Skip to main content
The Globe and Mail
Support Quality Journalism
The Globe and Mail
First Access to Latest
Investment News
Collection of curated
e-books and guides
Inform your decisions via
Globe Investor Tools
Just$1.99
per week
for first 24 weeks

Enjoy unlimited digital access
Enjoy Unlimited Digital Access
Get full access to globeandmail.com
Just $1.99 per week for the first 24 weeks
Just $1.99 per week for the first 24 weeks
var select={root:".js-sub-pencil",control:".js-sub-pencil-control",open:"o-sub-pencil--open",closed:"o-sub-pencil--closed"},dom={},allowExpand=!0;function pencilInit(o){var e=arguments.length>1&&void 0!==arguments[1]&&arguments[1];select.root=o,dom.root=document.querySelector(select.root),dom.root&&(dom.control=document.querySelector(select.control),dom.control.addEventListener("click",onToggleClicked),setPanelState(e),window.addEventListener("scroll",onWindowScroll),dom.root.removeAttribute("hidden"))}function isPanelOpen(){return dom.root.classList.contains(select.open)}function setPanelState(o){dom.root.classList[o?"add":"remove"](select.open),dom.root.classList[o?"remove":"add"](select.closed),dom.control.setAttribute("aria-expanded",o)}function onToggleClicked(){var l=!isPanelOpen();setPanelState(l)}function onWindowScroll(){window.requestAnimationFrame(function() {var l=isPanelOpen(),n=0===(document.body.scrollTop||document.documentElement.scrollTop);n||l||!allowExpand?n&&l&&(allowExpand=!0,setPanelState(!1)):(allowExpand=!1,setPanelState(!0))});}pencilInit(".js-sub-pencil",!1); // via darwin-bg var slideIndex = 0; carousel(); function carousel() { var i; var x = document.getElementsByClassName("subs_valueprop"); for (i = 0; i < x.length; i++) { x[i].style.display = "none"; } slideIndex++; if (slideIndex> x.length) { slideIndex = 1; } x[slideIndex - 1].style.display = "block"; setTimeout(carousel, 2500); }

Two men have been indicted on charges stemming from the hacking of dozens of websites based in the United States, actions that the federal authorities said were taken in retaliation for the death in an American drone strike of Gen. Qasem Soleimani of Iran.

The men, Behzad Mohammadzadeh and Marwan Abusrour, were charged with conspiracy to commit intentional damage to a protected computer and intentional damage to a protected computer, according to the indictment, which was dated Sept. 3 and unsealed Tuesday.

Mohammadzadeh, a citizen of Iran who the authorities believe is about 19 years old, and Abusrour, who is about 25 and whom the indictment identifies as “a stateless national of the Palestinian Authority,” are believed to be in their home countries.

Story continues below advertisement

The indictment, announced by the U.S. Attorney’s Office for the District of Massachusetts, did not identify or describe the approximately 51 websites that were attacked. The attacks began days after American officials announced the death of Soleimani, Iran’s most powerful security and intelligence commander, in a drone strike at Baghdad International Airport on Jan. 2, according to the indictment.

Soleimani was the long-time head of the Islamic Revolutionary Guards Corps’ Quds Force, the foreign-facing branch of Iran’s powerful security apparatus. Shortly after his death was announced, Mohammadzadeh transmitted codes to 51 websites in the United States, making them display pictures of Soleimani against an Iranian flag and messages including “Down with America,” according to the indictment.

“These hackers are accused of orchestrating a brazen cyberassault that defaced scores of websites across the country as a way of protesting and retaliating against the United States for killing the leader of a foreign terrorist organization,” Joseph R. Bonavolonta, special agent in charge of the FBI’s Boston Division, said in a statement. “Now, they are wanted by the FBI and are no longer free to travel outside Iran or Palestine without risk of arrest.”

It was not immediately clear if Mohammadzadeh or Abusrour had a lawyer.

According to the indictment, Mohammadzadeh had publicly claimed that he had hacked more than 1,100 websites around the world to display pro-Iranian messages since September 2018.

Abusrour had publicly claimed he had defaced more than 300 websites with pro-Islamic and pro-Palestinian messages, the indictment says. He was also a known hacker who had sent unsolicited emails for profit and traded stolen credit cards, according to the indictment.

The two men began working together in December 2019, the indictment said.

Story continues below advertisement

On Jan. 2, the Defense Department released a statement claiming responsibility for the air strike that killed Soleimani, stating that it was “aimed at deterring future Iranian attack plans.” The killing prompted worldwide political upheaval.

In addition to displaying images of Soleimani and anti-American slogans, the hacked sites directed visitors to Mohammadzadeh’s public Instagram page, which included a link to a website where he had posted 400 times, bragging about his hacking activities, the indictment says.

One post to Mohammadzadeh’s Instagram account showed messages he exchanged with Abusrour that listed several of the websites they had defaced, according to court documents.

Soleimani had long been designated a terrorist by the United States and Israel, but many in Iran lauded him as a hero. A New York Times analysis described the strike, which also killed several officials from Iraqi militias backed by Iran, as “the riskiest move made by the United States in the Middle East since the invasion of Iraq in 2003” given the likelihood of an Iranian military response.

After Soleimani was killed, the chief of cybersecurity at the Department of Homeland Security warned the public to be on alert for cyberattacks.

The website of at least one federal agency, the Federal Depository Library Program, was hacked in early January to feature a doctored photograph of President Donald Trump being punched in the jaw superimposed over a map of the Middle East, and a tribute to Soleimani. It was not clear Tuesday if that website was among the 51 referred to in the indictment.

Story continues below advertisement

“Hacked by Iran Cyber Security Group Hackers,” text on the website read before it was put back online. “This is only small part of Iran’s cyber ability!”

Report an error
Due to technical reasons, we have temporarily removed commenting from our articles. We hope to have this fixed soon. Thank you for your patience. If you are looking to give feedback on our new site, please send it along to feedback@globeandmail.com. If you want to write a letter to the editor, please forward to letters@globeandmail.com.

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to letters@globeandmail.com. Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to letters@globeandmail.com. Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff.

We aim to create a safe and valuable space for discussion and debate. That means:

  • Treat others as you wish to be treated
  • Criticize ideas, not people
  • Stay on topic
  • Avoid the use of toxic and offensive language
  • Flag bad behaviour

Comments that violate our community guidelines will be removed.

Read our community guidelines here

Discussion loading ...

To view this site properly, enable cookies in your browser. Read our privacy policy to learn more.
How to enable cookies