Category: MIL-OSI

Posted on

California Man Sentenced for Acting as an Illegal Agent of the People’s Republic of China Government and Bribery

Source: US FBI

John Chen Furthered the PRC Government’s Transnational Repression Campaign Against the Falun Gong by Paying Cash Bribes to a Purported IRS Official

John Chen, 71, of the People’s Republic of China (PRC) and Los Angeles, was sentenced today to 20 months in prison for acting as unregistered agents of the PRC and bribing an IRS agent in connection with a plot to target U.S.-based practitioners of Falun Gong — a spiritual practice banned in the PRC.

According to court documents, from at least approximately January 2023 to May 2023, Chen and co-defendant Lin Feng, 44, a PRC citizen and resident of Los Angeles, California, worked inside the United States at the direction of the PRC government, including an identified PRC government official PRC Official-1, to further the PRC government’s campaign to repress and harass Falun Gong practitioners. The PRC government has designated the Falun Gong as one of the “Five Poisons,” or one of the top five threats to its rule. In China, Falun Gong adherents face a range of repressive and punitive measures from the PRC government, including imprisonment.

As part of the PRC’s campaign against the Falun Gong, Chen and Feng engaged in a PRC government-directed scheme to manipulate the IRS’ Whistleblower Program in an effort to strip the tax-exempt status of an entity run and maintained by Falun Gong practitioners, the Shen Yun Performing Arts Center. After Chen filed a defective whistleblower complaint with the IRS (the Chen Whistleblower Complaint), Chen and Feng paid $5,000 in cash bribes and promised to pay substantially more to a purported IRS agent (Agent-1) who was, in fact, an undercover officer, in exchange for Agent-1’s assistance in advancing the complaint. Neither Chen nor Feng notified the Attorney General that they were acting as agents of the PRC in the United States.

In the course of the scheme, Chen, on a recorded call, explicitly noted that the purpose of paying these bribes, which were directed and funded by the PRC, was to carry out the PRC government’s aim of “toppl[ing] . . . the Falun Gong.” During a call intercepted pursuant to a judicially authorized wiretap, Chen and Feng discussed receiving “direction” on the bribery scheme from PRC Official-1, deleting instructions received from PRC Official-1 in order to evade detection, and “alert[ing]” and “sound[ing] the alarm” to PRC Official-1 if Chen and Feng’s meetings to bribe Agent-1 did not go as planned. Chen and Feng also discussed that PRC Official-1 was the PRC government official “in charge” of the bribery scheme targeting the Falun Gong.

As part of this scheme, Chen and Feng met with Agent-1 in Newburgh, New York, on May 14, 2023. During the meeting, Chen gave Agent-1 a $1,000 cash bribe as an initial, partial bribe payment. Chen further offered to pay Agent-1 a total of $50,000 for opening an audit on the Shen Yun Performing Arts Center, as well as 60% of any whistleblower award from the IRS if the Chen Whistleblower Complaint were successful. On May 18, 2023, Feng paid Agent-1 a $4,000 cash bribe at John F. Kennedy International Airport as an additional partial bribe payment in furtherance of the scheme.

Assistant Attorney General Matthew G. Olsen of the Justice Department’s National Security Division, U.S. Attorney Damian Williams for the Southern District of New York, and Executive Assistant Director Robert R. Wells of the FBI’s National Security Branch made the announcement.

In addition to the prison term, Chen was sentenced to three years of supervised release and ordered to forfeit $50,000. Feng was sentenced on Sept. 26, to a time-served sentence of 16 months in prison.

The FBI and Office of the Treasury Inspector General for Tax Administration investigated the case.

Assistant U.S. Attorneys Qais Ghafary, Michael D. Lockard, and Kathryn Wheelock for the Southern District of New York and Trial Attorney Christina Clark of the National Security Division’s Counterintelligence and Export Control Section prosecuted the case.

Posted on

Phobos Ransomware Administrator Extradited from South Korea to Face Cybercrime Charges

Source: US FBI

Russian National Alleged to Have Coordinated Sale, Distribution, and Operation of Phobos Ransomware as Part of International Hacking and Extortion Conspiracy

The Justice Department unsealed criminal charges today against Evgenii Ptitsyn, 42, a Russian national, for allegedly administering the sale, distribution, and operation of Phobos ransomware. Ptitsyn made his initial appearance in the U.S. District Court for the District of Maryland on Nov. 4 after being extradited from South Korea. Phobos ransomware, through its affiliates, victimized more than 1,000 public and private entities in the United States and around the world, and extorted ransom payments worth more than $16 million dollars.

“The Justice Department is committed to leveraging the full range of our international partnerships to combat the threats posed by ransomware like Phobos,” said Deputy Attorney General Lisa Monaco. “Evgenii Ptitsyn allegedly extorted millions of dollars of ransom payments from thousands of victims and now faces justice in the United States thanks to the hard work and ingenuity of law enforcement agencies around the world — from the Republic of Korea to Japan to Europe and finally to Baltimore, Maryland. Together with our partners across the globe, we will continue to hold cybercriminals accountable and protect innocent victims.”

“The indictment alleges that Ptitsyn and his co-conspirators ran the Phobos ransomware group, whose members committed ransomware attacks against more than 1,000 public and private victims throughout the United States and the rest of the world,” said Principal Deputy Assistant Attorney General Nicole M. Argentieri, head of the Justice Department’s Criminal Division. “Ptitsyn and his co-conspirators hacked not only large corporations but also schools, hospitals, nonprofits, and a federally recognized tribe, and they extorted more than $16 million in ransom payments. Ptitsyn’s indictment, arrest, and extradition reflect the Criminal Division’s commitment to leading the fight against the international scourge of ransomware. We are especially grateful to our domestic and foreign law enforcement partners, like South Korea, whose collaboration is essential to disrupting and deterring the most significant cybercriminal threats facing the United States.”

“It’s only a matter of time, cybercriminals will be caught and brought to justice,” said U.S. Attorney Erek L. Barron for the District of Maryland. “According to the indictment, Ptitsyn facilitated the worldwide use of a dangerous ransomware strain to target corporations and various organizations, including government agencies, healthcare facilities, educational institutions, and critical infrastructure. The U.S. Attorney’s Office for the District of Maryland is committed to bringing cybercriminals to justice and working with the private sector and the academic community to prevent and disrupt their activities.”

“The FBI is working tirelessly to ensure that ransomware actors, both developers and affiliates, face the consequences of their actions,” said Assistant Director Bryan Vorndran of the FBI’s Cyber Division. “We know it takes strong partnerships to disrupt cybercriminal networks, and the FBI must thank our partners for the important roles they play in carrying out this mission. The extradition announced today would not have been possible without their assistance.”

As alleged in the indictment, beginning in at least November 2020, Ptitsyn and others conspired to engage in an international computer hacking and extortion scheme that victimized public and private entities through the deployment of Phobos ransomware.

As part of the scheme, Ptitsyn and his co-conspirators allegedly developed and offered access to Phobos ransomware to other criminals or “affiliates” for the purposes of encrypting victims’ data and extorting ransom payments from victims. The administrators operated a darknet website to coordinate the sale and distribution of Phobos ransomware to co-conspirators and used online monikers to advertise their services on criminal forums and messaging platforms. At relevant times, Ptitsyn allegedly used the monikers “derxan” and “zimmermanx.”

Affiliates would then allegedly hack into the victims’ computer networks, often using stolen or otherwise unauthorized credentials; copy and steal files and programs on the victims’ networks; and encrypt the original versions of the stolen data on the networks by installing and executing Phobos ransomware. Affiliates then extorted the victims for ransom payments in exchange for the decryption keys to regain access to encrypted data by leaving ransom notes on compromised victims’ computers and by calling and emailing victims to initiate the ransom payment negotiations. Affiliates also threatened to expose victims’ stolen files to the public or to the victims’ clients, customers, or constituents if the ransoms were not paid.

After a successful Phobos ransomware attack, criminal affiliates paid fees to Phobos administrators like Ptitsyn for a decryption key to regain access to the encrypted files. Each deployment of Phobos ransomware was assigned a unique alphanumeric string in order to match it to the corresponding decryption key, and each affiliate was directed to pay the decryption key fee to a cryptocurrency wallet unique to that affiliate. From December 2021 to April 2024, the decryption key fees were then transferred from the unique affiliate cryptocurrency wallet to a wallet controlled by Ptitsyn.

Ptitsyn is charged in a 13-count indictment with wire fraud conspiracy, wire fraud, conspiracy to commit computer fraud and abuse, four counts of causing intentional damage to protected computers, and four counts of extortion in relation to hacking. If convicted, Ptitsyn faces a maximum penalty of 20 years in prison for each wire fraud count; 10 years in prison for each computer hacking count; and five years in prison for conspiracy to commit computer fraud and abuse. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

The FBI Baltimore Field Office is investigating the case. The Justice Department’s Office of International Affairs worked with the International Criminal Affairs Division of the Korean Ministry of Justice to secure the arrest and extradition of Ptitsyn. The Justice Department extends its thanks to international judicial and law enforcement partners in South Korea, the United Kingdom, Japan, Spain, Belgium, Poland, Czech Republic, France, and Romania, as well as Europol and the U.S. Department of Defense Cyber Crime Center, for their cooperation and coordination with the Phobos ransomware investigation. The Justice Department’s National Security Division also provided valuable assistance.

Senior Counsel Aarash A. Haghighat of the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorneys Aaron S.J. Zelinsky and Thomas M. Sullivan for the District of Maryland are prosecuting the case. CCIPS Trial Attorney Riane Harper and former Assistant U.S. Attorney Jeffrey J. Izant for the District of Maryland provided substantial assistance.

Additional details on protecting networks against Phobos ransomware are available at StopRansomware.gov, including Cybersecurity and Infrastructure Security Agency Advisory AA24-060A.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Posted on

FBI Statement Regarding Offensive Text Messages

Source: US FBI

The FBI is aware of the offensive and racist text messages sent to African American and Black communities around the country and is in contact with the Justice Department and other federal authorities on the matter. The reports are not identical and vary in their specific language, but many say the recipient has been selected to pick cotton on a plantation.

The text message recipients have now expanded to high school students, as well as both the Hispanic and LGBTQIA+ communities. Some recipients reported being told they were selected for deportation or to report to a re-education camp. The messages have also been reported as being received via email communication.

Although we have not received reports of violent acts stemming from these offensive messages, we are evaluating all reported incidents and engaging with the Department of Justice Civil Rights Division. We are also sharing information with our law enforcement partners and community, academia, and faith leaders.

Recipients of messages consistent with those described are encouraged to report the details to the FBI by phone at 1-800-CALL-FBI (1-800-225-5324) or online at tips.fbi.gov.

As always, we encourage members of the public to remain vigilant and report threats of violence or anything they consider suspicious to law enforcement immediately, call their local FBI office, or submit a report to tips.fbi.gov.

Posted on

U.S. Government Employee Charged with Two Counts of Unlawfully Transmitting National Defense Information

Source: US FBI

A U.S. government employee working overseas was charged with unlawfully transmitting two highly sensitive classified documents last month.

According to court documents, Asif William Rahman, 34, held a Top Secret/Sensitive Compartmented Information (SCI) security clearance as part of his role working for the U.S. government. According to an indictment filed in the Eastern District of Virginia on Nov. 7, Rahman, on or about Oct. 17, retained without authorization two documents classified at the Top Secret/SCI level, which contained information relating to national defense, and transmitted those documents to a person not entitled to receive them.

Rahman made his initial appearance in federal court in Guam on Nov. 14. The court ordered Rahman’s continued detention and removal from the District of Guam for further court hearings in the Eastern District of Virginia.

The FBI is investigating the case with valuable assistance from the U.S. Department of State’s Diplomatic Security Service.

The U.S. Attorney’s Office for the Eastern District of Virginia and National Security Division’s Counterintelligence and Export Control Section are prosecuting the case.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Posted on

FBI Seeking Individual Who May Have Information Regarding the Identity of a Child Sexual Abuse Victim

Source: US FBI

Photographs and an informational poster depicting the unknown individual, known only as John Doe 49, are being disseminated to the public and can be found online at fbi.gov/wanted/ecap.

Initial video of the unidentified male, John Doe 49, was first recorded by the National Center for Missing and Exploited Children and is believed to have been produced on or before July of 2024. There is no EXIF data em-bedded within the video file.

John Doe 49 is described as a white male between 45 and 65 years old, bald, with a dark goatee. He has at least five visual tattoos:

  • the word “Dabby” on the right side of his chest
  • “197” followed by possible additional unknown text on his left bicep
  • additional tattoos on his left and right forearms and right bicep.

Anyone with information to provide should submit a tip online at tips.fbi.gov or call the FBI’s toll-free tip line at 1-800-CALL-FBI (1-800-225-5324). The public is reminded no charges have been filed in this case and the pictured individual is presumed innocent unless and until proven guilty in a court of law.

This individual is being sought as part of the FBI’s Operation Rescue Me and Endangered Child Alert Program (ECAP) initiatives. Operation Rescue Me focuses on utilizing clues obtained through in-depth image analysis to identify the child victims depicted in child exploitation material, while ECAP seeks national and international media exposure of unknown adults (referred to as John/Jane Does) who visibly display their faces and/or other distinguishing characteristics in association with child sexual abuse material.

Posted on

Owners of Local Real Estate Investment Company Indicted in Federal Court for Fraud

Source: US FBI

PORTLAND, Ore.—An indictment was unsealed in federal court today charging the owners of a local real estate investment company with defrauding individual investors and commercial lenders out of more than $18 million.

Robert D. Christensen, 54, of Sherwood, Oregon, and Anthony M. Matic, 55, of Damascus, Oregon, have been charged in a 21-count indictment with conspiracy to commit wire fraud, wire fraud, and money laundering.

According to the indictment, from approximately January 2019 through June 2023, Christensen and Matic are alleged to have devised and carried out a scheme wherein they convinced individual investors to fund the purchase and renovation of undervalued residential real estate properties. After renovating the properties, Christensen and Matic claimed they would rent the properties to generate income and then refinance them to extract their increased value from the renovations. The pair further misled investors into believing they would be repaid their full principal investment along with interest as high as eight to fifteen percent and a large lump sum payout, all within periods as short as 30 to 90 days.

Christensen and Matic’s scheme failed to generate the promised returns almost immediately and they began using new investments to repay earlier investors to keep their business afloat. When they were unable to raise enough money from new investors, Christensen and Matic are alleged to have devised a separate scheme to defraud commercial lenders. By December 2020, the pair began submitting loan applications with false financial information to different commercial lenders and, based on their misrepresentations, received millions of dollars in loans.

In total, Christensen and Matic’s two schemes defrauded individual investors out of more than $11 million and commercial lenders out of more than $7 million.

Christensen and Matic made their initial appearances in federal court today before a U.S. Magistrate Judge. Both were arraigned, pleaded not guilty, and released on conditions pending a 7-day jury trial scheduled to begin on October 29, 2024.

Conspiracy to commit wire fraud and wire fraud are punishable by up to 20 years in federal prison and three years’ supervised release. Money laundering in punishable by up to 10 years in federal prison and three years’ supervised release. All three charges may also result in fines of up to $250,000 or twice the gross gains or losses resulting from the offense.

This case was investigated by the FBI and IRS Criminal Investigation. It is being prosecuted by Assistant U.S. Attorney Robert Trisotto.

An indictment is only an accusation of a crime, and defendants are presumed innocent unless and until proven guilty.

Posted on

Grants Pass Man Accused of Causing Train Derailment

Source: US FBI

MEDFORD, Ore.—A Grants Pass, Oregon man is facing federal charges for manipulating railroad track equipment and causing a derailment.

Craig David Saddler, 50, has been charged by criminal complaint with wrecking, derailing, or disabling railroad equipment and vehicles. 

According to court documents, on August 12, 2024, officers responded to reports of Saddler trespassing at the Union Pacific Railroad (UPR) yard in Klamath Falls, Oregon. He was reported to be on the railroad near a lever that redirects the train to different tracks. While a train occupied by UPR employees was in motion, Saddler pulled the lever causing the tracks to switch and the train to derail. The derailment caused an estimated one million dollars in damage to the railway, four railcars, and surrounding property.

Saddler fled the railyard, but officers quickly located him less than a mile away. Saddler stated he witnessed the train derail but denied involvement. He was arrested after a witness identified him as the man who pulled the lever causing the derailment. 

Saddler made his first appearance in federal court today before a U.S. Magistrate Judge and was ordered detained pending further court proceedings.

The case was investigated by the FBI with assistance from other agencies. It is being prosecuted by Assistant U.S. Attorney Judi Harper.

A criminal complaint is only an accusation of a crime, and a defendant is presumed innocent unless and until proven guilty.

Posted on

Eastern Oregon Man Sentenced to Federal Prison for Assaulting Girlfriend on the Burns Paiute Indian Reservation

Source: US FBI

EUGENE, Ore.—A Baker City, Oregon man was sentenced to federal prison Tuesday for assaulting his then-girlfriend on the Burns Paiute Indian Reservation in March 2023.

Skyhawk Teeman Garcia, 29, was sentenced to 27 months in federal prison and three years’ supervised release.

According to court documents, on March 11, 2023, Garcia went to his then-girlfriend’s house on the Burns Paiute Indian Reservation while intoxicated and demanded access to her phone. When she refused, Garcia, a former mixed martial arts fighter, became angry and put the victim in a chokehold, strangling her. The victim’s child intervened, causing Garcia to release the victim, and then called 911. Garcia punched multiple holes in a wall before leaving the residence.

Police arrived as Garcia was walking away from the house. He told the officer he had an argument with his girlfriend and punched some walls, but denied assaulting the victim. 

On April 20, 2023, a federal grand jury in Eugene returned an indictment charging Garcia with one count of assault by strangulation. One year later, on April 24, 2024, he pleaded guilty to the single charge.

This case was investigated by the FBI and Bureau of Indian Affairs Police, and was prosecuted by Assistant U.S. Attorney Jeffrey S. Sweet.

Domestic violence can include both physical and emotional abuse, and it is frequently hidden from public view. Many survivors suffer in silence, afraid to seek help or not knowing where to turn. The traumatic effects of domestic violence also extend beyond the abused person, impacting family members, friends, and communities.

If you or someone you know are in immediate danger, please call 911.

If you need assistance or know someone who needs help, please contact the National Domestic Violence Hotline at 1-800-799-SAFE (7233). Many communities throughout the country have also created support networks to assist survivors in the process of recovery.

The StrongHearts Native Helpline offers culturally specific support and advocacy for American Indian and Alaska Native survivors of domestic violence. Please call 1-844-762-8483 or visit www.strongheartshelpline.org for more information.

Posted on

Central Oregon Repeat Offender Sentenced to Federal Prison for Attempted Sexual Exploitation of a Child

Source: US FBI

PORTLAND, Ore.—A Deschutes County, Oregon sex offender with a prior felony conviction for encouraging child sex abuse was sentenced to federal prison today after he requested a sexually explicit image online from an individual he thought was a 14-year-old girl.

Roger Clint Lee Vanwormer, 30, was sentenced to 20 years in federal prison and a life term of supervised release.

According to court documents, while on supervision and wearing an ankle monitor, Vanwormer requested a sexually explicit image online from an individual he thought was a 14-year-old girl. Vanwormer further engaged in explicit discussions with the purported minor and arranged to meet. On July 27, 2021, Vanwormer was arrested in Bend when he showed up at the arranged meeting location.

On February 17, 2022, a federal grand jury in Eugene returned a three-count indictment charging Vanwormer with attempted sexual exploitation of a child, attempted coercion and enticement of a minor, and commission of a felony involving a minor by a registered sex offender. Vanwormer pleaded guilty to one count of attempted sexual exploitation of a child.

This case was investigated by the Bend Police Department with assistance from the FBI. It was prosecuted by Jeffrey S. Sweet, Assistant U.S. Attorney for the District of Oregon.

Anyone who has information about the physical or online exploitation of children are encouraged to call the FBI at (503) 224-4181 or submit a tip online at tips.fbi.gov.

This case was brought as part of Project Safe Childhood, a nationwide initiative launched in May 2006 by the Justice Department to combat the growing epidemic of child sexual exploitation and abuse. For more information about Project Safe Childhood, please visit www.justice.gov/psc.

Posted on

Brothers from Oregon Plead Guilty to Felony and Misdemeanor Charges for Actions During January 6 Capitol Breach

Source: US FBI

            WASHINGTON – Brothers from Oregon pleaded guilty today to felony and misdemeanor charges stemming from their conduct during the Jan. 6, 2021, breach of the U.S. Capitol. Their actions and the actions of others disrupted a joint session of the U.S. Congress convened to ascertain and count the electoral votes related to the 2020 presidential election.

            Jonathanpeter Allen Klein, 24, of Pendleton, Oregon, pleaded guilty to one count of civil disorder and one count or assaulting, resisting, or impeding certain officers before U.S. District Judge Randolph D. Moss.

            Matthew Leland Klein, 27, of Pendleton, Oregon, pleaded guilty to a felony charge of civil disorder and a misdemeanor charge of entering and remaining in a restricted building or grounds also before Judge Moss.

            The two men will be sentenced on Nov. 15, 2024.

            According to court documents, the brothers traveled from Portland, Oregon, to Washington, D.C., to attend the “Stop the Steal” rally on Jan. 6, 2021. After attending the rally, the brothers made their way toward the Capitol building and entered into the restricted perimeter before separating.

            At about 2:00 p.m., a group of Metropolitan Police Department (MPD) officers arrived at the Northwest edge of the grounds in order to assist and reinforce the U.S. Capitol Police (USCP), who were outnumbered by the amassing crowd on the West Plaza of the Capitol. The MPD officers had organized themselves into a two-line formation and then attempted to make their way through the crowd to reach other law enforcement on the West Plaza police line.

            As the MPD officers were attempting to move through the crowd of rioters, Jonathanpeter Klein threw a piece of audio-visual equipment at the officers. The object directly hit an MPD officer in the helmet, causing the officer to stumble.

            At approximately 2:18 p.m., Matthew Klein and Jonathanpeter Klein entered into the Capitol building via the Senate Wing Door and separated. Matthew Klein was carrying a Gadsden flag and left the building approximately ten minutes later through a broken window next to the Senate Wing Door. Jonathanpeter Klein traversed most of the building through the crypt, Rotunda, and House side of the Capitol. Jonathanpeter then left the building and reunited with his brother.

            After exiting the building, the two men joined with a group of other rioters struggling against police to open the North Door of the Capitol. Through these combined efforts, the rioters, including Matthew and Jonathanpeter, were able to force the door open. Immediately after breaching the North Door, Matthew positioned himself in front of the North Door to obstruct police officers who were emerging from the building to disperse the rioters. Matthew also used his flag to interfere with the officers who were attempting to resecure the door.

            The FBI arrested the two men on March 23, 2021, in Oregon.  

            This case is being prosecuted by the U.S. Attorney’s Office for the District of Columbia and the Department of Justice National Security Division’s Counterterrorism Section. Valuable assistance was provided by the U.S. Attorney’s Office for District of Oregon.

            This case was investigated by the FBI’s Portland and Washington Field Offices. Jonathanpeter was identified as BOLO (Be on the Lookout) #127L and Matthew was identified as BOLO #127R. Valuable assistance was provided by the U.S. Capitol Police and the Metropolitan Police Department. 

            In the 42 months since Jan. 6, 2021, more than 1,470 individuals have been charged in nearly all 50 states for crimes related to the breach of the U.S. Capitol, including more than 530 individuals charged with assaulting or impeding law enforcement, a felony. The investigation remains ongoing.

            Anyone with tips can call 1-800-CALL-FBI (800-225-5324) or visit tips.fbi.gov.