
The U.S. Department of Justice announced a major breakthrough in an international cybercrime investigation as Sina Gholinejad, a 37-year-old Iranian national, pleaded guilty to participating in a wide-ranging ransomware and extortion campaign leveraging the Robbinhood ransomware variant.
According to court records and statements, Gholinejad and his co-conspirators compromised computer networks of multiple U.S. cities and entities, encrypting critical files to extort Bitcoin ransom payments. Among the most affected victims were the City of Greenville, North Carolina, and the City of Baltimore, Maryland — the latter of which suffered over $19 million in damages and prolonged outages of vital city functions.
“The ransomware attack against the City of Baltimore forced the city to take hundreds of computers offline and prevented the city from performing basic functions for months,” said Matthew R. Galeotti, Head of the DOJ’s Criminal Division. “Gholinejad’s conviction reflects the Criminal Division’s commitment to bringing cybercriminals who target our cities, healthcare system, and businesses to justice no matter where they are located.”
The attackers began their campaign as early as January 2019, first gaining unauthorized access to victims’ networks and then exfiltrating sensitive data to servers under their control. Once entrenched, they deployed Robbinhood ransomware, encrypting victim files and demanding Bitcoin ransoms in exchange for decryption keys. The attack crippled public services in Baltimore, including online platforms for property taxes, water bills, and parking citations, creating months-long disruptions in city revenue streams.
“Cybercrime is not a victimless offense — it is a direct attack on our communities,” said Acting U.S. Attorney Daniel P. Bubar for the Eastern District of North Carolina. “The announcement today marks a significant step towards justice for the countless victims impacted by the defendant’s malicious scheme.”
Gholinejad and his accomplices allegedly used cryptocurrency mixing services and engaged in chain-hopping — the practice of converting ransoms between different cryptocurrencies — to obscure the financial trail. They also employed VPNs and anonymous infrastructure to evade detection and maintain operational secrecy.
The investigation revealed additional victims, including the City of Gresham, Oregon, and the City of Yonkers, New York, demonstrating the multi-jurisdictional scale of the operation.
“This case demonstrates the capability and resolve of the FBI and our partners to find and impose consequences on cybercriminals no matter where they attempt to hide,” said James C. Barnacle Jr., Acting Special Agent in Charge of the FBI’s Charlotte Field Office.
Gholinejad pleaded guilty to one count of computer fraud and abuse and one count of conspiracy to commit wire fraud. He now faces up to 30 years in prison, with sentencing scheduled for August. A federal judge will determine the final sentence based on the U.S. Sentencing Guidelines and statutory factors.