SamSam ransomware Bitcoin addresses

SamSam hit hospitals, universities and city governments, including Atlanta, from 2015 to 2018. In 2018 the US Justice Department indicted two Iranian men over the attacks, and the US Treasury (OFAC) sanctioned two Iranian nationals and their Bitcoin addresses for exchanging the ransom payments.

If a ransom note asked you to pay one of these addresses, report the attack to the police before paying anyone. Paying a sanctioned group can be illegal. Check any address.

All

All ransomware families · What the ransomware data shows