Yemeni Hacker Indicted: Black Kingdom’s Cyber Reign Over 1,500 Systems Ends

Yemeni Hacker Indicted: Black Kingdom’s Cyber Reign Over 1,500 Systems Ends

Summary

• Key Suspect: U.S. prosecutors charged Rami Khaled Ahmed, a 36-year-old Yemeni national, as the alleged developer and main operator of Black Kingdom ransomware.
• Global Impact: The malware was sent to about 1,500 computer systems in the United States and elsewhere, prosecutors say.
• Operations: The attacks exploited Microsoft Exchange server flaws between March 2021 and June 2023, roughly two years.
• Consequences: Named U.S. victims include a medical billing company, a school district, a health clinic and a ski resort.
• Still at large: Ahmed is believed to be in Yemen; no arrest has been announced.

Who was charged and why

A federal grand jury in Los Angeles has indicted Rami Khaled Ahmed, 36, of Sana’a, Yemen, on three counts tied to the Black Kingdom ransomware. Prosecutors say he developed and deployed it.

How Black Kingdom spread

According to the indictment, Ahmed built Black Kingdom to exploit a vulnerability in Microsoft Exchange, and from March 2021 to June 2023 he and others used it to infect victims’ networks. The ransomware encrypted data, or claimed to have stolen it, and left a note demanding $10,000 worth of Bitcoin.

Ahmed is charged with conspiracy, intentional damage to a protected computer and threatening damage to a protected computer. Each count carries up to five years in federal prison. An indictment is only an allegation, and he is presumed innocent unless proven guilty.

Who got hit

The U.S. victims named by prosecutors give a sense of the range: a medical billing services company in Encino, California, a ski resort in Oregon, a school district in Pennsylvania and a health clinic in Wisconsin.

None of them needed to be singled out. Black Kingdom went after whatever unpatched Exchange servers it could find, which is how a ski resort and a school district ended up on the same victim list.

Why an indictment still matters

Ahmed is believed to be living in Yemen, outside the reach of U.S. law enforcement for now. Indictments like this one still limit where a suspect can travel and put the evidence on record if he is ever caught.

The FBI investigated with help from the New Zealand Police. The U.S. Attorney’s Office for the Central District of California announced the charges on May 1, 2025.

What defenders should take from this

The case shows how long an unpatched server stays a target. Microsoft shipped Exchange fixes in March 2021. Black Kingdom kept finding unpatched systems for two more years.

Patch internet-facing servers fast, check Exchange for web shells left behind by earlier break-ins and keep offline backups. Charges against one operator don’t remove the flaw from your network.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.