Category: Security

Source: US FBI

Note: View the superseding indictment here.

Phobos Ransomware Group Alleged to have Attacked Over 1,000 Victims Worldwide

The Justice Department today unsealed criminal charges against Roman Berezhnoy, 33, and Egor Nikolaevich Glebov, 39, both Russian nationals, who allegedly operated a cybercrime group using the Phobos ransomware that victimized more than 1,000 public and private entities in the United States and around the world and received over $16 million in ransom payments. Berezhnoy and Glebov were arrested this week as part of a coordinated international disruption of their organization, which includes additional arrests and the technical disruption of the group’s computer infrastructure.

From May 2019, through at least October 2024, Berezhnoy, Glebov, and others allegedly caused victims to suffer losses resulting from the loss of access to their data in addition to the financial losses associated with the ransomware payments. The victims included a children’s hospital, health care providers, and educational institutions.

8Base Seizure Banner

According to court documents, Berezhnoy, Glebov, and others operated a ransomware affiliate organization, including under the names “8Base” and “Affiliate 2803,” among others, that victimized public and private entities through the deployment of Phobos ransomware.

As part of the scheme, Berezhnoy, Glebov, and others allegedly hacked into victim computer networks, copied and stole files and programs on the victims’ network, and encrypted the original versions of the stolen data with Phobos ransomware. The conspirators then allegedly extorted the victims for ransom payments in exchange for the decryption keys to regain access to the encrypted data by, among other things, leaving a ransom note on compromised victim computers and separately reaching out to victims to initiate ransom payment negotiations.

As alleged, the conspirators also threatened to expose victims’ stolen files to the public or to the victims’ clients, customers, or constituents if the ransoms were not paid. The conspirators are further alleged to have established and operated a darknet website where they repeated their extortionate threats and ultimately published the stolen data if a victim failed to pay the ransom.

After a successful Phobos ransomware attack, criminal affiliates paid fees to Phobos administrators for a decryption key to regain access to the encrypted files. Each deployment of Phobos ransomware was assigned a unique alphanumeric string in order to match it to the corresponding decryption key, and each affiliate was directed to pay the decryption key fee to a cryptocurrency wallet unique to that affiliate.

The charges unsealed today against Berezhnoy and Glebov follow the recent arrest and extradition of Evgenii Ptitsyn, a Russian national, on charges relating to his alleged administration of the Phobos ransomware variant.

In parallel with this week’s arrests, Europol and German authorities have announced an international operation involving the FBI and other international law enforcement partners to disrupt over 100 servers associated with this criminal network.

Berezhnoy and Glebov are charged in an 11-count indictment with one count of wire fraud conspiracy, one count of wire fraud, one count of conspiracy to commit computer fraud and abuse, three counts of causing intentional damage to protected computers, three counts of extortion in relation to damage to a protected computer, one count of transmitting a threat to impair the confidentiality of stolen data, and one count of unauthorized access and obtaining information from a protected computer. If convicted, Berezhnoy and Glebov face a maximum penalty of 20 years in prison on each wire fraud-related count; 10 years in prison on each computer damage count; and five years in prison on each of the other counts. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

Supervisory Official Antoinette T. Bacon of the Justice Department’s Criminal Division, U.S. Attorney Erek L. Barron for the District of Maryland, Assistant Director Bryan Vorndran of the FBI’s Cyber Division, and Special Agent in Charge William J. DelBagno of the FBI Baltimore Field Office made the announcement.

The FBI Baltimore Field Office is investigating the case. The Justice Department extends its thanks to international judicial and law enforcement partners in the United Kingdom, Germany, Japan, Spain, Belgium, Poland, Czech Republic, France, Thailand, Finland, Switzerland, and Romania, as well as Europol and the U.S. Department of Defense Cyber Crime Center, for their cooperation and coordination with the Phobos ransomware investigation. The National Security Division’s National Security Cyber Section and the Justice Department’s Office of International Affairs also provided valuable assistance.

Senior Counsel Aarash A. Haghighat of the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorney Thomas M. Sullivan for the District of Maryland are prosecuting the case. Former CCIPS Trial Attorney Riane Harper and former Assistant U.S. Attorneys Aaron S.J. Zelinsky and Jeffrey J. Izant for the District of Maryland provided substantial assistance.

Additional details on protecting networks against Phobos ransomware are available at StopRansomware.gov, including Cybersecurity and Infrastructure Security Agency Advisory AA24-060A.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Source: US FBI

Through the coordinated efforts of the FBI Cincinnati, Newark and New York field offices, the FBI arrested Dimitriy “Russo” Nezhinskiy, owner and manager of Big Apple General Buyers, and Juan Villar, an employee, in Manhattan’s Diamond District. They are accused in the Eastern District of New York of running the largest east coast “fence”, which is a hub to resell stolen goods. Additionally, a federal grand jury in Cincinnati indicted three defendants believed to be operating as part of the organized group and charged them with transporting stolen goods interstate and falsifying records in a federal investigation. The three men allegedly committed a burglary at the home of an NFL player last year.

In addition to high-end residential burglaries, SATGs are known to target traveling jewelry salesmen as they transport their inventory from location to location. They usually use facilitators, known as “fences,” to liquidate stolen merchandise. A fence is an individual or business who knowingly purchases stolen property and then resells it to others. In some scenarios, they send the stolen goods to Chile or Colombia. This week, a Chilean man, believed to be part of the South American Theft Group, was also charged for his involvement in a conspiracy to break into a jewelry store in New Jersey and then cross state lines with the stolen property.

Crimes committed by South American Theft Groups can victimize anyone, not just professional athletes. The FBI has an initiative targeting SATGs, which involves individuals from Chile and other South American countries exploiting illegal entry or tourist visas to travel in and out of the U.S. to facilitate theft and transportation of stolen goods internationally. This initiative dedicates resources through various active investigations and major theft task forces, which include our state and local partners, throughout the country and shares intelligence with law enforcement partners around the world.

You can visit tips.fbi.gov to report suspected South American Theft Group activity to the Bureau. Tips may be submitted anonymously.

Source: US FBI

The Federal Bureau of Investigation has named Mehtab Syed as the special agent in charge of the Salt Lake City Field Office. Ms. Syed most recently served as special agent in charge of Cyber and Counterintelligence Division in the Los Angeles Field Office.

Ms. Syed entered on duty as an FBI special agent in August 2005. She was assigned to the New York Field Office, where she worked counterterrorism investigations and was a member of the crisis negotiation team and the rapid deployment team. 

In 2008, Ms. Syed deployed to Islamabad, Pakistan, and served as acting assistant legal attaché. She was responsible for conducting extensive coordination between law enforcement, intelligence, and security services of multiple governments. She then returned to the New York Field Office until 2012.

Ms. Syed was assigned to an 18-month temporary duty assignment (TDY) at the Counterterrorism Division at FBI Headquarters in 2012. She worked as the program manager for extraterritorial counterterrorism cases in the Pakistan/Afghanistan region. 

In April 2015, Ms. Syed reported to LEGAT Amman as the assistant legal attaché. Ms. Syed returned to the New York Field Office as a supervisor for the New York Joint Terrorism Task Force (NY JTTF) in 2017. Ms. Syed was promoted to acting assistant special agent in charge of the NY JTTF’s Extraterritorial Branch in 2020.

In November 2020, Ms. Syed was selected as the assistant special agent in charge of the cyber and counterintelligence branch of the Newark Field Office. In 2022, Ms. Syed was promoted to section chief of China Operations II Branch of the Counterintelligence Division at FBI Headquarters. In April of 2023, Ms. Syed served as special agent in charge of Cyber and Counterintelligence Division in the Los Angeles Field Office

Prior to her career as a special agent for the FBI, Ms. Syed served at the Bureau as a contract linguist from 2004-2005. She has also worked as a financial analyst at the corporate office of Cosi, a restaurant chain with locations throughout the U.S. Ms. Syed received a bachelor’s degree in finance from Adelphi University in 2001. 

Source: US FBI

PHILADELPHIA – United States Attorney David Metcalf announced that Kimberly Lawson, 44, of Philadelphia, Pennsylvania, was sentenced today by United States District Court Judge Michael M. Baylson to 60 months in prison, five years of supervised release, and $244,343 in restitution, for the unauthorized use of her employer’s identity to embezzle from him and his company and her fraudulent applications to the Small Business Administration (SBA) to obtain Economic Injury Disaster Loans (“EIDL”).

In September 2023, Lawson was charged by indictment with one count of bank fraud, one count of aggravated identity theft, and four counts of wire fraud, and pleaded guilty to all charges against her in September 2024.

The fraud loss attributed to Lawson for the workplace embezzlement is $250,817.80, and for the fraud against the government $23,000, for a total fraud loss amount of $273,817.80.

In March 2018, Lawson began working as the office manager of an area electrical contracting company, where her responsibilities included tracking employee hours, invoices, and vendor payments, and writing checks to vendors from the company’s bank account. She was also responsible for reconciling bank statements, reviewing images of checks, and confirming the checks cleared. Lawson did not have signature authority on the checks but was authorized to use her employer’s signature stamp to sign the checks he authorized.

As detailed in court filings and admitted to by the defendant, between 2018 and 2020, Lawson used her knowledge and access to divert significant amounts of the company’s money to external accounts that she controlled, through hundreds of fraudulent vendor and employee payments, unauthorized payroll transactions, and unauthorized electronic transfers. To avoid discovery of her fraudulent activities, Lawson intentionally mislabeled entries in the company’s accounting software, making them look authentic by recording them as legitimate payables.

In addition, the defendant attempted to steal money from her employer’s 401k account, submitting two separate loan requests totaling more than $17,000, but her employer learned of and was able to cancel the requests before any funds were disbursed.

In addition to the workplace embezzlement, Lawson fraudulently sought $253,874 in EIDLs from the SBA, filed in 15 separate applications in different names including her own. Only the applications that she submitted in her husband’s and his sister’s names were approved for funding, with each receiving $8,500 and $14,500, respectively, deposited into bank accounts controlled by Lawson. Among numerous false statements made in the applications, Lawson falsely represented that she had a retail business, that her husband had a construction business, and her sister-in-law had a cleaning business.

In 2012, Lawson was convicted in the Eastern District of Pennsylvania of defrauding a different employer of more than $293,000 and received a sentence of 21 months’ imprisonment.

“Kimberly Lawson’s greed is her downfall,” said U.S. Attorney Metcalf. “This is now the second time that she’s being sentenced for stealing hundreds of thousands of dollars from an employer — and this go-round, she decided to defraud the federal government, as well. Perhaps today’s longer prison term will prove more impactful than her first. Either way, we won’t rest until criminals like this get the message that we will find and punish financial fraud.”

“Through a multitude of deceptions and manipulations, Ms. Lawson stole from her employer and from the United States in the pursuit of her own personal gain,” said Assistant Special Agent in Charge Dave Carter of FBI Philadelphia. “This sentencing serves as a reminder that those who exploit their positions for financial profits will be held accountable. I want to thank our FBI personnel and our partners at the U.S. Attorney’s Office for their diligent efforts in bringing this defendant to justice.”

The case was investigated by the FBI and is being prosecuted by Assistant United States Attorney Anita Eve.

Source: US FBI

Samantha Miller of Columbia County, Oregon, was sentenced to federal prison for her role in a conspiracy to defraud customers seeking to adopt pets.

Source: US FBI

MEDFORD, Ore.— Negasi Zuberi, 31, of Klamath Falls, Oregon, was sentenced to life in federal prison today for kidnapping and sexually assaulting two women, and holding one in a cell he constructed in his garage.

“There is no place in civil society for this type of terrifying violence,” said Natalie Wight, U.S. Attorney for the District of Oregon. “I sincerely hope Zuberi’s life sentence will bring some measure of comfort to his victims. Their courage and perseverance are an inspiration to us all.”

According to court documents, on July 15, 2023, while in Seattle, Zuberi posed as a police officer and used a taser and handcuffs to detain his victim in the backseat of his vehicle. Zuberi then transported the victim approximately 450 miles to his home in Klamath Falls, stopping along the way to sexually assault her.

At his residence, the victim was moved from his vehicle into a cell he had constructed in his garage. The woman repeatedly banged on the cell door until it broke open and she escaped. The victim retrieved a handgun from Zuberi’s vehicle, fled his garage, and flagged down a passing motorist who called 911.

On July 16, 2023, Reno Police Department officers and Nevada State Patrol officers located Zuberi in a parking lot in Reno, Nevada. After a short standoff, Zuberi surrendered to law enforcement and was taken into custody.

While investigating Zuberi’s crimes, federal agents discovered that approximately six weeks prior to the kidnapping in Seattle, on May 6, 2023, Zuberi kidnapped and sexually assaulted another victim. While being held by Zuberi, his first victim observed stacked cinder blocks in his garage that he later used to construct the cell where he detained his second victim.

On August 2, 2023, a federal grand jury in Medford returned an indictment charging Zuberi with kidnapping and transporting a victim with intent to engage in criminal sexual activity. Later, on February 15, 2024, a second kidnapping charge and charges for illegally possessing firearms and ammunition.

On October 18, 2024, a federal jury found Zuberi guilty of all charges.

This case was investigated by the FBI Portland and Reno, Nevada Field Offices, Klamath Falls Police Department, and Oregon State Police with assistance from the U.S. Attorney’s Office for the District of Nevada; Klamath County District Attorney’s Office; Reno, Nevada Police Department; Washoe County, Nevada District Attorney’s Office; Nevada State Police; and Klamath Falls Sheriff’s Office. It was prosecuted by Jeffrey S. Sweet, Nathan J. Lichvarcik, and Marco A. Boccato, Assistant U.S. Attorneys for the District of Oregon, with assistance from Appellate Chief Suzanne Miles, also of the District of Oregon.

Source: US FBI

NEWARK, N.J. – Seven members of an interstate burglary crew were charged for conspiring to target homeowners across multiple states in residential burglaries, Acting U.S. Attorney Vikas Khanna announced.

Christofer Sanguesa Aguirre, Fabiana Prado Scatarzi, Santana Arturo Castillo Gonzalez, Felipe Andres Del Valle Munoz, Carlos Alfredo Calderon Valencia, Diego Antonio Calderon Leiva, and Pedro Alejandro Salgado Vallejos, all Chilean nationals, were each charged by complaint with one count of conspiracy to sell and receive stolen property that had crossed state lines and one count of receiving stolen property that had crossed state lines.

“Residential burglaries have a traumatic and personal impact upon the people whose homes are violated.  Seven Chilean nationals have been charged with conspiring to target homeowners in residential burglaries across multiple states from New Jersey to Massachusetts, resulting in the theft of expensive wristwatches, designer handbags, and thousands of dollars in cash.  This office will continue to pursue those who commit these serious crimes.”

Acting U.S. Attorney Vikas Khanna

“We allege these men and women ransacked houses here in New Jersey and the East Coast, and then quickly traveled across the country, stealing over one hundred thousand dollars in valuables from private homes.” FBI-Newark Special Agent-in-charge Brian J. Driscoll, Jr. said.  “These alleged criminals are part of South American theft groups who have been coming in and out of the United States for months.  They hit an area and immediately disappear, using fake identifications and short-term rentals to evade getting caught.  It’s like chasing ghosts.  We put in a tremendous amount of hard work with incredible partner agencies from here to Oregon.  We caught this group—and a warning to others, this doesn’t end here.”

“This is another outstanding example how cooperation, both on a local and national level amongst law enforcement agencies, yields positive outcomes for public safety in our communities,” said Immigrations and Customs Enforcement – Enforcement and Removal Operations, Newark Field Office Director John Tsoukaris.  “ERO’s contributions to this investigation, initially with the defendants’ arrests on immigration charges, were critical in facilitating the criminal charges.”

“To disrupt these fast-moving, well-traveled crime networks, it often takes strong collaboration and state-of-the-art technology.  Thankfully, we have both,” said Port Authority Police Superintendent Edward Cetnar.  “By working together and leveraging our advanced technology, including CCTV and ALPR systems, we were able to track these subjects across state lines so that we could assist our law enforcement partners in apprehending them.  This operation is a testament to the strength of cooperation throughout our vast law enforcement family, including our longtime partners at the FBI Newark Joint Organized Crime Task Force and the New Jersey U.S. Attorney’s Office.”

Sanguesa Aguirre and Castillo Gonzalez appeared on January 15, 2025, before U.S. Magistrate Judge Cathy L. Waldor in Newark federal court and were detained.  Del Valle Munoz and Calderon Valencia had their initial appearances on January 15, 2025, before U.S. Magistrate Judge Theresa L. Fricke in federal court in Tacoma, Washington, and were detained.  Calderon Leiva had his initial appearance on January 15, 2025, before U.S. Magistrate Judge Daryl F. Bloom in federal court in Harrisburg, Pennsylvania and was detained. Prado Scatarzi appeared before U.S. Magistrate Judge Carol B. Whitehurst in federal court in Lafayette, Louisiana today and was detained.  Salgado Vallejos appeared before U.S. Magistrate Judge Paul G. Levenson in federal court in Boston, Massachusetts today and was detained.

According to documents filed in this case and statements made in court:

The defendants were part of a sophisticated burglary ring that committed multiple residential burglaries in November 2024 in New Jersey and Massachusetts.  The defendants conspired to possess large amounts of jewelry, watches, designer handbags, and other valuable goods, among other items, with the losses totaling over $100,000.

Law enforcement searched a vehicle the defendants were using to transport the stolen goods and recovered multiple pieces of jewelry, designer handbags and belts, perfume bottles, paper currency, watches, and other valuable items, alongside tools commonly used to burglarize residences. After law enforcement stopped the vehicle, Del Valle Munoz and Calderon Valencia fled across the country, eventually appearing near Seattle, Washington before traveling to a residence in Carlton, Oregon.  Law enforcement searched the residence where Del Valle Munoz, Calderon Valencia, and others had arrived and recovered bags and backpacks containing additional gold jewelry, diamonds, and watches, along with additional burglary tools.

The charge of conspiracy to sell or receive stolen property carries a maximum penalty of five years in prison; and the charge of receipt of stolen property carries a maximum potential penalty of ten years in prison. Both charges also carry a maximum potential penalty of up to a $250,000 fine, or twice the amount of money involved in the offense, whichever is greater.

Acting U.S. Attorney Khanna credited the FBI Newark’s Joint Organized Crime Task Force (JOCTF), under the direction of Special Agent in Charge Brian J. Driscoll, Jr. in Newark; Immigration and Customs Enforcement – Enforcement and Removal Operations, under the direction of Field Office Director John Tsoukaris; and the Port Authority of New York and New Jersey Police Department, under the direction of Superintendent of Police Edward T. Cetnar, with the investigation leading to the charges. He also thanked the Colts Neck Police Department, Keansburg Police Department, Fort Lee Police Department, Paramus Police Department, New Jersey State Police, Monmouth County Prosecutor’s Office, Spring Valley Police Department (NY), Town of Greenburgh Police Department (NY), Wellesley Police Department (MA), Westwood Police Department (MA), Massachusetts State Police, Renton Police Department (WA), King County Sheriff’s Office (WA), Tukwila Police Department (WA), Oregon State Police, Yamhill County Sheriff’s Office (OR), Carlton Police Department (OR), Denver Police Department (CO), Pennsylvania State Police, Novi Police Department (MI), ICE/ERO Portland, ICE/ERO Seattle, U.S. Customs and Border Protection, FBI New York, FBI Philadelphia, FBI Seattle, FBI Portland, FBI Denver, FBI New Orleans, FBI Boston, and FBI Legal Attaché Santiago, Chile.

Anyone who believes they may be a victim, or has information about the theft group or burglaries, is asked to call 1-800-CALL-FBI, submit the information online at tips.fbi.gov, or call a local field office.

The government is represented by Assistant U.S. Attorney Trevor A. Chenoweth of the Narcotics/OCDETF Unit in Newark.

The charges and allegations contained in the complaint are merely accusations, and the defendants are presumed innocent unless and until proven guilty.

                                                             ###

Defense counsel:

Christofer Sanguesa Aguirre: Claressa Lowe, Esq., Newark, New Jersey

Fabiana Prado Scatarzi:  James N. Green, Esq., Lafayette, Louisiana

Santana Arturo Castillo Gonzalez: Michael Simon, Esq., Mountainside, New Jersey

Felipe Andres Del Valle Munoz: John Carpenter, Esq., Tacoma, Washington

Carlos Alfredo Calderon Valencia: Thomas Weaver, Esq., Bremerton, Washington

Diego Antonio Calderon Leiva: Thomas Thornton, Esq., Harrisburg, Pennsylvania

Pedro Alejandro Salgado Vallejos: Michael Tumposky, Esq., Boston, Massachusetts

Source: US FBI

Source: US FBI

EUGENE, Ore.—A Redmond, Oregon man was sentenced to federal prison Tuesday for using a stolen identity to open more than 30 bank accounts and credit cards and evading payments on his $1.1 million tax debt.

Michael David Anastasia, 69, was sentenced to 24 months in federal prison and three years’ supervised release. He was also ordered to pay $777,899 in restitution to his victim. Restitution to the IRS will be determined at a later date.

According to court documents, from 2002 until January 2020, Anastasia knowingly and intentionally used the social security number of a victim to open numerous bank accounts and credit cards. In addition, between 1991 and 2003, Anastasia received $1.4 million from another victim after convincing them of a fabricated agreement with the United States to secure access to allegedly seized funds. In 2007, Anastasia was convicted of tax evasion for failing to pay federal income taxes on the funds received from the victim.

In November 2015, following his release from prison, Anastasia entered into an agreement with the IRS whereby he would make payments towards his tax debt if he received more than $4,526 per month. Rather than pay his taxes, Anastasia convinced the victim to send funds over this amount to his roommate. Anastasia instructed his roommate to withdraw the overage in cash, which Anastasia stored in a safe in his residence. Between March 2016 and September 2018, Anastasia evaded paying more than $180,000 to the IRS.

On February 15, 2024, a federal grand jury in Eugene returned a nine-count superseding indictment charging Anastasia with wire fraud, aggravated identity theft, tax evasion, and making false statements to financial institutions.

On September 4, 2024, Anastasia pleaded guilty to tax evasion and identity theft.

This case was investigated by the FBI and IRS. It was prosecuted by Gavin W. Bruce and William M. McLaren, Assistant U.S. Attorneys for the District of Oregon.

Source: US FBI

OKLAHOMA CITY – GENESIS NYRELL YOUNG, 21, of Oklahoma City, has been sentenced to serve 22 months in federal prison for unlawful possession of a machinegun, announced U.S. Attorney Robert J. Troester.

On September 4, 2024, a federal Grand Jury charged Young with unlawful possession of a machinegun. According to public record, on April 24, 2024, officers with the Oklahoma City Police Department (OCPD) executed a search warrant on Young’s home, during which they found a machinegun conversion device (MCD) inside a baby’s crib. Commonly referred to as switches, MCDs convert semi-automatic weapons into fully automatic machineguns. Possession of an MCD violates federal law. A pistol and an extended magazine were also located lying next to the crib.

On January 9, 2025, Young pleaded guilty, and admitted he knowingly possessed the MCD.

At the sentencing hearing on April 23, 2025, U.S. District Judge Jodi W. Dishman sentenced Young to serve 22 months in federal prison, followed by three years of supervised release. In announcing her sentence, Judge Dishman noted the serious nature and circumstances of the offense.

This case is the result of an investigation by the FBI Oklahoma City Field Office and OCPD. Assistant U.S. Attorney David Nichols, Jr. prosecuted the case.

This case is also part of Project Safe Neighborhoods (PSN), a program bringing together all levels of law enforcement and the communities they serve to reduce violent crime and gun violence, and to make our neighborhoods safer for everyone. This case is also part of “Project Switch Off,” the Western District of Oklahoma’s local implementation of PSN. “Project Switch Off” targets illegal machinegun conversion devices to address the significant danger these illegal devices present and to remove them from our streets. For more information about PSN and “Project Switch Off,” please visit https://justice.gov/psn and https://justice.gov/usao-wdok.

Reference is made to public filings for additional information.