Conspiracy to Commit Fraud and Related Activity in Connection with Computers; Conspiracy to Commit Wire Fraud; Intentional Damage to a Protected Computer; Transmitting a Demand in Relation to Damaging a Protected Computer


  • Mohammad Mehdi Shah Mansouri
  • Faramarz Shahi Savandi


Wanted by the FBI: Iranians Indicted for SamSam Ransomware Hacking and Extortion Scheme

Two Iranian men are wanted for their alleged roles in the creation and deployment of a sophisticated malicious software that caused more than $30 million in losses to more than 200 victim hospitals, schools, and other entities.

Featured News Item:

November 28, 2018

Ransomware Suspects Indicted

Two Iranian men were indicted in connection with the deployment of the sophisticated and sinister SamSam ransomware that crippled the operations of critical facilities in the U.S. and Canada.


Mohammad Mehdi Shah Mansouri is an Iranian male with a date of birth of September 24, 1991.  He has brown hair and brown eyes and was born in Qom, Iran.

Faramarz Shahi Savandi is an Iranian male who was born in Shiraz, Iran, on September 16, 1984.

Both men are known to speak Farsi and reside in Tehran, Iran.


Mohammad Mehdi Shah Mansouri and Faramarz Shahi Savandi are wanted for allegedly launching SamSam ransom ware, aka MSIL/Samas.A attacks, which encrypted hundreds of computer networks in the United States and other countries.  Since December of 2015, Shah Mansouri and Shahi Savandi have received over $6 million in ransom payments from victims across several sectors, including critical infrastructure, healthcare, transportation, and state/local governments.


On November 26, 2018, a federal grand jury sitting in the United States District Court for the District of New Jersey, Newark, New Jersey, indicted Shah Mansouri and Shahi Savandi on charges of conspiracy to commit fraud and related activity in connection with computers, conspiracy to commit wire fraud, intentional damage to a protected computer, and transmitting a demand in relation to damaging a protected computer.  The District of New Jersey issued a federal arrest warrant for both men.


Submit a Tip:

If you have any information concerning these individuals, please contact your local FBI office, or the nearest American Embassy or Consulate.

Field Office: Newark

Submit an anonymous Tip online