36-year-old Rami Khaled Ahmed, a Yemeni national, indicted for operating Black Kingdom ransomware targeting Microsoft Exchange servers in over 1,500 attacks worldwide.
Ahmed and co-conspirators infected systems of various victims, demanding $10,000 in Bitcoin for decryption.
Black Kingdom ransomware exploited ProxyLogon vulnerabilities in Microsoft Exchange servers to gain access, compromising around 1,500 servers.
Ahmed faces federal charges that could lead to 15 years in U.S. federal prison if convicted. He is believed to be currently in Yemen.