The person at the center of this case
Multiple organizations and government entities across the United States and abroad
Cold Case · Open
3 years waiting · since 2022
AHMAD KHATIBI AGHDA
Justice for Multiple organizations and government entities across the United States and abroad — the trail went cold in 2022, but the truth hasn't.
Start here
Key leads to think about
🎯
suspect
Lead #1What is Ahmad Khatibi Aghda's current location and operational status in Iran?
🔍
evidence
Lead #2Which specific organizations and critical infrastructure systems were compromised, and what data was exfiltrated?
👤
person
Lead #3What are the roles and relationships between Ahmad Khatibi Aghda, Mansour Ahmadi, and Amir Hossein Nickaein Ravari in this conspiracy?
Ahmad Khatibi Aghda is wanted for his alleged role in a sophisticated cybercriminal conspiracy that compromised hundreds of computer networks across the United States and abroad between October 2020 and August 2022. Working with co-conspirators Mansour Ahmadi and Amir Hossein Nickaein Ravari, Khatibi Aghda allegedly gained unauthorized access to protected networks, stole sensitive data, deployed ransomware, and extorted victims—targeting critical infrastructure, government agencies, and non-profit organizations. He remains at large, believed to be residing in Iran, and the FBI seeks information leading to his capture and prosecution.
Case
#732
United States and international networks
Federal Bureau of Investigation (FBI); United States District Court for the District of New Jersey
Try asking
Claim this imported case
A one-time $10 claim transfers this imported case workspace to your account. You get 10 uploads for this case, 25 daily AI questions for this case, and public tips with files route to you.
10 uploads25 AI questions/day
This does not start a subscription. When the included limits are reached, the Personal plan unlocks more workspace capacity.
More leads to consider
Beyond the top three above — each detail below could be the thread that pulls this case open.
💡
clue
Lead #4What ransom demands were made and to which victims, and how were payments facilitated?
📞
contact
Lead #5Are there any known associates, financial intermediaries, or technical infrastructure providers supporting this group?
Have information about any of these leads?
Even the smallest detail could be the key to solving this case.
Official wording
Source Narrative
Conspiracy to Commit Fraud and Related Activity in Connection with Computers; Intentional Damage to a Protected Computer; Transmitting a Demand in Relation to Damaging a Protected Computer Caution: Ahmad Khatibi Aghda, Mansour Ahmadi , and Amir Hossein Nickaein Ravari are wanted for their alleged involvement in a coordinated campaign which compromised hundreds of computer networks across the United States and abroad. Between October 2020 and August 2022, the three men allegedly gained unauthorized access to protected networks, exfiltrated data, encrypted computer systems, and extorted victims for ransom, causing damage to and disrupting operations of organizations across multiple sectors, including critical infrastructure, government agencies, and non-profit organizations.
On August 10, 2022, a federal grand jury sitting in the United States District Court for the District of New Jersey in Newark, New Jersey, indicted Ahmad Khatibi Aghda, Mansour Ahmadi, and Amir Hossein Nickaein Ravari on charges of conspiracy to commit fraud and related activity in connection with computers, intentional damage to a protected computer, and transmitting a demand in relation to damaging a protected computer. Remarks: Ahmad Khatibi Aghda is known to speak Farsi and reside in Iran.
Timeline of Events
🕵️
2020-10-01
Campaign begins
Coordinated cybercriminal campaign begins with unauthorized network access and data exfiltration
🕵️
2022-08-10
Federal indictment
Federal grand jury in the United States District Court for the District of New Jersey indicts Ahmad Khatibi Aghda, Mansour Ahmadi, and Amir Hossein Nickaein Ravari on charges of conspiracy to commit fraud, intentional damage to protected computers, and transmitting extortion demands
Case Information
Incident:October 1, 2020
Last Updated:May 11, 2026
Up to $10 Reward
For information leading to the resolution of this case
Leave a comment
Comments
Case Information
Incident:October 1, 2020
Last Updated:May 11, 2026
Up to $10 Reward
For information leading to the resolution of this case