, 2024. (Planet Labs PBC/Handout via Reuters)
A satellite image shows a suspected missile assembly building under construction (lower center of photo) at the "February 11 Plant" near Hamhung, North Korea in this handout image obtained by Reuters on November 20, 2024. (Planet Labs PBC/Handout via Reuters)
TT

Satellite Images Suggest North Korea Expanding Missile Plant, Researchers Say

A satellite image shows a suspected missile assembly building under construction (lower center of photo) at the "February 11 Plant" near Hamhung, North Korea in this handout image obtained by Reuters on November 20, 2024. (Planet Labs PBC/Handout via Reuters)
A satellite image shows a suspected missile assembly building under construction (lower center of photo) at the "February 11 Plant" near Hamhung, North Korea in this handout image obtained by Reuters on November 20, 2024. (Planet Labs PBC/Handout via Reuters)

North Korea is expanding a key weapons manufacturing complex that assembles a type of short-range missile used by Russia in Ukraine, researchers at a US-based think tank have concluded, based on satellite images.

The facility, known as the February 11 plant, is part of the Ryongsong Machine Complex in Hamhung, North Korea's second-largest city, on the country's east coast.

Sam Lair, a research associate at the James Martin Center for Nonproliferation Studies (CNS), located at the Middlebury Institute of International Studies at Monterey, said the plant was the only one known to produce the Hwasong-11 class of solid-fuel ballistic missiles. Ukrainian officials say these munitions - known as the KN-23 in the West - have been used by Russian forces in their assault on Ukraine.

The expansion of the complex has not been previously reported.

Both Moscow and Pyongyang have denied that North Korea has transferred weapons for Russia to use against Ukraine, which it invaded in February 2022. Russia and North Korea signed a mutual defense treaty at a summit in June and have pledged to boost their military ties.

North Korea's mission to the United Nations did not respond to a request for comment for this story.

The satellite images, taken in early October by the commercial satellite firm Planet Labs, show what appears to be an additional assembly building under construction as well as a new housing facility, likely intended for workers, according to the analysis by researchers at CNS.

It also appears that Pyongyang is improving the entrances for some of the underground facilities at the complex.

A disused bridge crane that was in front of a tunnel entrance, blocking easy access, was removed, suggesting they might be placing an emphasis on that part of the facility, Lair said.

"We see this as a suggestion that they're massively increasing, or they're trying to significantly increase, the throughput of this factory," Lair said.

The new assembly building is about 60 to 70 percent the size of the previous building used to assemble missiles.

In 2023, state media published images, which Reuters has reviewed, showing North Korean leader Kim Jong Un walking through new buildings at the complex in Hamhung, where workers were assembling tail kits and nose cones for what appeared to be the KN-23, according to analysts.

In the past, publicly released videos from North Korean state media show that the complex has produced everything from tank wheels to the casings for rocket motors, Lair said.

LOW-FLYING MISSILES

The KN-23 was first tested in May 2019, and is designed to evade missile defenses by flying on a lower, "depressed" trajectory, experts have told Reuters, making them potentially useful for Russia as it seeks ways to penetrate Ukraine's air defenses.

Russia has fired thousands of missiles since the invasion. Leaning on North Korea for additional supplies could ease the strain on its own production facilities, Lair said.

North Korea's state news agency KCNA has reported that construction is underway at the Ryongsong Machine Complex.

This month, KCNA said the facility "is pushing ahead with the projects for attaining the goal for modernization planned for this year." The work includes rebuilding production facilities as well as assembling and installing equipment at machine workshops and a steel casting workshop, it said.

Researchers at SI Analytics, a South Korean satellite imagery firm that uses AI technology to scour images, also confirmed the new construction at the February 11 plant, saying in a report on Monday that some of the construction near the loading area would likely be used to conceal the future operations of the factory from satellites.

"Considering the presence of numerous construction materials, vehicles, and open-top freight cars loaded with materials around the site, the construction appears to be progressing rapidly," the firm said. The report said the facility was used to produce ballistic missiles, without naming the KN-23.

Michael Duitsman, also a research associate at CNS, said it was possible that the new construction revealed in the satellite images could be a storage facility, but he believed it was more likely a new assembly building.

North Korean missiles account for a fraction of Russia's strikes during its war on Ukraine, but their alleged use has caused alarm in Seoul and Washington because it suggests an end of nearly two-decade consensus among UN Security Council permanent members on preventing Pyongyang from expanding its ballistic missile programs.

SI Analytics said on Monday it had also identified new construction at the nearby February 8 Vinalon Complex, which is believed to produce fuel for ballistic missiles. The construction may be aimed at boosting production of solid propellants or UDMH, an important liquid rocket engine fuel, the report said.

Joseph Dempsey, a military analyst with London's International Institute for Strategic Studies, said that North Korea's expansion of short-range ballistic missile facilities would likely be motivated mainly by a desire to boost the country's own arsenal.

He said it was unclear to what extent Pyongyang may have expanded production capacity to meet the demands of its new cooperation with Moscow.

More than 10,000 North Korean troops have been deployed to the Russian region of Kursk, where Ukraine launched a major cross-border incursion in August, according to Washington, Kyiv and Seoul.

The troops will fight as part of Russia's airborne unit and marines, with some already participating in battles in the Ukraine war, a South Korean lawmaker who sits on the parliamentary intelligence committee said on Wednesday.

Russia has not denied the involvement of North Korean troops in the war, which it has been waging in Ukraine since launching a full-scale invasion in February 2022.