U.S. Charges Yemeni Hacker in Black Kingdom Ransomware Attack Affecting 1,500 Systems
May 03, 2025
Cybercrime / Malware
The U.S. Department of Justice (DoJ) announced charges against Rami Khaled Ahmed, a 36-year-old Yemeni national, for allegedly deploying the Black Kingdom ransomware against numerous global targets, including businesses, schools, and hospitals in the United States. Ahmed, currently believed to be residing in Sana’a, Yemen, faces charges of conspiracy, intentional damage to a protected computer, and threatening damage to a protected computer.
According to the DoJ, from March 2021 to June 2023, Ahmed and accomplices compromised the computer networks of several U.S.-based victims, including a medical billing service in Encino, a ski resort in Oregon, a school district in Pennsylvania, and a health clinic in Wisconsin. Ahmed is accused of creating and launching the ransomware by exploiting a known vulnerability in Microsoft Exchange Server referred to as ProxyLogon. The ransomware operation involved encrypting data from targeted systems…
