SamSam Ransomware: Targeted Attacks Disrupt U.S. Healthcare and Government

In 2018, the SamSam ransomware group carried out targeted attacks against 67 organizations, 56 of them in the United States. The attacks were notable for their precision and patience — operators would break into a network, spend days silently mapping it and stealing credentials, then encrypt as many machines as possible in a single coordinated push. The most damaging attack hit the City of Atlanta in March 2018, taking down municipal systems and costing over $10 million to remediate.

In November 2018, the US Department of Justice indicted two Iranian nationals — Faramarz Shahi Savandi and Mohammad Mehdi Shah Mansouri — for conducting the SamSam attacks. The FBI estimated they had collected $6 million in Bitcoin ransom payments and caused over $30 million in losses to victims. No state sponsorship was established; the attacks are assessed as financially motivated criminal activity. Neither individual was arrested, as both remained outside US jurisdiction.

The motivation was financial extortion. Victims were offered two payment options: pay per encrypted machine at a lower rate, or pay a flat sum to decrypt the entire network. Ransom demands frequently ran into tens of thousands of dollars. The attackers deliberately targeted organizations where the cost of operational downtime — lost patient records, disrupted government services, inaccessible city systems — would make paying the ransom feel more practical than rebuilding from scratch.

Healthcare organizations were the most frequently targeted, making up 24 percent of 2018 attacks. Local government was the second most affected category, with the City of Atlanta and Colorado Department of Transportation among confirmed victims — as well as at least one organization involved in election administration. The vast majority of targets were in the United States, with a small number of attacks in Portugal, France, Australia, Ireland, and Israel.

The attackers gained initial access through RDP brute-force attacks or exploitation of vulnerable internet-facing applications. Once inside, they used only legitimate Windows administration tools — PsInfo to map the network and identify valuable systems, Mimikatz to steal passwords, and PsExec to push the ransomware to remote machines. In one documented case, over 48 hours passed between first intrusion and encryption, during which the attackers worked quietly before encrypting nearly 250 computers in a five-hour window just after 5 a.m.

SamSam used only tools that already exist on Windows systems or are widely used by IT administrators — PsExec, PsInfo, and Mimikatz. This "living off the land" approach meant their activity looked like normal administrative work on network logs, making it extremely difficult for security tools to raise alerts. The same techniques are typically associated with sophisticated nation-state espionage groups, not financially motivated criminal actors — which is part of what made SamSam so effective and damaging.

Healthcare and government organizations tend to run complex, interconnected networks with older infrastructure and limited security resources. Hospitals in particular face immediate pressure to restore systems — patient care can't wait. Government agencies face public accountability and operational obligations that make prolonged outages untenable. The attackers understood this pressure and sized ransom demands to be painful but plausibly payable — making the economics of capitulating feel more attractive than weeks of recovery.