But wording in the New Jersey indictment had left open the question of whether Atlanta or someone acting on the city’s behalf paid a ransom.
The document described the March 22 assault that crippled Atlanta's network and the effort by the two men to demand ransom. In one paragraph, the indictment said they demanded ransom from Atlanta in Bitcoin payments in exchange for encryption keys to recover the city's compromised data.
The next paragraph said that on April 19, Savandi “received funds associated with ransom proceeds, which were converted into Iranian rial and deposited by” an currency exchanger. Pak’s release Wednesday appeared to be an effort to clear up any doubt about a possible Atlanta ransom payment.
Authorities said there’s no indication the two attackers were acting in concert with the Iranian government.
The two men are not in U.S. custody, and Iran has no extradition treaty with the U. S. But Justice Department officials have expressed confidence that the Savandi and Mansouri’s travel patterns would subject them to being captured.
All told, the pair inflicted harm on more than 200 victims across the country, including health care companies, city governments and state agencies. Their scheme caused over $30 million in losses to various entities, according to federal authorities.
The attacks used "SamSam" ransomware, a type of malware which encrypts files of infected computers and demands a ransom. Authorities said Wednesday that the attack on Atlanta infected approximately 3,789 computers.
In the release Wednesday, Pak said the indictment in Atlanta “vindicates the City of Atlanta’s interest in ensuring that those responsible for the attacks face justice here as well.”