'Game of Thrones' Scripts Stolen by Iranian Hacker Who Demanded $6 Million Bitcoin Ransom

Behzad Mesri hacked HBO to steal “Game of Thrones“ scripts and demanded a Bitcoin ransom while also sending the network mocking images like this one, according to federal prosecutors. U.S. Attorney's Office

An Iranian hacker gained access to HBO's servers and stole unaired episodes of popular shows along with Game of Thrones scripts, and then sent the network mocking images from the blockbuster show along with a demand for a $6 million Bitcoin ransom, federal prosecutors announced Tuesday.

Behzad Mesri, a hacker who has worked on behalf of the Iranian military to target Israeli infrastructure, began conducting online reconnaissance of HBO's computer networks and employees in May, according to his indictment, which was unsealed Tuesday. He then used compromised employee accounts to gain access to HBO computer servers.

Mesri used that access to steal a huge amount of data from HBO, including unaired episodes of HBO shows including Curb Your Enthusiasm, Ballers and The Deuce. He also stole scripts and plot summaries for unaired shows including Game of Thrones, as well as emails and financial documents, the indictment states.

Behzad Mesri demanded a “non-negotiable” ransom of $5.5 million in Bitcoin and included an image of the “Night King,” a villain from “Game of Thrones,” with the message “Good luck to HBO,” according to federal prosecutors. U.S. Attorney's Office

Mesri is not in federal custody and authorities don't know where he is, a U.S. attorney spokesperson said.

In late July, Mesri began trying to extort HBO into paying him a ransom for what he called, "1.5 terabytes of HBO's precious data." In an anonymous email sent July 23, Mesri said, "Hi to All losers! Yes it's true! HBO is hacked! Beware of heart Attack!" In another email the same day, Mesri demanded a "non-negotiable" Bitcoin ransom of $5.5 million and included an image of the Night King, a villain from Game of Thrones, with the message "Good luck to HBO."

Later that month, Mesri leaked some of the stolen video online with the "Night King" image superimposed over it, and the words, "Winter is Coming, HBO is Falling."

He even promoted the leaks online with a Twitter profile and emails to the media, according to the indictment.

"Hi to all mankind. The greatest leak of cyber space era is happening," read one email circulated among reporters. "You are lucky to be the first pioneers to witness and download the leak. Enjoy it & spread the words."

Mesri was a member of an Iran-based hacking group called the Turk Black Hat Security team, and he defaced hundreds of websites using the hacker name Skote Vahshat, according to the indictment.

National security prosecutors at the U.S. Department of Justice were told to look for any ongoing investigations involving Iran that could be made public, The Washington Post reported earlier this week, possibly because the Trump administration wants Congress to impose tougher sanctions on the country. New criminal cases against Iran could push lawmakers to do so, according to the newspaper.

Mesri was charged with computer fraud, extortion and identity theft. The U.S. Attorney's Office for the Southern District of New York is scheduled to announce charges against Mesri at 12:30 p.m. Tuesday at its headquarters in downtown Manhattan. The press conference will be livestreamed on Facebook on the office's page, @USAOSDNY.