Charges Against Iranian National For Conducting Cyber Attack And $6 M Extortion Scheme Against HBO

https://www.justice.gov/usao-sdny/pr/acting-manhattan-us-attorney-announces-charges-against-iranian-national-conducting

Department of Justice
U.S. Attorney’s Office
Southern District of New York

FOR IMMEDIATE RELEASE
Tuesday, November 21, 2017

Acting Manhattan U.S. Attorney Announces Charges Against Iranian National For Conducting Cyber Attack And $6 Million Extortion Scheme Against HBO

Defendant Leaked Confidential Information Regarding HBO Original Series, “Game of Thrones,” and other Popular HBO Original Programming

Joon H. Kim, the Acting United States Attorney for the Southern District of New York, and William F. Sweeney Jr., the Assistant Director-in-Charge of the New York Field Division of the Federal Bureau of Investigation (“FBI”), announced today the unsealing of an indictment charging BEHZAD MESRI, a/k/a “Skote Vahshat,” for his involvement in a scheme to obtain unauthorized access to the computer systems of Home Box Office, Inc. (“HBO”), steal proprietary data from those systems, and obtain $6 million worth of Bitcoin from HBO through extortion by threatening to disseminate stolen content. Subsequently, MESRI leaked the stolen content on the Internet, including but not limited to confidential information about upcoming episodes of the popular television series, “Game of Thrones,” and video files containing unreleased episodes of other television series created by HBO.

MESRI is an Iran-based computer hacker who had previously worked on behalf of the Iranian military to conduct computer network attacks that targeted military systems, nuclear software systems, and Israeli infrastructure. At certain times, MESRI has been a member of an Iran-based hacking group called the Turk Black Hat security team and, as a member of that group, conducted hundreds of website defacements using the online hacker pseudonym “Skote Vahshat” against websites in the United States and elsewhere.

Starting in approximately May 2017, MESRI conducted online reconnaissance of HBO’s computer networks and employees. Among other things, MESRI searched for access points to the network where employees and other authorized users could remotely access HBO’s computer systems.

From approximately May 2017 to July 2017, MESRI successfully compromised multiple user accounts belonging to HBO employees and other authorized users, and used those accounts to repeatedly obtain unauthorized access to HBO’s computer servers. Over the course of several months, MESRI used that unauthorized access to steal confidential and proprietary information belonging to HBO, which he then exfiltrated to servers under his control. Through the course of the intrusions into HBO’s systems, MESRI was responsible for stealing confidential and proprietary data belonging to HBO, including, but not limited to: (a) confidential video files containing unaired episodes of original HBO television programs, including episodes of “Barry,” “Ballers,” “Curb Your Enthusiasm,” “Room 104,” and “The Deuce;” (b) scripts and plot summaries for unaired programming, including but not limited to episodes of “Game of Thrones;”(c) confidential cast and crew contact lists; (d) emails belonging to at least one HBO employee; (e) financial documents; and (f) online credentials for HBO social media accounts (collectively, the “Stolen Data”).

Between approximately July 23, 2017, and July 29, 2017, MESRI engaged in a scheme to extort HBO by transmitting, or aiding and abetting the transmission of, the following email messages, each of which was sent to multiple HBO executives and employees:
(snip)

Starting on approximately July 30, 2017, and continuing through August 2017, MESRI caused portions of the Stolen Data to be publicly leaked over the Internet on websites that he controlled. Certain of the video materials that MESRI caused to be leaked included a graphic depicting the “Night King” that was superimposed at the bottom of the video. In addition, MESRI undertook efforts to promote the leaks of the Stolen Data on the Internet, including by, among other things, causing emails to be sent to members of the media regarding the leaks, and causing the creation of a Twitter profile to announce the leaks and provide evidence of the hack of HBO’s computer network.
(snip)