US Indicts Black Kingdom Hacker for Exchange Hacking Tear

A Yemini man faces charges in U.S. federal court for being the mastermind behind a rash of ransomware attacks that took advantage of the 2021 Microsoft Exchange flaw known as ProxyLogon.

See Also: Why Cyberattackers Love ‘Living Off the Land’

A Los Angeles federal grand jury in June 2024 indicted Rami Khaled Ahmed, 36, in a court case prosecutors unsealed Thursday. U.S. authorities believe Ahmed still currently resides in Yemen.

The indictment accuses Ahmed of creating malware in March 2021 under the “Black Kingdom” ransomware brand that used an authentication bypass flaw fixed by Microsoft in an emergency patch that month. The computing giant rushed out the fix after apparent Chinese nation-state groups exploited ProxyLogon flaws to install backdoors.

Black Kingdom malware unleashed in the patch’s wake was “rudimentary and amateurish,” cybersecurity experts said at the time – but that didn’t stop Ahmed and his co-conspirators from infecting roughly 1,500 computer systems through mid-2023, according to figures cited by prosecutors (see: ‘Black Kingdom’ Ransomware Hits Unpatched Exchange Servers).

The extortion demand made by Black Kingdom hackers looks modest in an era when ransomware payments routinely amount to hundreds of thousands of dollars and even tens of millions. The ransom note left by hackers directed victims to pay $10,000 in Bitcoin.

U.S.-based victims included a Los Angeles medical billing services company in, a ski resort in Oregon, a school district in Pennsylvania and a health clinic in Wisconsin, government attorneys said. The case is being prosecuted in the U.S. District of the Central District of California. Ahmed is charged with one count of conspiracy, one count of intentional damage to a protected computer and one count of threatening damage to a protected computer. Each charge carries a maximum sentence of five years.

Prosecutors said Ahmed relied on infamous online file storage service Megaupload by having infected computers connect to a Mega repository with a hardcoded credential to obtain a dynamic encryption key.

Black Kingdom’s dive into ProxyLogon was not its first foray into using a major vulnerability with a long tail of patching to deliver ransomware. Cybersecurity researchers in 2020 spotted the group using a vulnerability on the Pulse Secure VPN – now Pulse Connect Secure made by Ivanti – to gain access to corporate networks (see: Hackers Hit Unpatched Pulse Secure and Fortinet SSL VPNs).