Yemeni Man Charged in Federal Indictment Alleging He Sent ‘Black Kingdom’ Malware to Extort Businesses, Schools, and Medical Clinics

LOS ANGELES – A Yemeni national was charged today in a three-count federal grand jury indictment alleging he deployed the so-called “Black Kingdom” ransomware against computer servers owned organizations worldwide, including businesses, schools, and hospitals in the United States, including a medical billing services company in the San Fernando Valley.

Rami Khaled Ahmed, 36, a.k.a. “Black Kingdom,” of Sana’a, Yemen, is charged with one count of conspiracy, one count of intentional damage to a protected computer, and one count of threatening damage to a protected computer. He is believed to be residing in Yemen.

According to the indictment, from March 2021 to June 2023, Ahmed and others infected computer networks of several U.S.-based victims, including a medical billing services company in Encino, a ski resort in Oregon, a school district in Pennsylvania, and a health clinic in Wisconsin. Ahmed developed and deployed Black Kingdom ransomware to exploit a vulnerability in Microsoft Exchange.

The ransomware either encrypted data from victims’ computer networks or claimed to take that data from the networks. When the malware was successful, the ransomware then created a ransom note on the victim’s system that directed the victim to send $10,000 worth of Bitcoin to a cryptocurrency address controlled by a co-conspirator and to send proof of this payment to a Black Kingdom email address.

During the conspiracy, the Black Kingdom conspirators caused the transmission of the Black Kingdom malware to approximately 1,500 computer systems in the United States and elsewhere.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.       

If convicted, Ahmed would face a statutory maximum sentence of five years in federal prison for each count.

The FBI is investigating this matter with assistance from the New Zealand Police.

Assistant United States Attorneys Angela C. Makabali and Alexander Gorin of the Cyber and Intellectual Property Crimes Section are prosecuting this case.