MANHATTAN (CN) – The hacker who began leaking unaired episodes of “Game of Thrones” this summer included a threat to HBO superimposed in the credits. “Winter is coming,” the message said. “HBO is falling.” Between the two phrases was an image of the show’s iconic villain, the Night King.
On Tuesday, U.S. prosecutors traced this graphic to Behzad Mesri, a 29-year-old hacker and suspected cyberwarrior for Iran’s military.
“Mesri was a self-professed expert in computer hacking techniques, and had worked on behalf of the Iranian military to conduct computer network attacks that targeted military systems, nuclear software systems, and Israeli infrastructure,” according to the 16-page indictment unveiled this morning in New York.
Mesri remains at large in Iran, however, and Acting U.S. Attorney Joon Kim stood beside an image of the suspect on an FBI wanted poster this afternoon at a press conference.
“If HBO did not make these payments, Mesri threatened that he would release the scripts and video files of unaired HBO shows and also threatened to destroy important data on HBO’s servers,” Kim told reporters.
Kim showed reporters the image from the leaked footage and another “Game of Thrones” graphic that Mesri allegedly used in his extortion demands to HBO.
“Good luck to HBO,” said a message sent to HBO on July 23, above a similar image of the Night King.
The indictment showcases a string of other taunting messages.
In the message that included the image of the Night King, the email professed: “I have the honor to inform you … that we successfully breached into your huge network.” (Ellipses in indictment.)
The anonymous sender called HBO the victim of “a complicated cyber operation” culling 1.5 terabytes of data.
Prosecutors say the stolen bounty included unaired episodes of “Ballers,” “Barry,” “Room 104,” “Curb Your Enthusiasm” and “The Deuce,” as well as scripts and plot summaries for some of these shows, confidential cast and crew contact lists, and financial documents.
Despite the email’s use of the plural “we,” Kim said his office is not alleging any Iranian collaboration at this time.
In the Night King email, the sender called HBO one “of our difficult targets to deal with but we succeeded.”
Kim declined to comment on whether HBO paid the bitcoin ransom demanded in the emails but noted that its data was leaked online, beginning on July 30.
Kim said Mesri will never leave his country again without fear of arrest.
“Mesri should know and cybercriminals should know that they are not safe behind the anonymity of their computer screens, even if they are a world away,” Kim said.
“If you hack our people, our companies, our institutions, we will work relentlessly and creatively find all the tools available to us to identify you, find you and charge you, and at some point — and it may not be right away — we will arrest you and bring you to justice,” he added.
Mesri’s charges were unsealed one day after the Washington Post reported that national security prosecutors at the Department of Justice have been pressured to speed up investigations involving Iran or Iranian nationals before the cases are ready to become public.
According to the article, senior Justice Department have taken this position because President Donald Trump wants to push for new sanctions against Iran.
Though he acknowledged reading the report, Kim insisted that the timing was a coincidence.
If captured and convicted, Mesri could spend up to 44 years in prison for wire fraud, computer hacking, aggravated identity theft and other charges.