The person at the center of this case
Multiple organizations across critical infrastructure, government, and non-profit sectors
Cold Case · Open
4 years waiting · since 2022
IRANIAN CYBER ACTORS
Justice for Multiple organizations across critical infrastructure, government, and non-profit sectors — the trail went cold in 2022, but the truth hasn't.
Start here
Key leads to think about
🎯
suspect
Lead #1Where are Mansour Ahmadi, Ahmad Khatibi Aghda, and Amir Hossein Nickaein Ravari currently located?
🔍
evidence
Lead #2How many organizations were victimized and what is the total financial impact of the ransomware campaign?
💡
clue
Lead #3What infrastructure vulnerabilities were exploited to compromise hundreds of networks across multiple sectors?
Three Iranian cyber actors—Mansour Ahmadi, Ahmad Khatibi Aghda, and Amir Hossein Nickaein Ravari—are wanted for orchestrating a sophisticated ransomware campaign that compromised hundreds of computer networks across the United States and internationally between October 2020 and August 2022. The conspiracy targeted critical infrastructure, government agencies, and non-profit organizations, with the actors gaining unauthorized access, stealing data, encrypting systems, and demanding ransom payments. A federal grand jury in New Jersey indicted all three in August 2022, but their whereabouts remain unknown and the investigation continues to identify additional victims and recover damages.
Case
#856
United States District Court for the District of New Jersey; Federal Bureau of Investigation
Try asking
Claim this imported case
A one-time $10 claim transfers this imported case workspace to your account. You get 10 uploads for this case, 25 daily AI questions for this case, and public tips with files route to you.
10 uploads25 AI questions/day
This does not start a subscription. When the included limits are reached, the Personal plan unlocks more workspace capacity.
More leads to consider
Beyond the top three above — each detail below could be the thread that pulls this case open.
📞
contact
Lead #4Are there additional co-conspirators or associates who facilitated the campaign infrastructure?
Have information about any of these leads?
Even the smallest detail could be the key to solving this case.
Official wording
Source Narrative
Conspiracy to Commit Fraud and Related Activity in Connection with Computers; Intentional Damage to a Protected Computer; Transmitting a Demand in Relation to Damaging a Protected Computer Caution: Mansour Ahmadi , Ahmad Khatibi Aghda , and Amir Hossein Nickaein Ravari are wanted for their alleged involvement in a coordinated campaign which compromised hundreds of computer networks across the United States and abroad. Between October 2020 and August 2022, the three men allegedly gained unauthorized access to protected networks, exfiltrated data, encrypted computer systems, and extorted victims for ransom, causing damage to and disrupting operations of organizations across multiple sectors, including critical infrastructure, government agencies, and non-profit organizations.
On August 10, 2022, a federal grand jury sitting in the United States District Court for the District of New Jersey in Newark, New Jersey, indicted Mansour Ahmadi, Ahmad Khatibi Aghda, and Amir Hossein Nickaein Ravari on charges of conspiracy to commit fraud and related activity in connection with computers, intentional damage to a protected computer, and transmitting a demand in relation to damaging a protected computer.
Timeline of Events
🕵️
2020-10-01
Campaign begins
Coordinated ransomware campaign begins with unauthorized network access
🕵️
2022-08-10
Federal indictment
Federal grand jury in Newark, New Jersey indicts Mansour Ahmadi, Ahmad Khatibi Aghda, and Amir Hossein Nickaein Ravari on conspiracy and computer fraud charges
Key Locations
Interactive map showing important locations related to this case
Case Information
Incident:October 1, 2020
Last Updated:October 30, 2026
Up to $10 Reward
For information leading to the resolution of this case
Leave a comment
Comments
Case Information
Incident:October 1, 2020
Last Updated:October 30, 2026
Up to $10 Reward
For information leading to the resolution of this case