Category: MIL-OSI

Source: US FBI

Mansuri Manuchekhri, 33, of Sheepshead Bay, Brooklyn, New York, was arrested today for allegedly conspiring to provide material support to the Islamic State of Iraq and al-Sham (ISIS) and to the Islamic State-Khorasan Province (ISIS-K), possessing firearms while unlawfully in the United States, and immigration fraud. Manuchekhri was arrested today and made his initial appearance this afternoon in the Eastern District of New York.

“Under no circumstances will my Department of Justice tolerate terrorism,” said Attorney General Pam Bondi. “We stand ready to find, arrest, and prosecute those who seek to harm American citizens with the full force of the law. I stand with our federal, state, and local law enforcement partners who work to keep Americans safe and evil off our streets.” 

“The defendant allegedly supported ISIS and sent thousands of dollars overseas to individuals connected to ISIS,” said FBI Director Kash Patel. “The FBI is focused on preventing acts of terrorism and ISIS has a long and violent record of harming U.S. citizens. We are committed to working with our law enforcement partners to find and hold accountable those who assist terrorists and endanger the safety of Americans at home or abroad.”

“The Justice Department will relentlessly pursue those who fund and support terrorists,” said Sue Bai, head of the Justice Department’s National Security Division. “We will not allow our immigration or financial systems to be exploited. Our country will not be a safe haven for those who try to harm Americans.”

“As alleged, the defendant, who was in the United States illegally, not only facilitated tens of thousands of dollars in contributions to ISIS extremists overseas, but trained with assault rifles at shooting ranges in the United States and declared his readiness to ISIS,” said U.S. Attorney John J. Durham for the Eastern District of New York. “Protecting the homeland and prosecuting evildoers who assist terrorist organizations by funding their violent and hateful agenda, here and abroad, will always be a priority of this office.”    

As alleged in the complaint, Manuchekhri traveled to the United States from Tajikistan in June 2016 on a non-immigrant tourist visa and remained in the country after his visa expired in December 2016. In March 2017, Manuchekhri paid an American citizen to enter into a sham marriage with him so that he could obtain legal status in the United States. However, he failed to provide supporting documentation that was requested of him and his petition was never granted. 

As alleged in the complaint, Manuchekhri traveled to the United States from Tajikistan in June 2016 on a non-immigrant tourist visa and remained in the country after his visa expired in December 2016. In March 2017, Manuchekhri paid an American citizen to enter into a sham marriage with him so that he could obtain legal status in the United States. However, he failed to provide supporting documentation that was requested of him and his petition was never granted.

From approximately December 2021 through April 2023, while residing in Brooklyn, Manuchekhri facilitated more than $50,000 in payments to ISIS-affiliated individuals in Turkey and Syria, including to an individual who was later arrested by Turkish authorities for his alleged involvement in a January 2024 terrorist attack on a church in Istanbul for which ISIS-K publicly claimed responsibility. Manuchekhri expressed his support for ISIS to others by praising past ISIS attacks in the United States and by collecting jihadi propaganda videos promoting violence and martyrdom.

The complaint further alleges that Manuchekhri possessed and used firearms and made frequent visits to shooting ranges even though he was prohibited from doing so as an alien unlawfully in the United States. In February 2022, Manuchekhri recorded himself firing an assault rifle at a shooting range in New Jersey and sent the video to one of the ISIS-affiliated individuals in Turkey with the message, “Praise God, I am ready, brother.”

If convicted, Manuchekhri faces a maximum penalty of 45 years in prison. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

Assistant U.S. Attorneys Robert M. Pollack and Andrew D. Reich for the Eastern District of New York are prosecuting the case with assistance from Trial Attorneys John Cella, Andrea Broach, George Kraehe, and Ryan White of the National Security Division’s Counterterrorism Section and Paralegal Specialist Wayne Colón.

A criminal complaint is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Source: US FBI

The Federal Bureau of Investigation has named Timothy A. Ferguson as the assistant director of the Criminal Justice Information Services Division in Clarksburg, West Virginia. Mr. Ferguson has served as the acting assistant director of the CJIS Division since April 2024.

Mr. Ferguson joined the FBI as a special agent in 2002 and was assigned to the Dayton Resident Agency under the Cincinnati Field Office in Ohio, where he primarily worked criminal investigations with the Southern Ohio Safe Streets Task Force. He was promoted to supervisory senior resident agent in 2011.

In 2015, Mr. Ferguson was promoted to assistant section chief of the Violent Crime and Gang Section in the Criminal Investigative Division at FBI Headquarters in Washington, D.C. He oversaw the division’s Safe Streets and Gang Unit, Violent Crime Unit, and Indian Country Crime Unit.

Mr. Ferguson moved to the Springfield Field Office in Illinois in 2018 to serve as the assistant special agent in charge of the Criminal Branch. In 2020, he returned to FBI Headquarters as the section chief of the Field Operations Section and the Digital Forensics and Analytics Section in the Operational Technology Division.

In 2023, Mr. Ferguson was promoted to deputy assistant director of the CJIS Division, responsible for the FBI’s National Threat Operations Center and the National Instant Criminal Background Check System Section.

During his FBI career, Mr. Ferguson has served as a crisis negotiator, a SWAT Team operator, a medic, an adjunct faculty member, and a Behavioral Analysis Unit coordinator.

Prior to joining the FBI, Mr. Ferguson served in the U.S. Army. He earned a bachelor’s degree in English from Welsh College in Nashville, Tennessee, and a master’s degree in behavioral science from Wright State University in Dayton, Ohio.

Source: US FBI

The Federal Bureau of Investigation has named Robert K. Tripp as the assistant director of the Human Resources Division at FBI Headquarters in Washington, D.C. Mr. Tripp most recently served as the special agent in charge of the San Francisco Field Office.

Mr. Tripp joined the FBI as an intelligence research specialist in 1998 and worked in the Criminal Investigative Division at Headquarters. He became a special agent in 2003 and was assigned to the St. Louis Field Office to investigate public corruption and white-collar crime.

In 2006, Mr. Tripp transferred to the Washington Field Office and was detailed to work international mass marketing fraud through the Department of Justice Fraud Section. He was promoted to supervisory special agent in 2012 and worked in the Director’s Research Group at Headquarters, which prepares the director for meetings, conferences, and events.

Mr. Tripp transferred to the Sacramento Field Office in California in 2014. He first supervised a public corruption and civil rights squad, then a squad responsible for violent crime and violent crimes against children. He was also the supervisor of the Fairfield Resident Agency, a Sacramento satellite office.

In 2018, Mr. Tripp was promoted to assistant special agent in charge of the Sacramento office, responsible for all investigations of criminal and cyber threats and overseeing the criminal squads in Sacramento’s seven resident agencies. He also served as the acting commander of the newly established Sacramento Organized Crime Drug Enforcement Task Force.

Mr. Tripp was promoted to inspector in 2021 and returned to Headquarters. He was promoted to special agent in charge of the San Francisco Field Office in 2022.

Mr. Tripp earned a bachelor’s degree in history from Cornell University in Ithaca, New York, and a master’s and doctorate in history from Washington University in St. Louis.

Source: US FBI

Jairo Jaime Tinajero, 25, pleaded guilty yesterday in the Western District of Kentucky to the following charges contained in the superseding information: racketeering conspiracy, online enticement, three counts of production of child sexual abuse material, three counts of distribution of child sexual abuse material (CSAM), five counts of interstate communications of threats, cyberstalking, and conspiracy to murder Jane Doe 1 in aid of racketeering. The terms of the plea agreement specify that both parties agree to the applicability of the terrorism sentencing enhancement (U.S.S.G. § 3A1.4 n. 4).

On Oct. 11, 2023, a grand jury in the Western District of Kentucky returned an indictment charging Tinajero with online enticement and production of child sexual abuse material. On Oct. 4, 2023, in the Eastern District of Arkansas, Tinajero was arrested on a criminal complaint that was filed in the Western District of Kentucky.

According to the court documents, Tinajero is a self-identified member of the 764 network. The 764 network’s accelerationist goals include social unrest and the downfall of the current world order, including the U.S. Government. Beginning in 2020, Tinajero started communicating with, and grooming, several minor victims to obtain sexually explicit content from them, including Jane Doe 1. In 2023, Tinajero began to threaten the safety of Jane Doe 1 and her family. Tinajero posted online in encrypted platforms associated with 764 and related groups a “Lorebook” – commonly used in 764 blackmail schemes — containing Jane Doe 1’s identifying information along with nude pictures of the minor.

Between July 2023 and September 2023, during multiple discussions over social media, Tinajero and a co-conspirator agreed that Tinajero should kill Jane Doe 1. Tinajero and the co-conspirator specifically discussed that Tinajero should murder Jane Doe 1 and dispose of Jane Doe 1’s body in a barrel of acid after the murder. Tinajero posted multiple messages on various social media websites stating that he planned to kill Jane Doe 1 with a firearm because Jane Doe 1 refused to provide additional child sexual abuse material.

On Aug. 26, 2023, Tinajero posted on Telegram, “Im determined to die” and “If I gotta kill her I can’t let her live and f**k with dudes and girls while I’m sick and miserable” and “Im gonna live stream it.” Tinajero also posted a picture of Jane Doe 1. On Sept. 2, 2023, Tinajero posted on Telegram, “I wanna kill them so bad just show up at their cribs and shoot 100 rounds in 5 seconds” and, on Sept. 3, 2023, posted “I didn’t wanna do anything bc I was scared of dying or prison but now I’m determined to die if I have to after getting rid of [Jane Doe 1] . . . .” Tinajero also began soliciting others to assist with attempting to kill Jane Doe 1.

The FBI is investigating the case.

Assistant U.S. Attorney Erwin Roberts for the Western District of Kentucky and Trial Attorneys Justin Sher and James Donnelly of the National Security Division’s Counterterrorism Section are prosecuting the case. The Violent Crime and Racketeering Section for the Criminal Division and the Eastern District of Arkansas provided assistance.

Source: US FBI

Orlando, Florida – United States District Judge Carlos E. Mendoza has sentenced Alan W. Filion (18, Lancaster, CA) to four years in federal prison for making interstate threats to injure the person of another.

According to the plea agreement, from approximately August 2022 to January 2024, Filion made over 375 swatting and threat calls, including calls in which he claimed to have planted bombs in the targeted locations or threatened to detonate bombs and/or conduct mass shootings at those locations. Filion targeted religious institutions, high schools, colleges and universities, government officials, and numerous individuals across the United States.

Filion intended his calls to cause large-scale deployment of police and emergency services units to the targeted locations. During these calls, he provided information to law enforcement and emergency services agencies that he knew to be false, such as false names, false claims that he and others had placed explosives in particular locations, false claims that he and others possessed dangerous weapons, including firearms and explosives, and false claims that he and/or other individuals had committed, or intended to imminently commit, violent crimes. 

In some instances, armed law enforcement officers approached and entered a targeted residence with their weapons drawn and detained individuals that occupied the residence. Filion claimed in a post on January 20, 2023, that when he swats someone he “usually get[s] the cops to drag the victim and their families out of the house cuff them and search the house for dead bodies.” Additionally, Filion’s calls caused law enforcement officers and dispatchers to respond, and to be unavailable in response to other emergencies.

Filion became a serial swatter for both profit and recreation. He claimed in a January 19, 2023, online post that his “first” swatting was like “2 to 3 years ago” and that “6-9 months ago [he] decided to turn it into a business. . . .” On several occasions, Filion placed posts on social-media channels advertising his services and swatting-for-a-fee structure.

On January 18, 2024, Filion was arrested in California on Florida state charges arising from a May 2023 threat he made to a religious institution in Sanford, Florida. In that threat, he claimed to have an illegally modified AR-15, a Glock 17 pistol, pipe bombs, and Molotov cocktails. He said that he was going to imminently “commit a mass shooting” and “kill everyone” he saw. He pleaded guilty in federal court to making that threat.

Filion also pleaded guilty to making three other threatening calls: an October 2022 call to a public high school in the Western District of Washington, in which he threatened to commit a mass shooting and claimed to have planted bombs throughout the school; a May 2023 call to a Historically Black College & University in the Northern District of Florida, in which he claimed to have placed bombs in the walls and ceilings of campus housing that would detonate in about an hour; and a July 2023 call to a local police department dispatch number in the Western District of Texas, in which he falsely identified himself as a senior federal law enforcement officer, provided the federal law-enforcement officer’s residential address to the dispatcher, claimed to have killed his (the federal officer’s) mother, and threatened to kill any responding police officers.  

This case was investigated by the Federal Bureau of Investigation and the United States Secret Service. Valuable assistance was provided by the Seminole County (Florida) Sheriff’s Office; the Anacortes (Washington) Police Department; the Florida Department of Law Enforcement; the California Department of Justice; the Los Angeles County (California) Sheriff’s Office; and the Volusia County (Florida) Sheriff’s Office. The case is being prosecuted by Assistant United States Attorney Kara Wick, with valuable assistance from the State Attorney’s Office for Seminole County, Florida, 18^th Judicial Circuit; the Counterterrorism Section of the United States Department of Justice; and the United States Attorneys’ Offices for the Western District of Washington, the Northern District of Florida, the Western District of Texas, and the District of Columbia. 

Source: US FBI

Note: View the superseding indictment here.

Phobos Ransomware Group Alleged to have Attacked Over 1,000 Victims Worldwide

The Justice Department today unsealed criminal charges against Roman Berezhnoy, 33, and Egor Nikolaevich Glebov, 39, both Russian nationals, who allegedly operated a cybercrime group using the Phobos ransomware that victimized more than 1,000 public and private entities in the United States and around the world and received over $16 million in ransom payments. Berezhnoy and Glebov were arrested this week as part of a coordinated international disruption of their organization, which includes additional arrests and the technical disruption of the group’s computer infrastructure.

From May 2019, through at least October 2024, Berezhnoy, Glebov, and others allegedly caused victims to suffer losses resulting from the loss of access to their data in addition to the financial losses associated with the ransomware payments. The victims included a children’s hospital, health care providers, and educational institutions.

8Base Seizure Banner

According to court documents, Berezhnoy, Glebov, and others operated a ransomware affiliate organization, including under the names “8Base” and “Affiliate 2803,” among others, that victimized public and private entities through the deployment of Phobos ransomware.

As part of the scheme, Berezhnoy, Glebov, and others allegedly hacked into victim computer networks, copied and stole files and programs on the victims’ network, and encrypted the original versions of the stolen data with Phobos ransomware. The conspirators then allegedly extorted the victims for ransom payments in exchange for the decryption keys to regain access to the encrypted data by, among other things, leaving a ransom note on compromised victim computers and separately reaching out to victims to initiate ransom payment negotiations.

As alleged, the conspirators also threatened to expose victims’ stolen files to the public or to the victims’ clients, customers, or constituents if the ransoms were not paid. The conspirators are further alleged to have established and operated a darknet website where they repeated their extortionate threats and ultimately published the stolen data if a victim failed to pay the ransom.

After a successful Phobos ransomware attack, criminal affiliates paid fees to Phobos administrators for a decryption key to regain access to the encrypted files. Each deployment of Phobos ransomware was assigned a unique alphanumeric string in order to match it to the corresponding decryption key, and each affiliate was directed to pay the decryption key fee to a cryptocurrency wallet unique to that affiliate.

The charges unsealed today against Berezhnoy and Glebov follow the recent arrest and extradition of Evgenii Ptitsyn, a Russian national, on charges relating to his alleged administration of the Phobos ransomware variant.

In parallel with this week’s arrests, Europol and German authorities have announced an international operation involving the FBI and other international law enforcement partners to disrupt over 100 servers associated with this criminal network.

Berezhnoy and Glebov are charged in an 11-count indictment with one count of wire fraud conspiracy, one count of wire fraud, one count of conspiracy to commit computer fraud and abuse, three counts of causing intentional damage to protected computers, three counts of extortion in relation to damage to a protected computer, one count of transmitting a threat to impair the confidentiality of stolen data, and one count of unauthorized access and obtaining information from a protected computer. If convicted, Berezhnoy and Glebov face a maximum penalty of 20 years in prison on each wire fraud-related count; 10 years in prison on each computer damage count; and five years in prison on each of the other counts. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

Supervisory Official Antoinette T. Bacon of the Justice Department’s Criminal Division, U.S. Attorney Erek L. Barron for the District of Maryland, Assistant Director Bryan Vorndran of the FBI’s Cyber Division, and Special Agent in Charge William J. DelBagno of the FBI Baltimore Field Office made the announcement.

The FBI Baltimore Field Office is investigating the case. The Justice Department extends its thanks to international judicial and law enforcement partners in the United Kingdom, Germany, Japan, Spain, Belgium, Poland, Czech Republic, France, Thailand, Finland, Switzerland, and Romania, as well as Europol and the U.S. Department of Defense Cyber Crime Center, for their cooperation and coordination with the Phobos ransomware investigation. The National Security Division’s National Security Cyber Section and the Justice Department’s Office of International Affairs also provided valuable assistance.

Senior Counsel Aarash A. Haghighat of the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorney Thomas M. Sullivan for the District of Maryland are prosecuting the case. Former CCIPS Trial Attorney Riane Harper and former Assistant U.S. Attorneys Aaron S.J. Zelinsky and Jeffrey J. Izant for the District of Maryland provided substantial assistance.

Additional details on protecting networks against Phobos ransomware are available at StopRansomware.gov, including Cybersecurity and Infrastructure Security Agency Advisory AA24-060A.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Source: US FBI

Through the coordinated efforts of the FBI Cincinnati, Newark and New York field offices, the FBI arrested Dimitriy “Russo” Nezhinskiy, owner and manager of Big Apple General Buyers, and Juan Villar, an employee, in Manhattan’s Diamond District. They are accused in the Eastern District of New York of running the largest east coast “fence”, which is a hub to resell stolen goods. Additionally, a federal grand jury in Cincinnati indicted three defendants believed to be operating as part of the organized group and charged them with transporting stolen goods interstate and falsifying records in a federal investigation. The three men allegedly committed a burglary at the home of an NFL player last year.

In addition to high-end residential burglaries, SATGs are known to target traveling jewelry salesmen as they transport their inventory from location to location. They usually use facilitators, known as “fences,” to liquidate stolen merchandise. A fence is an individual or business who knowingly purchases stolen property and then resells it to others. In some scenarios, they send the stolen goods to Chile or Colombia. This week, a Chilean man, believed to be part of the South American Theft Group, was also charged for his involvement in a conspiracy to break into a jewelry store in New Jersey and then cross state lines with the stolen property.

Crimes committed by South American Theft Groups can victimize anyone, not just professional athletes. The FBI has an initiative targeting SATGs, which involves individuals from Chile and other South American countries exploiting illegal entry or tourist visas to travel in and out of the U.S. to facilitate theft and transportation of stolen goods internationally. This initiative dedicates resources through various active investigations and major theft task forces, which include our state and local partners, throughout the country and shares intelligence with law enforcement partners around the world.

You can visit tips.fbi.gov to report suspected South American Theft Group activity to the Bureau. Tips may be submitted anonymously.

Source: US FBI

The Federal Bureau of Investigation has named Mehtab Syed as the special agent in charge of the Salt Lake City Field Office. Ms. Syed most recently served as special agent in charge of Cyber and Counterintelligence Division in the Los Angeles Field Office.

Ms. Syed entered on duty as an FBI special agent in August 2005. She was assigned to the New York Field Office, where she worked counterterrorism investigations and was a member of the crisis negotiation team and the rapid deployment team. 

In 2008, Ms. Syed deployed to Islamabad, Pakistan, and served as acting assistant legal attaché. She was responsible for conducting extensive coordination between law enforcement, intelligence, and security services of multiple governments. She then returned to the New York Field Office until 2012.

Ms. Syed was assigned to an 18-month temporary duty assignment (TDY) at the Counterterrorism Division at FBI Headquarters in 2012. She worked as the program manager for extraterritorial counterterrorism cases in the Pakistan/Afghanistan region. 

In April 2015, Ms. Syed reported to LEGAT Amman as the assistant legal attaché. Ms. Syed returned to the New York Field Office as a supervisor for the New York Joint Terrorism Task Force (NY JTTF) in 2017. Ms. Syed was promoted to acting assistant special agent in charge of the NY JTTF’s Extraterritorial Branch in 2020.

In November 2020, Ms. Syed was selected as the assistant special agent in charge of the cyber and counterintelligence branch of the Newark Field Office. In 2022, Ms. Syed was promoted to section chief of China Operations II Branch of the Counterintelligence Division at FBI Headquarters. In April of 2023, Ms. Syed served as special agent in charge of Cyber and Counterintelligence Division in the Los Angeles Field Office

Prior to her career as a special agent for the FBI, Ms. Syed served at the Bureau as a contract linguist from 2004-2005. She has also worked as a financial analyst at the corporate office of Cosi, a restaurant chain with locations throughout the U.S. Ms. Syed received a bachelor’s degree in finance from Adelphi University in 2001.