Three months later, the FBI says it warned Witt she was a target for Iranian recruitment. Just weeks after that warning, she was hired by an Iranian-American based in Tehran—whom the indictment labels "Individual A"—to work on a film the indictment describes as a documentary with an anti-American bent. The following year, Witt attended the "Hollywoodism" conference again. The Treasury Department joined in Wednesday's press conference to announce new sanctions against New Horizons, as well as an unnamed private firm that employed the hackers she aided.

The indictment details messages Witt allegedly sent to Individual A documenting her transition. "I am endeavoring to put the training I received to good use instead of evil," she wrote, adding a smiling emoji. "Thanks for giving me the opportunity."

They allegedly created a persona named Bella Wood, in an attempt to trick US agents into installing malware.

After her second trip to the New Horizons conference in 2013, Witt allegedly began telling her Iranian-American contact that she was ready to defect, or, as she described it in messages included in the indictment, become a WikiLeaks-style whistle-blower. "If all else fails, I may just go public with a program and do like Snowden :)," she wrote. A week later, she allegedly told Individual A she had "told all" to representatives in the Iranian embassy in Kabul, Afghanistan. Not long after that, apparently frustrated with the suspicion and lack of action from the Iranians, she described a plan to "slip into Russia quietly" and contact WikiLeaks.

Ultimately, it appears that Individual A did help Witt arrange a meeting with Iranian officials in Dubai and finally defect to Tehran.

Once she'd settled in Iran, Witt worked actively for the Iranian government, the indictment charges, telling them classified details of a sensitive "special access project"—only elliptically described in the indictment—and its specific target. Over the next two years, she allegedly helped search Facebook for details of US agents she had previously worked with and assembled "target packages" that provided profiles of the agents for Iranian hackers, even sharing the name of one active agent in a compromising position, endangering that agent's life, according to assistant attorney general Demers.

Bella Wood

The Iranian hackers, according to the indictment, used Witt's target profiles to send phishing emails and social media messages to her former colleagues, including one based in Afghanistan. They allegedly created a persona named Bella Wood, in an attempt to trick US agents into installing malware that would monitor their computer activities, steal passwords, and access their webcam.

"I'll send you a file including my photos but u should deactivate your antivirus to open it," one email from the Bella Wood character read. "I hope you enjoy the photos I designed for the new year, they should opened in your computer honey." In other cases, the hackers sent links spoofing news stories at sites they controlled, as well as fake password reset pages in an attempt to steal Facebook passwords, though it's not clear if any of the intended victims fell for those ruses.

The FBI’s wanted poster for Witt states only that she may be in Southwest Asia—hardly a promising sign that she’ll ever be arrested by American authorities. But as in the growing stack of cases where the US Department of Justice indicts foreign hackers and spies, the FBI and Justice Department says they intend the charges to telegraph a message to anyone who might attempt to follow in her or her handlers’ footsteps.

“Today should serve as a warning to those who seek out our current and former national security personnel for the sensitive information they have, and to those individuals themselves,” said FBI executive assistant director Jay Tabb in Wednesday’s press conference. “Unlike Witt, we take the oaths we swear seriously, and we will continue to pursue those who do not.”

More Great WIRED Stories