Category: Security

Source: US FBI

The Federal Bureau of Investigation has named Timothy A. Ferguson as the assistant director of the Criminal Justice Information Services Division in Clarksburg, West Virginia. Mr. Ferguson has served as the acting assistant director of the CJIS Division since April 2024.

Mr. Ferguson joined the FBI as a special agent in 2002 and was assigned to the Dayton Resident Agency under the Cincinnati Field Office in Ohio, where he primarily worked criminal investigations with the Southern Ohio Safe Streets Task Force. He was promoted to supervisory senior resident agent in 2011.

In 2015, Mr. Ferguson was promoted to assistant section chief of the Violent Crime and Gang Section in the Criminal Investigative Division at FBI Headquarters in Washington, D.C. He oversaw the division’s Safe Streets and Gang Unit, Violent Crime Unit, and Indian Country Crime Unit.

Mr. Ferguson moved to the Springfield Field Office in Illinois in 2018 to serve as the assistant special agent in charge of the Criminal Branch. In 2020, he returned to FBI Headquarters as the section chief of the Field Operations Section and the Digital Forensics and Analytics Section in the Operational Technology Division.

In 2023, Mr. Ferguson was promoted to deputy assistant director of the CJIS Division, responsible for the FBI’s National Threat Operations Center and the National Instant Criminal Background Check System Section.

During his FBI career, Mr. Ferguson has served as a crisis negotiator, a SWAT Team operator, a medic, an adjunct faculty member, and a Behavioral Analysis Unit coordinator.

Prior to joining the FBI, Mr. Ferguson served in the U.S. Army. He earned a bachelor’s degree in English from Welsh College in Nashville, Tennessee, and a master’s degree in behavioral science from Wright State University in Dayton, Ohio.

Source: US FBI

The Federal Bureau of Investigation has named Robert K. Tripp as the assistant director of the Human Resources Division at FBI Headquarters in Washington, D.C. Mr. Tripp most recently served as the special agent in charge of the San Francisco Field Office.

Mr. Tripp joined the FBI as an intelligence research specialist in 1998 and worked in the Criminal Investigative Division at Headquarters. He became a special agent in 2003 and was assigned to the St. Louis Field Office to investigate public corruption and white-collar crime.

In 2006, Mr. Tripp transferred to the Washington Field Office and was detailed to work international mass marketing fraud through the Department of Justice Fraud Section. He was promoted to supervisory special agent in 2012 and worked in the Director’s Research Group at Headquarters, which prepares the director for meetings, conferences, and events.

Mr. Tripp transferred to the Sacramento Field Office in California in 2014. He first supervised a public corruption and civil rights squad, then a squad responsible for violent crime and violent crimes against children. He was also the supervisor of the Fairfield Resident Agency, a Sacramento satellite office.

In 2018, Mr. Tripp was promoted to assistant special agent in charge of the Sacramento office, responsible for all investigations of criminal and cyber threats and overseeing the criminal squads in Sacramento’s seven resident agencies. He also served as the acting commander of the newly established Sacramento Organized Crime Drug Enforcement Task Force.

Mr. Tripp was promoted to inspector in 2021 and returned to Headquarters. He was promoted to special agent in charge of the San Francisco Field Office in 2022.

Mr. Tripp earned a bachelor’s degree in history from Cornell University in Ithaca, New York, and a master’s and doctorate in history from Washington University in St. Louis.

Source: US FBI

Jairo Jaime Tinajero, 25, pleaded guilty yesterday in the Western District of Kentucky to the following charges contained in the superseding information: racketeering conspiracy, online enticement, three counts of production of child sexual abuse material, three counts of distribution of child sexual abuse material (CSAM), five counts of interstate communications of threats, cyberstalking, and conspiracy to murder Jane Doe 1 in aid of racketeering. The terms of the plea agreement specify that both parties agree to the applicability of the terrorism sentencing enhancement (U.S.S.G. § 3A1.4 n. 4).

On Oct. 11, 2023, a grand jury in the Western District of Kentucky returned an indictment charging Tinajero with online enticement and production of child sexual abuse material. On Oct. 4, 2023, in the Eastern District of Arkansas, Tinajero was arrested on a criminal complaint that was filed in the Western District of Kentucky.

According to the court documents, Tinajero is a self-identified member of the 764 network. The 764 network’s accelerationist goals include social unrest and the downfall of the current world order, including the U.S. Government. Beginning in 2020, Tinajero started communicating with, and grooming, several minor victims to obtain sexually explicit content from them, including Jane Doe 1. In 2023, Tinajero began to threaten the safety of Jane Doe 1 and her family. Tinajero posted online in encrypted platforms associated with 764 and related groups a “Lorebook” – commonly used in 764 blackmail schemes — containing Jane Doe 1’s identifying information along with nude pictures of the minor.

Between July 2023 and September 2023, during multiple discussions over social media, Tinajero and a co-conspirator agreed that Tinajero should kill Jane Doe 1. Tinajero and the co-conspirator specifically discussed that Tinajero should murder Jane Doe 1 and dispose of Jane Doe 1’s body in a barrel of acid after the murder. Tinajero posted multiple messages on various social media websites stating that he planned to kill Jane Doe 1 with a firearm because Jane Doe 1 refused to provide additional child sexual abuse material.

On Aug. 26, 2023, Tinajero posted on Telegram, “Im determined to die” and “If I gotta kill her I can’t let her live and f**k with dudes and girls while I’m sick and miserable” and “Im gonna live stream it.” Tinajero also posted a picture of Jane Doe 1. On Sept. 2, 2023, Tinajero posted on Telegram, “I wanna kill them so bad just show up at their cribs and shoot 100 rounds in 5 seconds” and, on Sept. 3, 2023, posted “I didn’t wanna do anything bc I was scared of dying or prison but now I’m determined to die if I have to after getting rid of [Jane Doe 1] . . . .” Tinajero also began soliciting others to assist with attempting to kill Jane Doe 1.

The FBI is investigating the case.

Assistant U.S. Attorney Erwin Roberts for the Western District of Kentucky and Trial Attorneys Justin Sher and James Donnelly of the National Security Division’s Counterterrorism Section are prosecuting the case. The Violent Crime and Racketeering Section for the Criminal Division and the Eastern District of Arkansas provided assistance.

Source: US FBI

Orlando, Florida – United States District Judge Carlos E. Mendoza has sentenced Alan W. Filion (18, Lancaster, CA) to four years in federal prison for making interstate threats to injure the person of another.

According to the plea agreement, from approximately August 2022 to January 2024, Filion made over 375 swatting and threat calls, including calls in which he claimed to have planted bombs in the targeted locations or threatened to detonate bombs and/or conduct mass shootings at those locations. Filion targeted religious institutions, high schools, colleges and universities, government officials, and numerous individuals across the United States.

Filion intended his calls to cause large-scale deployment of police and emergency services units to the targeted locations. During these calls, he provided information to law enforcement and emergency services agencies that he knew to be false, such as false names, false claims that he and others had placed explosives in particular locations, false claims that he and others possessed dangerous weapons, including firearms and explosives, and false claims that he and/or other individuals had committed, or intended to imminently commit, violent crimes. 

In some instances, armed law enforcement officers approached and entered a targeted residence with their weapons drawn and detained individuals that occupied the residence. Filion claimed in a post on January 20, 2023, that when he swats someone he “usually get[s] the cops to drag the victim and their families out of the house cuff them and search the house for dead bodies.” Additionally, Filion’s calls caused law enforcement officers and dispatchers to respond, and to be unavailable in response to other emergencies.

Filion became a serial swatter for both profit and recreation. He claimed in a January 19, 2023, online post that his “first” swatting was like “2 to 3 years ago” and that “6-9 months ago [he] decided to turn it into a business. . . .” On several occasions, Filion placed posts on social-media channels advertising his services and swatting-for-a-fee structure.

On January 18, 2024, Filion was arrested in California on Florida state charges arising from a May 2023 threat he made to a religious institution in Sanford, Florida. In that threat, he claimed to have an illegally modified AR-15, a Glock 17 pistol, pipe bombs, and Molotov cocktails. He said that he was going to imminently “commit a mass shooting” and “kill everyone” he saw. He pleaded guilty in federal court to making that threat.

Filion also pleaded guilty to making three other threatening calls: an October 2022 call to a public high school in the Western District of Washington, in which he threatened to commit a mass shooting and claimed to have planted bombs throughout the school; a May 2023 call to a Historically Black College & University in the Northern District of Florida, in which he claimed to have placed bombs in the walls and ceilings of campus housing that would detonate in about an hour; and a July 2023 call to a local police department dispatch number in the Western District of Texas, in which he falsely identified himself as a senior federal law enforcement officer, provided the federal law-enforcement officer’s residential address to the dispatcher, claimed to have killed his (the federal officer’s) mother, and threatened to kill any responding police officers.  

This case was investigated by the Federal Bureau of Investigation and the United States Secret Service. Valuable assistance was provided by the Seminole County (Florida) Sheriff’s Office; the Anacortes (Washington) Police Department; the Florida Department of Law Enforcement; the California Department of Justice; the Los Angeles County (California) Sheriff’s Office; and the Volusia County (Florida) Sheriff’s Office. The case is being prosecuted by Assistant United States Attorney Kara Wick, with valuable assistance from the State Attorney’s Office for Seminole County, Florida, 18^th Judicial Circuit; the Counterterrorism Section of the United States Department of Justice; and the United States Attorneys’ Offices for the Western District of Washington, the Northern District of Florida, the Western District of Texas, and the District of Columbia. 

Source: US FBI

Note: View the superseding indictment here.

Phobos Ransomware Group Alleged to have Attacked Over 1,000 Victims Worldwide

The Justice Department today unsealed criminal charges against Roman Berezhnoy, 33, and Egor Nikolaevich Glebov, 39, both Russian nationals, who allegedly operated a cybercrime group using the Phobos ransomware that victimized more than 1,000 public and private entities in the United States and around the world and received over $16 million in ransom payments. Berezhnoy and Glebov were arrested this week as part of a coordinated international disruption of their organization, which includes additional arrests and the technical disruption of the group’s computer infrastructure.

From May 2019, through at least October 2024, Berezhnoy, Glebov, and others allegedly caused victims to suffer losses resulting from the loss of access to their data in addition to the financial losses associated with the ransomware payments. The victims included a children’s hospital, health care providers, and educational institutions.

8Base Seizure Banner

According to court documents, Berezhnoy, Glebov, and others operated a ransomware affiliate organization, including under the names “8Base” and “Affiliate 2803,” among others, that victimized public and private entities through the deployment of Phobos ransomware.

As part of the scheme, Berezhnoy, Glebov, and others allegedly hacked into victim computer networks, copied and stole files and programs on the victims’ network, and encrypted the original versions of the stolen data with Phobos ransomware. The conspirators then allegedly extorted the victims for ransom payments in exchange for the decryption keys to regain access to the encrypted data by, among other things, leaving a ransom note on compromised victim computers and separately reaching out to victims to initiate ransom payment negotiations.

As alleged, the conspirators also threatened to expose victims’ stolen files to the public or to the victims’ clients, customers, or constituents if the ransoms were not paid. The conspirators are further alleged to have established and operated a darknet website where they repeated their extortionate threats and ultimately published the stolen data if a victim failed to pay the ransom.

After a successful Phobos ransomware attack, criminal affiliates paid fees to Phobos administrators for a decryption key to regain access to the encrypted files. Each deployment of Phobos ransomware was assigned a unique alphanumeric string in order to match it to the corresponding decryption key, and each affiliate was directed to pay the decryption key fee to a cryptocurrency wallet unique to that affiliate.

The charges unsealed today against Berezhnoy and Glebov follow the recent arrest and extradition of Evgenii Ptitsyn, a Russian national, on charges relating to his alleged administration of the Phobos ransomware variant.

In parallel with this week’s arrests, Europol and German authorities have announced an international operation involving the FBI and other international law enforcement partners to disrupt over 100 servers associated with this criminal network.

Berezhnoy and Glebov are charged in an 11-count indictment with one count of wire fraud conspiracy, one count of wire fraud, one count of conspiracy to commit computer fraud and abuse, three counts of causing intentional damage to protected computers, three counts of extortion in relation to damage to a protected computer, one count of transmitting a threat to impair the confidentiality of stolen data, and one count of unauthorized access and obtaining information from a protected computer. If convicted, Berezhnoy and Glebov face a maximum penalty of 20 years in prison on each wire fraud-related count; 10 years in prison on each computer damage count; and five years in prison on each of the other counts. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

Supervisory Official Antoinette T. Bacon of the Justice Department’s Criminal Division, U.S. Attorney Erek L. Barron for the District of Maryland, Assistant Director Bryan Vorndran of the FBI’s Cyber Division, and Special Agent in Charge William J. DelBagno of the FBI Baltimore Field Office made the announcement.

The FBI Baltimore Field Office is investigating the case. The Justice Department extends its thanks to international judicial and law enforcement partners in the United Kingdom, Germany, Japan, Spain, Belgium, Poland, Czech Republic, France, Thailand, Finland, Switzerland, and Romania, as well as Europol and the U.S. Department of Defense Cyber Crime Center, for their cooperation and coordination with the Phobos ransomware investigation. The National Security Division’s National Security Cyber Section and the Justice Department’s Office of International Affairs also provided valuable assistance.

Senior Counsel Aarash A. Haghighat of the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorney Thomas M. Sullivan for the District of Maryland are prosecuting the case. Former CCIPS Trial Attorney Riane Harper and former Assistant U.S. Attorneys Aaron S.J. Zelinsky and Jeffrey J. Izant for the District of Maryland provided substantial assistance.

Additional details on protecting networks against Phobos ransomware are available at StopRansomware.gov, including Cybersecurity and Infrastructure Security Agency Advisory AA24-060A.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Source: US FBI

Through the coordinated efforts of the FBI Cincinnati, Newark and New York field offices, the FBI arrested Dimitriy “Russo” Nezhinskiy, owner and manager of Big Apple General Buyers, and Juan Villar, an employee, in Manhattan’s Diamond District. They are accused in the Eastern District of New York of running the largest east coast “fence”, which is a hub to resell stolen goods. Additionally, a federal grand jury in Cincinnati indicted three defendants believed to be operating as part of the organized group and charged them with transporting stolen goods interstate and falsifying records in a federal investigation. The three men allegedly committed a burglary at the home of an NFL player last year.

In addition to high-end residential burglaries, SATGs are known to target traveling jewelry salesmen as they transport their inventory from location to location. They usually use facilitators, known as “fences,” to liquidate stolen merchandise. A fence is an individual or business who knowingly purchases stolen property and then resells it to others. In some scenarios, they send the stolen goods to Chile or Colombia. This week, a Chilean man, believed to be part of the South American Theft Group, was also charged for his involvement in a conspiracy to break into a jewelry store in New Jersey and then cross state lines with the stolen property.

Crimes committed by South American Theft Groups can victimize anyone, not just professional athletes. The FBI has an initiative targeting SATGs, which involves individuals from Chile and other South American countries exploiting illegal entry or tourist visas to travel in and out of the U.S. to facilitate theft and transportation of stolen goods internationally. This initiative dedicates resources through various active investigations and major theft task forces, which include our state and local partners, throughout the country and shares intelligence with law enforcement partners around the world.

You can visit tips.fbi.gov to report suspected South American Theft Group activity to the Bureau. Tips may be submitted anonymously.

Source: US FBI

The Federal Bureau of Investigation has named Mehtab Syed as the special agent in charge of the Salt Lake City Field Office. Ms. Syed most recently served as special agent in charge of Cyber and Counterintelligence Division in the Los Angeles Field Office.

Ms. Syed entered on duty as an FBI special agent in August 2005. She was assigned to the New York Field Office, where she worked counterterrorism investigations and was a member of the crisis negotiation team and the rapid deployment team. 

In 2008, Ms. Syed deployed to Islamabad, Pakistan, and served as acting assistant legal attaché. She was responsible for conducting extensive coordination between law enforcement, intelligence, and security services of multiple governments. She then returned to the New York Field Office until 2012.

Ms. Syed was assigned to an 18-month temporary duty assignment (TDY) at the Counterterrorism Division at FBI Headquarters in 2012. She worked as the program manager for extraterritorial counterterrorism cases in the Pakistan/Afghanistan region. 

In April 2015, Ms. Syed reported to LEGAT Amman as the assistant legal attaché. Ms. Syed returned to the New York Field Office as a supervisor for the New York Joint Terrorism Task Force (NY JTTF) in 2017. Ms. Syed was promoted to acting assistant special agent in charge of the NY JTTF’s Extraterritorial Branch in 2020.

In November 2020, Ms. Syed was selected as the assistant special agent in charge of the cyber and counterintelligence branch of the Newark Field Office. In 2022, Ms. Syed was promoted to section chief of China Operations II Branch of the Counterintelligence Division at FBI Headquarters. In April of 2023, Ms. Syed served as special agent in charge of Cyber and Counterintelligence Division in the Los Angeles Field Office

Prior to her career as a special agent for the FBI, Ms. Syed served at the Bureau as a contract linguist from 2004-2005. She has also worked as a financial analyst at the corporate office of Cosi, a restaurant chain with locations throughout the U.S. Ms. Syed received a bachelor’s degree in finance from Adelphi University in 2001. 

Source: US FBI

PHILADELPHIA – United States Attorney David Metcalf announced that Kimberly Lawson, 44, of Philadelphia, Pennsylvania, was sentenced today by United States District Court Judge Michael M. Baylson to 60 months in prison, five years of supervised release, and $244,343 in restitution, for the unauthorized use of her employer’s identity to embezzle from him and his company and her fraudulent applications to the Small Business Administration (SBA) to obtain Economic Injury Disaster Loans (“EIDL”).

In September 2023, Lawson was charged by indictment with one count of bank fraud, one count of aggravated identity theft, and four counts of wire fraud, and pleaded guilty to all charges against her in September 2024.

The fraud loss attributed to Lawson for the workplace embezzlement is $250,817.80, and for the fraud against the government $23,000, for a total fraud loss amount of $273,817.80.

In March 2018, Lawson began working as the office manager of an area electrical contracting company, where her responsibilities included tracking employee hours, invoices, and vendor payments, and writing checks to vendors from the company’s bank account. She was also responsible for reconciling bank statements, reviewing images of checks, and confirming the checks cleared. Lawson did not have signature authority on the checks but was authorized to use her employer’s signature stamp to sign the checks he authorized.

As detailed in court filings and admitted to by the defendant, between 2018 and 2020, Lawson used her knowledge and access to divert significant amounts of the company’s money to external accounts that she controlled, through hundreds of fraudulent vendor and employee payments, unauthorized payroll transactions, and unauthorized electronic transfers. To avoid discovery of her fraudulent activities, Lawson intentionally mislabeled entries in the company’s accounting software, making them look authentic by recording them as legitimate payables.

In addition, the defendant attempted to steal money from her employer’s 401k account, submitting two separate loan requests totaling more than $17,000, but her employer learned of and was able to cancel the requests before any funds were disbursed.

In addition to the workplace embezzlement, Lawson fraudulently sought $253,874 in EIDLs from the SBA, filed in 15 separate applications in different names including her own. Only the applications that she submitted in her husband’s and his sister’s names were approved for funding, with each receiving $8,500 and $14,500, respectively, deposited into bank accounts controlled by Lawson. Among numerous false statements made in the applications, Lawson falsely represented that she had a retail business, that her husband had a construction business, and her sister-in-law had a cleaning business.

In 2012, Lawson was convicted in the Eastern District of Pennsylvania of defrauding a different employer of more than $293,000 and received a sentence of 21 months’ imprisonment.

“Kimberly Lawson’s greed is her downfall,” said U.S. Attorney Metcalf. “This is now the second time that she’s being sentenced for stealing hundreds of thousands of dollars from an employer — and this go-round, she decided to defraud the federal government, as well. Perhaps today’s longer prison term will prove more impactful than her first. Either way, we won’t rest until criminals like this get the message that we will find and punish financial fraud.”

“Through a multitude of deceptions and manipulations, Ms. Lawson stole from her employer and from the United States in the pursuit of her own personal gain,” said Assistant Special Agent in Charge Dave Carter of FBI Philadelphia. “This sentencing serves as a reminder that those who exploit their positions for financial profits will be held accountable. I want to thank our FBI personnel and our partners at the U.S. Attorney’s Office for their diligent efforts in bringing this defendant to justice.”

The case was investigated by the FBI and is being prosecuted by Assistant United States Attorney Anita Eve.

Source: US FBI

Samantha Miller of Columbia County, Oregon, was sentenced to federal prison for her role in a conspiracy to defraud customers seeking to adopt pets.

Source: US FBI

MEDFORD, Ore.— Negasi Zuberi, 31, of Klamath Falls, Oregon, was sentenced to life in federal prison today for kidnapping and sexually assaulting two women, and holding one in a cell he constructed in his garage.

“There is no place in civil society for this type of terrifying violence,” said Natalie Wight, U.S. Attorney for the District of Oregon. “I sincerely hope Zuberi’s life sentence will bring some measure of comfort to his victims. Their courage and perseverance are an inspiration to us all.”

According to court documents, on July 15, 2023, while in Seattle, Zuberi posed as a police officer and used a taser and handcuffs to detain his victim in the backseat of his vehicle. Zuberi then transported the victim approximately 450 miles to his home in Klamath Falls, stopping along the way to sexually assault her.

At his residence, the victim was moved from his vehicle into a cell he had constructed in his garage. The woman repeatedly banged on the cell door until it broke open and she escaped. The victim retrieved a handgun from Zuberi’s vehicle, fled his garage, and flagged down a passing motorist who called 911.

On July 16, 2023, Reno Police Department officers and Nevada State Patrol officers located Zuberi in a parking lot in Reno, Nevada. After a short standoff, Zuberi surrendered to law enforcement and was taken into custody.

While investigating Zuberi’s crimes, federal agents discovered that approximately six weeks prior to the kidnapping in Seattle, on May 6, 2023, Zuberi kidnapped and sexually assaulted another victim. While being held by Zuberi, his first victim observed stacked cinder blocks in his garage that he later used to construct the cell where he detained his second victim.

On August 2, 2023, a federal grand jury in Medford returned an indictment charging Zuberi with kidnapping and transporting a victim with intent to engage in criminal sexual activity. Later, on February 15, 2024, a second kidnapping charge and charges for illegally possessing firearms and ammunition.

On October 18, 2024, a federal jury found Zuberi guilty of all charges.

This case was investigated by the FBI Portland and Reno, Nevada Field Offices, Klamath Falls Police Department, and Oregon State Police with assistance from the U.S. Attorney’s Office for the District of Nevada; Klamath County District Attorney’s Office; Reno, Nevada Police Department; Washoe County, Nevada District Attorney’s Office; Nevada State Police; and Klamath Falls Sheriff’s Office. It was prosecuted by Jeffrey S. Sweet, Nathan J. Lichvarcik, and Marco A. Boccato, Assistant U.S. Attorneys for the District of Oregon, with assistance from Appellate Chief Suzanne Miles, also of the District of Oregon.