Category: MIL-OSI

Posted on

Justice Department Seizes Domains Behind Major Information-Stealing Malware Operation

Source: United States Department of Justice Criminal Division

Coordinated Microsoft Actions and Court-Authorized Domain Seizures Disrupt LummaC2 Malware Infrastructure Used to Target Millions Worldwide

The Justice Department announced today the unsealing of two warrants authorizing the seizure of five internet domains used by malicious cyber actors to operate the LummaC2 information-stealing malware service.

“The Department will continue to use its unique tools, authorities, and partnerships to disrupt malicious cyber operations and criminal networks,” said Sue J. Bai, head of the Justice Department’s National Security Division. “Today’s disruption is another instance where our prosecutors, agents, and private sector partners came together to protect us from the persistent cybersecurity threats targeting our country. We are grateful for their work and dedication.”

“Malware like LummaC2 is deployed to steal sensitive information such as user login credentials from millions of victims in order to facilitate a host of crimes, including fraudulent bank transfers and cryptocurrency theft,” said Matthew R. Galeotti, head of the Justice Department’s Criminal Division. “Today’s announcement demonstrates that the Justice Department is resolved to use court-ordered disruptions like this one to protect the public from the theft of their personal information and their assets. The Department is also committed to working with and appreciates the efforts of the private sector to safeguard the public from cybercrime.”

“The FBI is committed to disrupting the key services that cyber criminals rely on,” said Assistant Director Bryan Vorndran of FBI’s Cyber Division. “That’s why, with our partners, we took action against the most popular infostealer service available in online criminal markets, which is responsible for millions of attacks against victims. Thanks to partnerships with the private sector, we were able to disrupt the LummaC2 infrastructure and seize user panels. Together, we are making it harder, and more painful, for cyber criminals to operate.”

As alleged in the affidavits filed in support of the government’s seizure warrants, the administrators of LummaC2 used the seized websites to distribute LummaC2, an information-stealing malware, to their affiliates and other cyber criminals. According to court documents, common targets for cybercriminals using malware like LummaC2 include browser data, autofill information, login credentials for accessing email and banking services, as well as cryptocurrency seed phrases, which permit access to virtual currency wallets. As alleged in the affidavits, the FBI has identified at least 1.7 million instances where LummaC2 was used to steal this type of information.

The government’s affidavit further alleges that the seized domains, also referred to as user panels, served as login pages for the LummaC2 malware, allowing credentialed users and administrators to access and deploy LummaC2. On May 19, 2025, the government seized two domains. On May 20, 2025, as detailed in court documents, the LummaC2 administrators informed their users of three new domains that they had set up to host the user panel. The next day, the government then seized those three domains.

The seizure of these domains by the government will prevent the owners and cybercriminals from using the websites to access LummaC2 to compromise computers and steal victim information. Individuals who now visit the websites will see a message indicating that the site has been seized by the Justice Department, including the FBI.

Concurrent with today’s actions and consistent with the Department’s approach to public-private operational coordination, Microsoft announced an independent civil action to take down 2,300 internet domains also claimed to be used by the LummaC2 actors or their proxies.

FBI’s Dallas Field Office is investigating the case.

The U.S. Attorney’s Office for the Northern District of Texas, the National Security Division’s National Security Cyber Section, and the Criminal Division’s Computer Crime and Intellectual Property Section are handling the case.

The U.S. Department of State’s Rewards for Justice (RFJ) program, which is administered by the Diplomatic Security Service, offers a reward of up to $10 million for information on foreign government-linked individuals participating in certain malicious cyber activities against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act.

Anyone with information on any other foreign government-linked malicious cyber actors or activity targeting U.S. critical infrastructure should contact Rewards for Justice via the RFJ Tor-based tip line at: he5dybnt7sr6cm32xt77pazmtm65flqy6irivtflruqfc5ep7eiodiad.onion (Tor browser required). Learn more about Rewards for Justice and their reward offers at RewardsforJustice.net.

If you believe you have a compromised computer or device, please visit the FBI’s Internet Crime Complaint Center (IC3). You may also contact your local FBI field office directly.

Posted on

Virginia Attorney Pleads Guilty to Filing False Tax Return

Source: United States Department of Justice Criminal Division

A Virginia attorney pleaded guilty yesterday to filing a false tax return that concealed a significant portion of his income.

The following is according to court documents and statements made in court: Asim Ghafoor, of Ashburn, was an attorney who operated a law practice in Virginia. His law practice had clients in various states, including Michigan. Ghafoor reported income from his practice on individual income tax returns that he personally prepared and signed. For 2012 through 2016, Ghafoor prepared and filed false tax returns that underreported the income he earned from his business.

In total, Ghafoor caused a tax loss to the IRS of $354,634.

Ghafoor is scheduled to be sentenced on Sept. 23. He faces a maximum penalty of three years in prison for filing a false tax return. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

Acting Deputy Assistant Attorney General Karen E. Kelly of the Justice Department’s Tax Division made the announcement.

IRS Criminal Investigation is investigating the case.

Trial Attorneys Richard J. Kelley and Jeffrey A. McLellan of the Tax Division are prosecuting the case.

Posted on

Justice Department Files Religious Liberty Lawsuit Against Troy, Idaho for Discriminating Against a Small Christian Church

Source: United States Department of Justice Criminal Division

The Justice Department filed a lawsuit today in the U.S. District Court for the District of Idaho alleging that the City of Troy, Idaho, violated the Religious Land Use and Institutionalized Persons Act (RLUIPA) when it denied a conditional use permit (CUP) application sought by Christ Church, a small evangelical church.

The lawsuit alleges that Christ Church had outgrown the space where it had been worshipping and was unable to find a space to rent. It then sought a CUP to operate a church in the City’s C-1 zoning district, where nonreligious assembly uses such as clubs, museums, auditoriums, and art galleries were allowed. Local residents vociferously opposed the Church’s CUP application, and many of their written and verbal comments reflected animus against Christ Church’s beliefs. In its denial of the Church’s CUP application, the City cited the fact that the public was “heavily against” it and that the “great majority of the city residents” opposed granting the CUP.

“RLUIPA unequivocally forbids local governments from deciding zoning matters based on their dislike of certain religious groups,” said Assistant Attorney General Harmeet K. Dhillon of the Justice Department’s Civil Rights Division. “The Department of Justice will not hesitate to file suit against jurisdictions that discriminate in land use matters on the basis of the applicants’ religious beliefs.”

The lawsuit alleges that the City’s denial of the CUP imposed a substantial burden on Christ Church and was based on the community’s discriminatory animus against the Church. It also alleges that the City’s zoning code treats religious assembly use worse than nonreligious assembly use.  The lawsuit alleges violations of RLUIPA’s substantial burden, equal terms, and discrimination provisions.

RLUIPA is a federal law that guards individuals and religious institutions from unduly burdensome, unequal, or discriminatory land use regulations. More information about RLUIPA and the department’s work can be found on the Place to Worship Initiative’s webpage.

As part of this initiative, the department distributed a letter to state, county, and municipal leaders throughout the country to remind them of their obligations under RLUIPA, including its requirement that land use regulations treat religious assemblies and institutions at least as well as nonreligious assemblies and institutions.

Individuals who believe they have been subjected to discrimination in land use or zoning decisions may contact the Civil Rights Division’s Housing and Civil Enforcement Section at (833) 591-0291 or may submit a complaint through the RLUIPA complaint portal. More information about RLUIPA, including questions and answers about the law and other documents, may be found at www.justice.gov/crt/about/hce/rluipaexplain.php.

Posted on

Three White Supremacists Sentenced to Prison for Racketeering Conspiracy; Two to Serve Life In Prison for Murder

Source: United States Department of Justice Criminal Division

WASHINGTON — On May 19, a federal judge sentenced three members of the Aryan Brotherhood prison gang who were convicted at trial of a racketeering (RICO) conspiracy that included multiple murders, drug trafficking, fraud, and robbery.

Francis Clement, 58, was found guilty by a jury in February of RICO conspiracy and five separate counts of murder in aid of racketeering. Each of these murders was committed while Clement was in state prison. Clement was sentenced to life in prison. There is no parole in the federal system.

The jury also found Kenneth Johnson, 63, guilty of RICO conspiracy and two counts of murder in aid of racketeering. Johnson was also sentenced to life in prison.

A third defendant, John Stinson, 70, was found guilty of one count of RICO conspiracy. Stinson, who was already serving a lengthy prison sentence in the California state prison system, was sentenced to 20 years in federal prison.

According to court documents and evidence presented at trial, between 2016 and 2023, Aryan Brotherhood members and associates engaged in racketeering activity, including murder, conspiracy to murder, fraud, robbery, and drug trafficking crimes. Johnson and Clement, who both held leadership roles in the gang, directed crimes committed by Aryan Brotherhood members both inside and outside of prison using cellphones that had been smuggled into prison. Because of his rank in the gang, Clement received a cut from the illegal drug sales and fraud schemes the Aryan Brotherhood committed. According to trial testimony, the Aryan Brotherhood regularly smuggled drugs, including methamphetamine, into prisons throughout the California prison system, which defendants and other gang members then sold to inmates.

In October 2020, Johnson and Clement together ordered one murder during the execution of which another individual was also killed. Johnson and Clement also ordered another murder of an individual who was subsequently killed. It was further proven at trial that in February 2022, Clement ordered the murder of an individual and the following month, in March 2022, Clement ordered the murder of two more individuals. For each murder, the killings were ordered because defendants believed the victims either violated gang rules or owed the gang money.

According to court documents and evidence presented at trial, Stinson was a high-ranking leader of the Aryan Brotherhood and had substantial authority over the enterprise, including sponsoring multiple individuals for membership, resolving disputes among members, and approving the murder of current and former members. During the investigation, Stinson used a contraband cellphone within his prison cell to conduct business on behalf of the Aryan Brotherhood. The jury heard some of these communications from Stinson through court-authorized wiretapped conversations. Evidence was presented that Stinson also engaged in drug trafficking, and that, given his position within the gang, he received a cut of illegal drug sales that took place in prison and out on the street.

“The convicted defendants led a notorious prison gang that committed ruthless murders, widespread methamphetamine trafficking, and perpetuated a culture of mayhem, fear, and disorder within the prison system that bled into the outside world,” said Matthew Galeotti, Head of the Justice Department’s Criminal Division. “Organized crime within the prison system, enabled by the use of contraband cellphones, endangers American neighborhoods by flooding streets with dangerous drugs. The Criminal Division will continue to pursue crime syndicates, like the Aryan Brotherhood and their facilitators, to ensure they go to prison and the harm they inflict on society ends once incarcerated.”

“Today’s sentences are yet another blow to the leadership of a violent criminal enterprise run from inside California prisons and spanning multiple counties and states,” said Acting U.S. Attorney Michele Beckwith for the Eastern District of California. “The Aryan Brotherhood has maintained its deadly influence over members, associates and others both inside and outside prison. We are committed to doing everything we can to stop these violent inmates from orchestrating their criminal activities from inside prison walls.”

“These sentences send a clear message: the walls of a prison do not shield violent gang leaders from justice,” said Acting Director Daniel Driscoll of the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). “The Aryan Brotherhood’s leadership operated a brutal criminal enterprise from behind bars — ordering murders, trafficking drugs, and fueling violence in our communities. ATF remains committed to working with our law enforcement partners to dismantle violent gangs wherever they operate and hold their leaders accountable, no matter where they try to hide.”

The indictment in this case charged 11 defendants with RICO conspiracy and other crimes. There are five defendants awaiting trial and the three defendants have pleaded guilty.

This case was the product of an extensive investigation by the ATF, with assistance from the Office of Correctional Safety (CDCR), U.S. Marshals Service, Los Angeles County Sheriff’s Department, Pomona Police Department, Torrance Police Department, San Diego Police Department, San Diego Sheriff’s Department, Los Angeles County District Attorney’s Office, and Kern County District Attorney’s Office.

Assistant U.S. Attorneys Stephanie Stokman and James Conolly for the Eastern District of California are prosecuting the case with the assistance of Trial Attorney Jared Engelking of the Criminal Division’s Violent Crime and Racketeering Section.

The case was investigated under the Organized Crime Drug Enforcement Task Forces (OCDETF). OCDETF identifies, disrupts, and dismantles the highest-level criminal organizations that threaten the United States using a prosecutor-led, intelligence-driven, multi-agency approach. For more information about Organized Crime Drug Enforcement Task Forces, please visit https://www.justice.gov/ocdetf.

Posted on

The U.S. Department of Justice’s Civil Rights Division Dismisses Biden-Era Police Investigations and Proposed Police Consent Decrees in Louisville and Minneapolis

Source: United States Department of Justice Criminal Division

Today, the Department of Justice’s Civil Rights Division is beginning the process of dismissing lawsuits against the Louisville, Kentucky and Minneapolis, Minnesota police departments.

These lawsuits, which were filed at the last minute by the Biden administration after President Donald Trump’s reelection, accused Louisville and Minneapolis of widespread patterns of unconstitutional policing practices by wrongly equating statistical disparities with intentional discrimination and heavily relying on flawed methodologies and incomplete data. They also sought to subject the Louisville and Minneapolis police departments to sweeping consent decrees that went far beyond the Biden administration’s accusations of unconstitutional conduct; the decrees would have governed many aspects of those police departments, including their management, supervision, training, performance evaluations, discipline, staffing, recruitment, and hiring.  In short, these sweeping consent decrees would have imposed years of micromanagement of local police departments by federal courts and expensive independent monitors, and potentially hundreds of millions of dollars of compliance costs, without a legally or factually adequate basis for doing so.

“Overbroad police consent decrees divest local control of policing from communities where it belongs, turning that power over to unelected and unaccountable bureaucrats, often with an anti-police agenda,” added Assistant Attorney General Harmeet K. Dhillon of the Justice Department’s Civil Rights Division. “Today, we are ending the Biden Civil Rights Division’s failed experiment of handcuffing local leaders and police departments with factually unjustified consent decrees.”

The Civil Rights Division will be taking all necessary steps to dismiss the Louisville and Minneapolis lawsuits with prejudice, to close the underlying investigations into the Louisville and Minneapolis police departments, and to retract the Biden administration’s findings of constitutional violations.

The Civil Rights Division will also be closing its investigations into, and retracting the Biden administration’s findings of constitutional violations on the part of, the following additional local police departments:

  • Phoenix, Arizona
  • Trenton, New Jersey
  • Memphis, Tennessee
  • Mount Vernon, New York
  • Oklahoma City, Oklahoma
  • Louisiana State Police

The Department of Justice will continue to offer its full support to police departments across the country, including through grants and technical assistance. The Department is confident that the vast majority of police officers across the Nation will continue to vigorously enforce the law and protect the public in full compliance with the Constitution and all applicable federal laws. When bad actors in uniform fail to do so, the Department stands ready to take all necessary action to address any resulting constitutional or civil-rights violations, including via criminal prosecution.

Posted on

Foreign National Sentenced for $3.2 Million Medicare Fraud Scheme

Source: United States Department of Justice Criminal Division

A foreign national was sentenced today to 30 months in prison for his role in a scheme to defraud Medicare of more than $3.2 million through a sham durable medical equipment company.

According to court documents, Julian Lopez, 55, a citizen of Cuba who resides in Miami-Dade County, Florida, obtained Medicare beneficiary identification cards and sold Medicare beneficiaries’ personal information to a durable medical equipment company, One Medical Services. Lopez knew the Medicare identification cards he obtained would be used to submit fraudulent claims to Medicare. One Medical Services used the information from Lopez to bill Medicare for orthotic braces that were never provided to the Medicare beneficiaries. In connection with the scheme, One Medical Services submitted and caused the submission of over $3.2 million in false and fraudulent claims to Medicare for medically unnecessary DME.

Lopez pleaded guilty to two counts of health care fraud in February 2025. At sentencing, he was also ordered to pay $1,496,412 in restitution.

Matthew R. Galeotti, Head of the Justice Department’s Criminal Division; Acting Special Agent in Charge Jesus Barranco at the U.S. Department of Health and Human Services, Office of Inspector General (HHS-OIG) Miami Regional Office; and Acting Special Agent in Charge Brett Skiles of the FBI Miami Field Office made the announcement.

The FBI and HHS-OIG investigated the case.

Assistant Chief Emily Gurskis and Trial Attorney Owen Dunn of the Criminal Division’s Fraud Section prosecuted the case.

The Fraud Section leads the Criminal Division’s efforts to combat health care fraud through the Health Care Fraud Strike Force Program. Since March 2007, this program, currently comprised of nine strike forces operating in 27 federal districts, has charged more than 5,800 defendants who collectively have billed federal health care programs and private insurers more than $30 billion. In addition, the Centers for Medicare & Medicaid Services, working in conjunction with HHS-OIG, are taking steps to hold providers accountable for their involvement in health care fraud schemes. More information can be found at www.justice.gov/criminal-fraud/health-care-fraud-unit.

Posted on

California Man Sentenced for 20-Year Scheme to Evade Employment Taxes

Source: United States Department of Justice Criminal Division

Defendant Caused Approximately $60M in Loss to United States Which He Used to Fund a Lavish Lifestyle

A California man was sentenced today to 96 months in prison and ordered to pay $38 million in restitution for a decades-long scheme to evade employment taxes.

The following is according to court documents and statements made in court: for more than 20 years, Luis E. Perez was the owner and primary decision-maker for more than a dozen labor staffing companies including Check Mate Inc., BaronHR LLC, BaronHR West Inc., and Fortress Holding Group LLC. Typically, a labor staffing company helps connect job candidates with client-companies looking for temporary employees. The staffing company also usually remains responsible for paying the temporary employees’ wages and complying with associated reporting and tax obligations. Specifically, the companies were responsible for withholding Social Security, Medicare, and income taxes from employees’ wages and paying those funds over to the IRS each quarter. They were also responsible for paying their own Social Security and Medicare taxes. The timely payment of these taxes is critical to the functioning of the U.S. government, because, for example, they are the primary source of funding for Social Security and Medicare. The federal income taxes that are withheld from employees’ wages also account for a significant portion of all federal income taxes collected each year.

For nearly as long as Perez was in business, he was noncompliant with his tax obligations. Starting as early as 2001, Perez began not paying over the full amount of taxes withheld from employees’ wages or the full amount of Social Security and Medicare taxes his companies owed. In June 2007, Perez personally owed the IRS taxes related to Check Mate Inc., which the IRS was attempting to collect. By 2017, Perez’s outstanding tax liability had ballooned to nearly $30 million. Between 2007 and 2017, Perez tried to hinder IRS collection efforts in a number of ways. He used BaronHR and Fortress Holding Group’s bank accounts to make personal purchases, such as several luxury items, including automobiles and a boat. He titled the items in the names of several nominees to conceal his ownership from the IRS and to prevent the IRS from seizing them. In addition, he opened a credit card in the name of a nominee and used the card to make personal purchases. He then paid the bills for that credit card from those same business bank accounts. Perez also funneled money from BaronHR and Fortress Holding Group to a nominee, but then used the funds for himself. To further impede IRS collection efforts, Perez lied to IRS revenue officers and submitted false forms to the IRS about his income.

Perez’s misconduct continued even after he was charged for tax offenses in February 2018. From January 2018 through June 2019, he reported that BaronHR West had paid total wages of approximately $54 million and paid approximately $7 million in total taxes on these wages to the IRS. In fact, BaronHR West paid approximately $185 million in total wages and was required but did not pay approximately $37 million in total taxes to the IRS. Similarly, during the first quarter of 2022, BaronHR West paid about $30 million in wages and was obligated to pay nearly $6 million in taxes. The company paid only $76,000.

In total, Perez caused a tax loss to the IRS of approximately $60 million.

Instead of paying his tax obligations, Perez used the money to fund a lavish lifestyle for himself, including multiple large residences, courtside seats to the Los Angeles Lakers, a private jet, a yacht, and dozens of luxury automobiles, including Bentleys and Lamborghinis.

In addition to his prison sentence, U.S. District Court Judge Kenly Kiya Kato for the Central District of California ordered Perez to serve three years of supervised release and pay $38,052,767 in restitution to the IRS.

Acting Deputy Assistant Attorney General Karen E. Kelly of the Justice Department’s Tax Division and U.S. Attorney Bilal A. Essayli for the Central District of California made the announcement.

IRS Criminal Investigation investigated the case.

Trial Attorney Robert Kemins of the Tax Division and Assistant U.S. Attorneys Brett A. Sagel and James C. Hughes for the Central District of California prosecuted the case

Posted on

Fifteen Charged with Drug Conspiracy and Weapons Charges

Source: United States Department of Justice Criminal Division

A 29-count indictment was unsealed today charging 12 men and 3 women for their roles in a drug trafficking organization and related gun offenses.

According to court documents, the defendants were part of a drug trafficking organization that distributed methamphetamine, powder cocaine, crack cocaine, heroin, oxycodone, Xanax, psylocibin mushrooms, and marijuana. Six of the defendants face additional charges for gun crimes relating to their alleged drug trafficking. The defendants are alleged to have used several drug houses and a food truck to store illegal drugs and conduct drug transactions. As alleged, in one notable instance in June of 2023, U.S. Customs and Border Protection agents seized 29 kilograms of methamphetamine that one defendant was attempting to transport into the United States.

“As alleged, this drug trafficking organization imported methamphetamine directly from Mexico and used the U.S. mail, a taco truck, and homes in different Houston neighborhoods to distribute and sell methamphetamine and other dangerous drugs,” said Matthew R. Galeotti, Head of the Justice Department’s Criminal Division. “Several of the defendants are also alleged to have used firearms in furtherance of their narcotics trafficking and illegally possessed firearms despite having previously been convicted of felonies. The Criminal Division, along with our federal, state, and local partners, will continue to work tirelessly to combat the scourge of drug trafficking in communities.”

“The defendants are alleged to have engaged in a multi-drug narcotics distribution ring, and, as often seen in the drug trade, are also alleged to have used illegal firearms to facilitate their enterprise,” said U.S. Attorney Nicholas J. Ganjei for the Southern District of Texas. “Some of the charges indicate methamphetamine was alleged to have been sourced from Mexico, and thus this investigation highlights why this office’s enforcement efforts on the border are so critical. The Southern District of Texas will do everything it can to prevent narcotics from entering our country and will be relentless in apprehending those that would distribute drugs in our communities.”

“For years, the transnational criminal organization allegedly operated by these gang members has brazenly flooded our local communities with deadly narcotics,” said Special Agent in Charge Chad Plantz of Immigration and Customs Enforcement – Homeland Security Investigations (ICE-HSI) Houston. “Working in conjunction with the Houston Police Department (HPD) and our Organized Crime Drug Enforcement Task Forces (OCDETF) partners, we were able to expose and dismantle their drug trafficking scheme, eliminating a significant contributor to violent crime in the area and saving an untold number of Houstonians from becoming addicted.”

James Michael Brewer, also known as Creeper, 33; Jonathan Alvarado, also known as Joker, 28; Hector Luis Lopez, also known as Capulito, 23; Alfredo Gomez, also known as Fredo, 26; and Victor Norris Ellison, 35, all of Houston, have been indicted on drug trafficking and firearm charges. If convicted, they each face a mandatory minimum penalty of 15 years in prison and a maximum penalty of life in prison.

The following defendants, all of Houston unless otherwise noted, have been indicted on drug trafficking charges. If convicted, they each face a mandatory minimum penalty of 10 years in prison and a maximum penalty of life in prison.

  • Jose Francisco Garcia-Martinez, also known as Paco, 29, a Mexican national;
  • Enzo Xavier Dominguez, also known as Smiley, 32;
  • Alexis Delgado, also known as Chino, 28;
  • Jose Eduardo Morales, also known as Primo, 22;
  • William Alexander Lazo, also known as Miclo, 21;
  • Kylie Rae Alvarado, 24;
  • Ruby Mata, 31;
  • Mexi Dyan Garcia, also known as Mexi, 31; and
  • Jesus Gomez-Rodriguez, also known as Jr., 33.

Marcos Rene Simaj-Guch, also known as Taco Man, 41, a Mexican national, is charged with drug trafficking. If convicted, he faces a mandatory minimum penalty of five years in prison and a maximum penalty of 40 years in prison.

ICE-HSI and HPD conducted the investigation with the assistance of the FBI, Bureau of Alcohol, Tobacco, Firearms, and Explosives and Texas Board of Criminal Justice Office of the Inspector General.

Trial Attorneys Ralph Paradiso and Amanda Kotula of the Criminal Division’s Violent Crime and Racketeering Section and Assistant U.S. Attorney Francisco Rodriguez for the Southern District of Texas are prosecuting the case.

This case is part of the Criminal Division’s Violent Crime Initiative to prosecute violent crimes in Houston, Texas. The Criminal Division and the U.S. Attorney’s Office for the Southern District of Texas have partnered, along with local, state, and federal law enforcement agencies, to confront violent crimes committed by gang members and associates through the enforcement of federal laws and use of federal resources to prosecute the violent offenders and prevent further violence.

This case is part of Operation Take Back America, a nationwide initiative that marshals the full resources of the Department of Justice to repel the invasion of illegal immigration, achieve the total elimination of cartels and transnational criminal organizations and protect our communities from the perpetrators of violent crime. Operation Take Back America streamlines efforts and resources from the Department’s OCDETF and Project Safe Neighborhoods.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Posted on

Leader of Qakbot Malware Conspiracy Indicted for Involvement in Global Ransomware Scheme

Source: United States Department of Justice Criminal Division

A federal indictment unsealed today charges Rustam Rafailevich Gallyamov, 48, of Moscow, Russia, with leading a group of cyber criminals who developed and deployed the Qakbot malware. In connection with the charges, the Justice Department filed today a civil forfeiture complaint against over $24 million in cryptocurrency seized from Gallyamov over the course of the investigation. These actions are the latest step in an ongoing multinational effort by the United States, France, Germany, the Netherlands, Denmark, the United Kingdom, and Canada to combat cybercrime.

“Today’s announcement of the Justice Department’s latest actions to counter the Qakbot malware scheme sends a clear message to the cybercrime community,” said Matthew R. Galeotti, Head of the Justice Department’s Criminal Division. “We are determined to hold cybercriminals accountable and will use every legal tool at our disposal to identify you, charge you, forfeit your ill-gotten gains, and disrupt your criminal activity.”

“The criminal charges and forfeiture case announced today are part of an ongoing effort with our domestic and international law enforcement partners to identify, disrupt, and hold accountable cybercriminals,” said U.S. Attorney Bill Essayli for the Central District of California. “The forfeiture action against more than $24 million in virtual assets also demonstrates the Justice Department’s commitment to seizing ill-gotten assets from criminals in order to ultimately compensate victims.”

“Mr. Gallyamov’s bot network was crippled by the talented men and women of the FBI and our international partners in 2023, but he brazenly continued to deploy alternative methods to make his malware available to criminal cyber gangs conducting ransomware attacks against innocent victims globally,” said Assistant Director in Charge Akil Davis of the FBI’s Los Angeles Field Office. “The charges announced today exemplify the FBI’s commitment to relentlessly hold accountable individuals who target Americans and demand ransom, even when they live halfway across the world.”

According to court documents, Gallyamov developed, deployed, and controlled the Qakbot malware beginning in 2008. From 2019 onward, Gallyamov allegedly used the Qakbot malware to infect thousands of victim computers around the world in order to establish a network, or “botnet,” of infected computers. As alleged, once Gallyamov gained access to victim computers, he provided access to co-conspirators who infected the computers with ransomware, including Prolock, Dopplepaymer, Egregor, REvil, Conti, Name Locker, Black Basta, and Cactus. In exchange, Gallyamov was allegedly paid a portion of the ransoms received from ransomware victims.

The announcement of charges today is the latest step taken by the Justice Department against the Qakbot conspiracy. In August 2023, a U.S.-led multinational operation disrupted the Qakbot botnet and malware. At that time, the Justice Department announced the seizure of illicit proceeds from Gallyamov, including over 170 bitcoin and over $4 million of USDT and USDC tokens.

According to the indictment, after the disruption and takedown of the Qakbot botnet, Gallyamov and his co-conspirators continued their criminal activities. Instead of a botnet, they allegedly used different tactics, including “spam bomb” attacks on victim companies, where co-conspirators would trick employees at those victim companies into granting access to computer systems. The indictment alleges that Gallyamov orchestrated spam bomb attacks against victims in the United States as recently as January 2025. It also alleges that Gallyamov and his co-conspirators deployed Black Basta and Cactus ransomware on victim computers.

On April 25, 2025, pursuant to a seizure warrant, the FBI seized additional illicit proceeds from Gallyamov, including over 30 bitcoin and over $700,000 of USDT tokens. Today, the Department filed a civil forfeiture complaint in the Central District of California against all of the illicit proceeds seized from Gallyamov — worth over $24 million as of today — in order to forfeit and ultimately return those funds to victims.

The investigation of Gallyamov was led by the FBI’s Los Angeles Field Office, which worked closely with investigators from Germany’s Bundeskriminalamt (BKA), the Netherlands National Police, The Public Prosecutor’s Office of the Netherlands, France’s Anti-Cybercrime Office (Office Anti-cybercriminalité) and Cyber Division of the Paris Prosecution Office, and Europol. The Justice Department’s Office of International Affairs and the FBI Milwaukee Field Office provided significant assistance.

Trial Attorney Jessica Peck of the Justice Department’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorneys Khaldoun Shobaki, Lauren Restrepo, and James Dochterman for the Central District of California are prosecuting the case.

These law enforcement actions were taken in conjunction with Operation Endgame, an ongoing, coordinated effort among international law enforcement agencies aimed at dismantling and prosecuting cybercriminal organizations around the world.

Resources for victims can be found on the following website, which will be updated as additional information becomes available: https://www.justice.gov/usao-cdca/divisions/national-security-division/qakbot-resources

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

 

Posted on

Colombian National Sentenced to Over 20 Years in Prison for Role in Conspiracy to Kidnap and Assault U.S. Army Soldiers in Colombia

Source: United States Department of Justice Criminal Division

A Colombian national was sentenced today in the Southern District of Florida for her role in kidnapping and assaulting two members of the U.S. military who were on temporary duty in Bogotá, Colombia.

Kenny Julieth Uribe Chiran, 35, was sentenced to 262 months in prison followed by three years of supervised release, and ordered to pay $24,115 in restitution. She is the third and final defendant to be sentenced and held accountable for this criminal conspiracy. She pleaded guilty in March 2025 to conspiracy to kidnap an internationally protected person.

“Uribe Chiran and her co-defendants mercilessly preyed on U.S. soldiers when they drugged their drinks, stole their valuables, and left them incapacitated on the street,” said Matthew R. Galeotti, Head of the Justice Department’s Criminal Division. “Kidnapping and assaulting two U.S. military service members is deplorable and the Criminal Division will continue to prioritize protecting our service members through these prosecutions. I thank the prosecutors and our law enforcement partners who work tirelessly to bring justice to these victims.”

“Members of our military, whether serving here or abroad, can count on this Department of Justice’s respect, support, and protection,” said U.S. Attorney Hayden P. O’Byrne for the Southern District of Florida. “Kidnappings and assaults against U.S. service members will not be tolerated. To those who would dare commit such reprehensible acts against America’s heroes, know this: We will identify you; we will find you; and we will prosecute you as aggressively as the law permits.”

“The FBI’s commitment to investigate criminal acts against the U.S. military beyond our borders is clearly demonstrated by our persistent pursuit of justice for the two kidnapped soldiers,” said Acting Special Agent in Charge Brett D. Skiles of the FBI Miami Field Office. “Our close cooperation with Colombian and Chilean law enforcement authorities was essential to this international investigation’s success. To all would be kidnappers the message is clear: target our citizens with violence anywhere in the world and we will hold you accountable for your actions.”

According to court documents, the two U.S. soldiers went to an entertainment district in Bogotá to watch a soccer game on the evening of March 5, 2020. They later went to a pub, where Uribe Chiran and one of her co-defendants approached the soldiers and, without their knowledge, put drugs in their drinks that rendered them incapacitated. Medical examinations later confirmed the presence of benzodiazepines in the two soldiers’ systems. The defendants then kidnapped the soldiers, took their valuables, including their credit and debit card information, and left them incapacitated on the street in separate locations. The defendants used one victim’s credit card and the other victim’s debit card to make purchases and withdraw money.

Uribe Chiran was extradited in September 2024 from Colombia to the United States. Co-defendant Pedro Jose Silva Ochoa was extradited in April 2024 from Chile to the United States, pleaded guilty in December 2024, and was sentenced in March 2025 to 27 years and three months in prison. Co-defendant Jeffersson Arango Castellanos was extradited in May 2023 from Colombia to the United States, pleaded guilty in January 2024, and was sentenced in May 2024 to 48 years and nine months in prison.

The FBI Miami Field Office investigated the case. The Justice Department’s Office of International Affairs and the Criminal Division’s Narcotic and Dangerous Drug Section’s Office of the Judicial Attaché in Bogotá provided significant assistance in this matter. The United States thanks Colombian law enforcement authorities for their valuable assistance.

Trial Attorneys Clayton O’Connor and Elizabeth Nielsen of the Criminal Division’s Human Rights and Special Prosecutions Section and Assistant U.S. Attorney Bertila Fernandez for the Southern District of Florida are prosecuting the case.