Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

In September 2020, U.S. prosecutors charged Hooman Heidarian and Mehdi Farhadi with alleged fraud, computer intrusions and damage, access-device fraud, and aggravated identity theft. The Justice Department also alleged that their activity, which reportedly began in at least 2013, targeted organizations across several sectors and involved large-scale data theft. The charges were accusations, not proof of guilt; the report does not establish the case’s later court status.

Who were the two men named in the charges?

SecurityWeek reported on September 17, 2020, that the defendants were Hooman Heidarian, also known as “neo,” and Mehdi Farhadi, also known as Mehdi Mahdavi and Mohammad Mehdi Farhadi Ramin. The report listed their ages at the time as 30 and 34, respectively, and said both were from Hamedan, Iran. Those ages describe the 2020 report, not their current ages. SecurityWeek’s report was contemporaneous reporting, not the indictment itself.

What were they charged with?

The report said the two men faced charges of conspiracy to commit fraud and wire fraud, unauthorized access to protected computers, unauthorized damage to protected computers, access device fraud, and aggravated identity theft. These are reported charges, not convictions or established findings of fact.

What did prosecutors allege they did?

Targets and information

According to the 2020 report, the alleged activity began in at least 2013 and reached targets including an aerospace company, a defense contractor, U.S. and foreign universities, a Washington, D.C.-based think tank, foreign governments, a foreign-policy organization, NGOs, and nonprofits. Some of the attacks were allegedly conducted in the interest of the Iranian government.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The information described as targeted included national-security communications, foreign-policy material, aerospace and financial information, personally identifying information, non-military nuclear data, intellectual property, and information involving human-rights activists. These descriptions reflect allegations reported at the time.

Intrusion and disruption methods

The report described alleged online reconnaissance and vulnerability scanning, session hijacking, SQL injection, malware, keyloggers, and remote-access Trojans. It also said a botnet was allegedly used to spread malware, launch distributed denial-of-service (DDoS) attacks, and send spam. Automated email-forwarding rules allegedly copied messages to accounts controlled by the attackers.

The men were also reported to have been charged with defacing websites with political and ideological content. Prosecutors allegedly characterized the defacements as an effort to project Iranian influence and threaten people viewed as enemies of Iran.

How much data was allegedly stolen?

SecurityWeek reproduced a Justice Department statement alleging that the defendants stole “hundreds of terabytes” of data, including confidential work product, intellectual property, and personal identifying information such as credentials, names, addresses, phone numbers, Social Security numbers, and birthdates. The statement also alleged that stolen data was marketed on the black market. “Hundreds of terabytes” is the Justice Department’s reported allegation, not an independently verified measurement in the SecurityWeek account.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What is known about the case after the 2020 report?

The cited September 17, 2020 report does not establish what happened in court after the charges were announced. It therefore cannot support a claim that either defendant was convicted, taken into custody, or has a particular current case status. An indictment and the charges reported from it are accusations; guilt must be determined through the legal process.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.