Hospitals and Schools Under Siege: SamSam’s Targeted Ransomware Campaign

SamSam is ransomware that was used in a sustained campaign from 2016 through 2018, targeting organizations in the United States — primarily hospitals, schools, and government agencies. Unlike most ransomware of the era, it was deployed manually by human operators who first broke into a network, explored it, and then deliberately encrypted as many systems as possible before demanding payment. This made it far more damaging than automated ransomware campaigns.

The US Department of Justice indicted two Iranian nationals — Faramarz Shahi Savandi and Mohammad Mehdi Shah Mansouri — in November 2018 for conducting the SamSam attacks. No state sponsorship was established; the attacks appear to have been financially motivated criminal activity. The indictment did not result in arrests, as both individuals remained outside US jurisdiction.

The goal was financial. The attackers targeted organizations that were likely to pay quickly to restore operations — hospitals that couldn't afford downtime, schools with limited IT resources, and city governments with operational dependencies on their systems. Victims were given the option to pay per-encrypted machine or a flat rate for full network decryption, all in Bitcoin. The campaign generated significant ransom income across multiple years of operation.

SamSam targeted organizations across the United States. Confirmed victim categories include hospitals and healthcare providers, school districts, and municipal governments — most notably the City of Atlanta. The attackers focused on US-based targets throughout the campaign, selecting victims based on their perceived likelihood to pay and the operational damage a ransomware attack would cause.

The attackers got in one of two ways: by exploiting known vulnerabilities in internet-facing application servers (such as unpatched JBoss servers), or by brute-forcing weak passwords on Remote Desktop Protocol (RDP) connections that were exposed to the internet. Once inside, they manually explored the network, harvested credentials, and used a legitimate Windows administration tool called PsExec to push the ransomware to every machine they could reach — maximizing the damage before demanding payment.

SamSam stood out because it was operated by humans, not automated. Most ransomware of the time spread itself indiscriminately. SamSam operators instead behaved like skilled intruders: they entered quietly, took time to understand the target network, moved laterally to reach as many systems as possible, and only triggered the encryption when they were ready to cause maximum damage. They also kept the ransomware payload encrypted on disk until execution and deleted evidence afterward — making it harder for security teams to analyze or recover from.

Hospitals, schools, and government agencies were attractive because they tend to have older or under-maintained IT infrastructure, limited cybersecurity resources, and a strong operational need to restore systems quickly. A hospital that can't access patient records or critical systems faces immediate pressure to pay. Schools and city governments face similar public-service disruptions. The attackers understood this and deliberately chose victims where the cost of downtime exceeded the ransom demand.