Former Bank CEO Pleads Guilty to Multimillion-Dollar Wire Fraud Conspiracy and Venezuela Sanctions Evasion Scheme

Source: United States Department of Justice Criminal Division

The former Chief Executive Officer of Nodus International Bank (Nodus Bank), a Puerto Rican international bank, pleaded guilty yesterday for leading a scheme to fraudulently obtain at least $24.9 million from Nodus Bank and conspiring to evade U.S. sanctions against Venezuela.

“The defendant abused his position as CEO, turning the bank he managed into his own personal ATM and unlawfully transacting with a sanctioned individual,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “The defendant’s crimes undermine the integrity of our financial system, threaten economic prosperity, and harm national security. The Criminal Division will investigate and prosecute fraudsters to protect financial markets and promote safety and prosperity for all Americans.”

“This defendant used his position as CEO to siphon more than $24 million, hide conflicts of interest, and help drive the bank’s collapse,” said U.S. Attorney Jason A. Reding Quiñones for the Southern District of Florida. “The scheme also involved efforts to evade U.S. sanctions tied to Venezuela’s state-owned oil company, PDVSA. As a career prosecutor and former state trial judge, I’ve learned that following the money reveals the truth. Here, it exposed both fraud and sanctions violations. We will hold accountable anyone who abuses our financial system for personal gain.”

“Corporate titles don’t place anyone above the law,” said Ron Loecker, Special Agent in Charge, IRS Criminal Investigation, Florida Field Office. “Executive level fraud has real victims, and yesterday’s outcome is a step toward restoring accountability and confidence in the banking system. IRS Special Agents, alongside our partners, will keep bringing transparency to complex financial crimes and delivering results.”

According to court filings, Tomás Niembro Concha, 64, of Miami, Florida, conspired with others to siphon money from Nodus Bank, ultimately leading to the bank’s failure in 2023. Niembro and his co-conspirators concealed from other Nodus Bank board members and executives and the bank’s regulator that certain investments and loans were for the benefit of Niembro and Board Chairman Juan Ramirez, in violation of Puerto Rican law. From 2017 to 2023, Niembro, Ramirez and others caused Nodus Bank to invest $11 million in a Miami-based lender so those funds could be loaned to Niembro and Ramirez for their own benefit. Niembro and his co-conspirators knew that these transactions were illegal and concealed their conduct through the sham investments.

Between January 2018 and September 2021, Niembro and Ramirez also fraudulently induced Nodus Bank’s board and comptroller to agree to buy at least 47 promissory notes totaling approximately $25.3 million from Nodus Finance, a Miami-based company that Niembro and Ramirez jointly owned, so they could use the proceeds of the transactions for themselves.

In early March 2023, Nodus’s regulator, the Office of the Commissioner of Financial Institutions of Puerto Rico (OCIF), notified the bank it would be placed into liquidation. Niembro and Ramirez fraudulently caused Nodus Bank to accept a loan portfolio from Nodus Finance to pay down the debt from the 47 promissory notes.   

Moreover, between 2021 and 2023, Niembro conspired with others to conduct prohibited financial transactions with an individual designated as a Specially Designated National (SDN) by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) for providing material support to Venezuela’s state-owned oil company, Petróleos de Venezuela, S.A. (PDVSA). To satisfy an outstanding loan of approximately $2.5 million that the SDN’s company had with Nodus Bank prior to the imposition of sanctions, Niembro and the SDN devised a scheme to cause Nodus Bank to foreclose on the SDN’s home in Southampton, NY — for which they obtained OFAC authorization — but separately reached a “private” agreement to induce Nodus Bank to sell the property back to the SDN for $4 million through a front company — a transaction that was strictly prohibited by U.S. sanctions and not otherwise licensed by OFAC.

Niembro pleaded guilty to a two-count Information charging conspiracy to commit wire fraud and conspiracy to violate the International Emergency Economic Powers Act (IEEPA). Each charge carries a maximum penalty of 20 years in prison. Niembro’s sentencing has been scheduled for June 8. As part of his plea agreement, Niembro agreed to forfeit at least $16.9 million, which represents the value of the proceeds he derived from the wire fraud conspiracy. A federal judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

IRS Criminal Investigation (IRS-CI) investigated the case with support from OCIF and the Treasury Executive Office for Asset Forfeiture (TEOAF).

Trial Attorneys Javier Urbina and Samir Paul of the Criminal Division’s Money Laundering, Narcotics and Forfeiture Section (MNF) and Assistant U.S. Attorney Felipe Plechac-Diaz for the Southern District of Florida are prosecuting the case.

This prosecution is part of the Homeland Security Task Force (HSTF) initiative established by Executive Order 14159, Protecting the American People Against Invasion. The HSTF is a whole-of-government partnership dedicated to eliminating criminal cartels, foreign gangs, transnational criminal organizations, and human smuggling and trafficking rings operating in the United States and abroad. Through historic interagency collaboration, the HSTF directs the full might of United States law enforcement towards identifying, investigating, and prosecuting the full spectrum of crimes committed by these organizations, which have long fueled violence and instability within our borders. In performing this work, the HSTF places special emphasis on investigating and prosecuting those engaged in child trafficking or other crimes involving children. The HSTF further utilizes all available tools to prosecute and remove the most violent criminal aliens from the United States. HSTF Miami comprises agents and officers from IRS Criminal Investigation with the prosecution being led by Bank Integrity Unit of the Money Laundering Narcotics and Forfeiture Section of the Department of Justice and by the United States Attorney’s Office for the Southern District of Florida.

MNF’s mission is to take the profit out of crime, eliminate drug cartels, and protect the U.S. financial system. MNF pursues criminal prosecutions and criminal and civil asset recovery actions involving: financial facilitators who launder profits for criminals; financial institutions and their officers and employees whose actions threaten the U.S. financial system and financial institutions; international money launderers who support transnational organized crime; and the top command and control of international drug trafficking organizations.

MNF’s Bank Integrity Unit investigates and prosecutes banks and other financial institutions, including their officers, managers and employees whose actions threaten the integrity of the individual institution or the wider financial system.

Defense News in Brief: JIATF-401, in Support of Interagency Task Force, Emphasizes Zero-Tolerance Policy, Cracks Down on Drones in Restricted Airspace

Source: United States Department of War

In support of the White House Task Force to Restore American Airspace Sovereignty, the Justice Department, Department of Homeland Security, Federal Aviation Administration and War Department warn that any individual or group found operating an unauthorized drone within designated restricted airspace will face severe consequences.

Prior Felon Pleads Guilty to Drug Trafficking and Firearm Offenses

Source: United States Department of Justice Criminal Division

Pensacola, Florida – Scott Oranje, 52, of Mary Esther, Florida, pleaded guilty in federal court to possession with intent to distribute more than 40 grams of fentanyl, possession of a firearm in furtherance of a drug trafficking offense, and possession of a firearm by a convicted felon. 

Former Wheeling Business Owner Admits to COVID Fraud

Source: United States Department of Justice Criminal Division

A former Wheeling business owner has admitted to fraud totaling nearly $300,000 in COVID relief funds, announced U.S. Attorney Matthew L. Harvey. Bradley Temple, 48, of Delray Beach, Florida (formerly of Wheeling, WV) pled guilty to unlawful money transactions.

Illegal alien from Mexico charged with alien smuggling

Source: United States Department of Justice Criminal Division

U.S. Attorney Michael DiGiacomo announced today that Andres Carrillo-Hernandez, 27, a citizen of Mexico, was arrested and charged by criminal complaint with alien smuggling, which carries a mandatory minimum penalty of three years in prison, and a maximum of 10 years.   

South Carolina Man Pleads Guilty to Federal Civil Rights Crime for Racially Motivated Shooting

Source: United States Department of Justice Criminal Division

The Department of Justice announced that Jonathan Andrew Felkel, 34, entered a plea of guilty today before United States District Judge Mary Geiger Lewis for violating the housing rights of his Black neighbor, J.M., in violation of 42 U.S.C. §. 3631.

As the defendant admitted at the plea hearing, on July 17, 2025, Felkel, while driving into the community where both he and J.M. lived, fired a gun and shouted at J.M., “You better keep running, boy!” while J.M. was standing at the community gate. Felkel further admitted that, during the investigation, he told law enforcement officers that he believed Black people were committing crimes in his neighborhood, that he had assumed J.M. was a criminal due to his race, and that he had hoped to convey to J.M. that he should “leave” and “not be around this area.”

“The defendant’s actions were deeply disturbing and completely unacceptable,” said Assistant Attorney General Harmeet K. Dhillon. “We hope his conviction brings a sense of peace to the victim and greater security to Black communities across the country.”

Assistant Attorney General Harmeet K. Dhillon of the Justice Department’s Civil Rights Division; U.S. Attorney Bryan P. Stirling for the District of South Carolina; and Special Agent in Charge Kevin Moore of the FBI Columbia Field Office made the announcement.

Felkel will be sentenced at a later date. The maximum penalty is 10 years in prison.

The FBI Columbia Field Office and the Richland County Sheriff’s Department investigated the case.

Assistant U.S. Attorneys Elle Klein and Lamar Fyall of the District of South Carolina and Trial Attorney Sarah Armstrong of the Civil Rights Division’s Criminal Section are prosecuting the case.

Three Charged with Conspiring to Unlawfully Divert Cutting Edge U.S. Artificial Intelligence Technology to China

Source: United States Department of Justice Criminal Division

Today, an indictment was unsealed charging Yih-Shyan “Wally” Liaw, Ruei-Tsang “Steven” Chang, and Ting-Wei “Willy” Sun, for allegedly conspiring to divert high-performance computer servers assembled in the United States and integrating sophisticated U.S. artificial intelligence technology to China, in violation of U.S. export controls laws.  Liaw, a U.S. citizen, and Sun, a citizen of Taiwan, were arrested today and will be presented in the Northern District of California. Chang, a citizen of Taiwan, remains a fugitive.

“The indictment unsealed today details alleged efforts to evade U.S. export laws through false documents, staged dummy servers to mislead inspectors, and convoluted transshipment schemes, in order to obfuscate the true destination of restricted AI technology—China,” said John A. Eisenberg, Assistant Attorney General for National Security. “These chips are the product of American ingenuity, and NSD will continue to enforce our export-control laws to protect that advantage.”

“The FBI’s investigation revealed that Liaw, Chang, and Sun allegedly conspired to sell billions of dollars’ worth of servers integrating sensitive, controlled graphic processing units to buyers in China, in violation of U.S. export control laws,” said Assistant Director Roman Rozhavsky of the FBI’s Counterintelligence and Espionage Division.  “Controlling the export of sensitive U.S. artificial intelligence technology is essential to safeguarding our national security and defending the homeland.  That’s why combating export violations is among the FBI’s highest priorities, and we will continue working with our law enforcement, private sector, and international partners to bring to justice all who take action to undermine U.S. national security.”

“As alleged in the Indictment, the defendants participated in a systematic scheme to divert massive quantities of servers housing U.S. artificial intelligence technology to customers in China,” said U.S. Attorney Jay Clayton for the Southern District of New York. “They did so through a tangled web of lies, obfuscation, and concealment—all to drive sales and generate revenues in violation of U.S. law. Diversion schemes like those disrupted today generate billions of dollars in ill-gotten gains and pose a direct threat to U.S. national security. Our Office, along with our partners at the FBI and Department of Commerce’s Bureau of Industry and Security, will continue to doggedly investigate these illegal diversion schemes to bring to justice bad actors who aim to profit from illegally exporting U.S. artificial intelligence technology.”

“Yih-Shyan Liaw, Ruei-Tsang Chang, and Ting-Wei Sun allegedly defrauded the United States by diverting hundreds of servers with advanced artificial intelligence capabilities to Chinese customers,” said FBI Assistant Director in Charge James C. Barnacle, Jr of the New York Field Office.  “These defendants allegedly fabricated documents, staged bogus equipment to pass audit inventories, and used a pass-through company to conceal their misconduct and true clientele list.  The FBI will hold accountable individuals who use American companies to provide export-controlled technology to our adversaries.”

The entirety of the text of the indictment and the descriptions of the indictment constitute only allegations, and every fact described should be treated as an allegation. According to the allegations contained in the indictment unsealed today in Manhattan federal court:

To protect U.S. national security and foreign policy interests, the U.S. Department of Commerce has implemented license requirements for the export and reexport of artificial intelligence technologies to China and Hong Kong.  In particular, the U.S. Department of Commerce has placed restrictions on the export and reexport of items that could make a significant contribution to the military potential or nuclear proliferation of other nations or that could be detrimental to the foreign policy or national security of the United States.  For these reasons, among others, advanced artificial intelligence accelerator chips, and servers incorporating such chips, are subject to export license requirements for transfers to China and Hong Kong.  Those regulations reflect a formal determination that the computing capabilities in advanced artificial intelligence accelerator hardware are of sufficient strategic significance that their transfer to China poses an unacceptable risk to national security.

Liaw is a co-founder, board member, and Senior Vice President of Business Development of a publicly traded U.S.-based manufacturer that designs and builds high-performance computer servers for artificial intelligence and cloud computing applications (the U.S. Manufacturer), including servers that integrate artificial intelligence graphics processing units (GPUs).  Chang is a general manager in the U.S. Manufacturer’s Taiwan office.  Sun is a third-party broker and “fixer” who has worked with Liaw, Chang, and others to divert U.S.-export controlled technology to China.  Together, the defendants and others conspired to systematically divert the U.S. Manufacturer’s servers with certain GPUs to China without a license to do so from the U.S. Department of Commerce.

The scheme operated as follows. Liaw and Chang, who worked closely with third-party brokers with customers based in China, directed certain executives of a company based in Southeast Asia (“Company-1”) to place purchase orders with the U.S. Manufacturer for servers with certain GPUs, purportedly for Company-1.  Those servers were often assembled in the United States and shipped to the U.S. Manufacturer’s facilities in Taiwan, then delivered to Company-1 elsewhere in Southeast Asia. Company-1, in consultation with the defendants, then used a shipping and logistics company to repackage the U.S. Manufacturer’s servers and place them in unmarked boxes to conceal their content prior to shipping them to their final destinations in China.  To ensure that these server allocations were approved internally at the U.S. Manufacturer, the defendants and executives at Company-1 prepared false documents and records, and transmitted false communications, purporting to show that Company-1 was the end user of the servers.

At the defendants’ direction, between 2024 and 2025, Company-1 purchased approximately $2.5 billion worth of servers from the U.S. Manufacturer, many of which were assembled in the United States.  The defendants’ scheme became more brazen over time and resulted in massive quantities of servers with controlled U.S. artificial intelligence technology being sent to China.  Between late April 2025 and mid-May 2025 alone, at least approximately $510 million worth of the U.S. Manufacturer’s servers, assembled in the United States, were diverted to China in violation of U.S. export control laws as part of the defendants’ scheme.

The defendants and their co-conspirators took extensive measures to conceal their scheme.  As just one example, to deceive the U.S. Manufacturer’s compliance team, responsible for ensuring adherence to U.S. export control laws, the defendants staged thousands of “dummy” servers—non-working, physical replicas of the U.S. Manufacturer’s servers—for inspection at the locations where Company-1 was purportedly storing the servers it had purchased from the U.S. Manufacturer. However, the actual servers purchased by Company-1 from the U.S. Manufacturer had already been unlawfully shipped to China.  Photographs of some of the dummy servers that were staged at a warehouse rented by Company-1 in connection with an August 2025 audit conducted by the U.S. Manufacturer are below:Today, an indictment was unsealed charging Yih-Shyan “Wally” Liaw, Ruei-Tsang “Steven” Chang, and Ting-Wei “Willy” Sun, for allegedly conspiring to divert high-performance computer servers assembled in the United States and integrating sophisticated U.S. artificial intelligence technology to China, in violation of U.S. export controls laws.  Liaw, a U.S. citizen, and Sun, a citizen of Taiwan, were arrested today and will be presented in the Northern District of California. Chang, a citizen of Taiwan, remains a fugitive.

“The indictment unsealed today details alleged efforts to evade U.S. export laws through false documents, staged photographs to mislead inspectors, and convoluted transshipment schemes, in order to obfuscate the true destination of restricted AI technology—China,” said John A. Eisenberg, Assistant Attorney General for National Security. “These chips are the product of American ingenuity, and NSD will continue to enforce our export-control laws to protect that advantage.”

“The FBI’s investigation revealed that Liaw, Chang, and Sun allegedly conspired to sell billions of dollars’ worth of servers integrating sensitive, controlled graphic processing units to buyers in China, in violation of U.S. export control laws,” said Assistant Director Roman Rozhavsky of the FBI’s Counterintelligence and Espionage Division.  “Controlling the export of sensitive U.S. artificial intelligence technology is essential to safeguarding our national security and defending the homeland.  That’s why combating export violations is among the FBI’s highest priorities, and we will continue working with our law enforcement, private sector, and international partners to bring to justice all who take action to undermine U.S. national security.”

“As alleged in the Indictment, the defendants participated in a systematic scheme to divert massive quantities of servers housing U.S. artificial intelligence technology to customers in China,” said U.S. Attorney Jay Clayton for the Southern District of New York. “They did so through a tangled web of lies, obfuscation, and concealment—all to drive sales and generate revenues in violation of U.S. law. Diversion schemes like those disrupted today generate billions of dollars in ill-gotten gains and pose a direct threat to U.S. national security. Our Office, along with our partners at the FBI and Department of Commerce’s Bureau of Industry and Security, will continue to doggedly investigate these illegal diversion schemes to bring to justice bad actors who aim to profit from illegally exporting U.S. artificial intelligence technology.”

“Yih-Shyan Liaw, Ruei-Tsang Chang, and Ting-Wei Sun allegedly defrauded the United States by diverting hundreds of servers with advanced artificial intelligence capabilities to Chinese customers,” said FBI Assistant Director in Charge James C. Barnacle, Jr of the New York Field Office.  “These defendants allegedly fabricated documents, staged bogus equipment to pass audit inventories, and used a pass-through company to conceal their misconduct and true clientele list.  The FBI will hold accountable individuals who use American companies to provide export-controlled technology to our adversaries.”

The entirety of the text of the indictment and the descriptions of the indictment constitute only allegations, and every fact described should be treated as an allegation. According to the allegations contained in the indictment unsealed today in Manhattan federal court:

To protect U.S. national security and foreign policy interests, the U.S. Department of Commerce has implemented license requirements for the export and reexport of artificial intelligence technologies to China and Hong Kong.  In particular, the U.S. Department of Commerce has placed restrictions on the export and reexport of items that could make a significant contribution to the military potential or nuclear proliferation of other nations or that could be detrimental to the foreign policy or national security of the United States.  For these reasons, among others, advanced artificial intelligence accelerator chips, and servers incorporating such chips, are subject to export license requirements for transfers to China and Hong Kong.  Those regulations reflect a formal determination that the computing capabilities in advanced artificial intelligence accelerator hardware are of sufficient strategic significance that their transfer to China poses an unacceptable risk to national security.

Liaw is a co-founder, board member, and Senior Vice President of Business Development of a publicly traded U.S.-based manufacturer that designs and builds high-performance computer servers for artificial intelligence and cloud computing applications (the U.S. Manufacturer), including servers that integrate artificial intelligence graphics processing units (GPUs).  Chang is a general manager in the U.S. Manufacturer’s Taiwan office.  Sun is a third-party broker and “fixer” who has worked with Liaw, Chang, and others to divert U.S.-export controlled technology to China.  Together, the defendants and others conspired to systematically divert the U.S. Manufacturer’s servers with certain GPUs to China without a license to do so from the U.S. Department of Commerce.

The scheme operated as follows. Liaw and Chang, who worked closely with third-party brokers with customers based in China, directed certain executives of a company based in Southeast Asia (“Company-1”) to place purchase orders with the U.S. Manufacturer for servers with certain GPUs, purportedly for Company-1.  Those servers were often assembled in the United States and shipped to the U.S. Manufacturer’s facilities in Taiwan, then delivered to Company-1 elsewhere in Southeast Asia. Company-1, in consultation with the defendants, then used a shipping and logistics company to repackage the U.S. Manufacturer’s servers and place them in unmarked boxes to conceal their content prior to shipping them to their final destinations in China.  To ensure that these server allocations were approved internally at the U.S. Manufacturer, the defendants and executives at Company-1 prepared false documents and records, and transmitted false communications, purporting to show that Company-1 was the end user of the servers.

At the defendants’ direction, between 2024 and 2025, Company-1 purchased approximately $2.5 billion worth of servers from the U.S. Manufacturer, many of which were assembled in the United States.  The defendants’ scheme became more brazen over time and resulted in massive quantities of servers with controlled U.S. artificial intelligence technology being sent to China.  Between late April 2025 and mid-May 2025 alone, at least approximately $510 million worth of the U.S. Manufacturer’s servers, assembled in the United States, were diverted to China in violation of U.S. export control laws as part of the defendants’ scheme.

The defendants and their co-conspirators took extensive measures to conceal their scheme.  As just one example, to deceive the U.S. Manufacturer’s compliance team, responsible for ensuring adherence to U.S. export control laws, the defendants staged thousands of “dummy” servers—non-working, physical replicas of the U.S. Manufacturer’s servers—for inspection at the locations where Company-1 was purportedly storing the servers it had purchased from the U.S. Manufacturer. However, the actual servers purchased by Company-1 from the U.S. Manufacturer had already been unlawfully shipped to China.  Photographs of some of the dummy servers that were staged at a warehouse rented by Company-1 in connection with an August 2025 audit conducted by the U.S. Manufacturer are below:

Some of those same dummy servers were also later staged at a warehouse rented by Company-1 in an attempt to pass an inspection being conducted by the U.S. Department of Commerce of Company-1’s purchases of the U.S. Manufacturer’s servers.  In advance of the inspection, SUN and one of the third-party brokers who works closely with the defendants to divert servers to China (“Broker-1”) staged dummy servers at the warehouse by, among other things, unboxing the dummy servers; using a hair dryer to remove and affix labels and serial number stickers to the server boxes and to the dummy servers themselves; and then re-packaging the dummy servers in the U.S. Manufacturer’s boxes. Surveillance cameras recorded their work and captured them preparing the dummy servers, including as shown in the images below, Sun (top) and Broker-1 (bottom):

Throughout the scheme, the defendants coordinated closely with each other, executives of Company-1, and third-party brokers with end customers in China using encrypted messaging applications.  Those communications related to, among other topics, the quantities of servers for Company-1 to order, the locations in China where those servers were to be shipped, and efforts to conceal the nature of the scheme from the U.S. Manufacturer’s compliance team, U.S. authorities, and others.  At no point did the defendants or the U.S. Manufacturer have a license from the U.S. Department of Commerce to export or reexport U.S.-manufactured servers to China.

Liaw, 71, of Fremont, California; Chang, 53, of Taiwan; and Sun, 44, of Taiwan, are each charged with one count of conspiring to violate the Export Controls Reform Act, which carries a maximum term of imprisonment of 20 years, one count of conspiring to smuggle goods from the United States, which carries a maximum term of imprisonment of 5 years, and one count of conspiring to defraud the United States, which carries a maximum term of imprisonment of 5 years.   

The maximum potential sentences in this case are prescribed by Congress and are provided here for informational purposes only, as any sentencing of the defendants will be determined by a judge.

The FBI, the Department of Commerce’s Bureau of Industry and Security, and the Department of Justice’s National Security Division, Counterintelligence and Export Control Section investigated the case.

This case is being handled by the Southern District of New York’s National Security and International Narcotics Unit and Securities and Commodities Fraud Task Force and by the National Security Division’s Counterintelligence and Export Control Section. The case is being prosecuted by Assistant United States Attorneys Juliana N. Murray, David J. Robles, and Kevin T. Sullivan for the Southern District of New York and Trial Attorneys Maria Fedor and Mark Murphy of the National Security Division’s Counterintelligence and Export Control Section.

The charges contained in the Indictment are merely accusations, and the defendants are presumed innocent unless and until proven guilty.

Honduran Illegal Indicted for Reentry of Deported Alien

Source: United States Department of Justice Criminal Division

NEW ORLEANS, LOUISIANA – United States Attorney David I. Courcelle announced that ELVIN LEONARDO OLIVA-RODRIGUEZ   (“OLIVIA-RODRIGUEZ”), age 37, a native of Honduras, was indicted on March 13, 2026, for reentry of removed alien, in violation of Title 8, United States Code, Section 1326(a).

Justice Department Disrupts Iranian Cyber Enabled Psychological Operations

Source: United States Department of Justice Criminal Division

A Court-Authorized Domain Seizure Removes Four Websites Facilitating the Islamic Republic of Iran’s Ministry of Intelligence and Security’s Hacking Efforts Tied to Psychological Operations and Transnational Repression

The Justice Department announced the seizure of four domains as part of an ongoing effort to disrupt hacking and transnational repression schemes conducted by the Islamic Republic of Iran’s Ministry of Intelligence and Security (MOIS). The affidavit supporting the seizure warrant can be found here. The seized domains – Justicehomeland[.]org, Handala-Hack[.]to, Karmabelow80[.]org, and Handala-Redwanted[.]to – were used by the MOIS in furtherance of attempted psychological operations targeting adversaries of the regime by claiming credit for hacking activity, posting sensitive data stolen during such hacks, and calling for the killing of journalists, regime dissidents, and Israeli persons. For example, the MOIS used the Handala-hack[.]to domain to claim credit for a March 2026 destructive malware attack against a U.S.-based multinational medical technologies firm.

“Terrorist propaganda online can incite real-world violence — thanks to our National Security Division and the U.S. Attorney’s Office for the District of Maryland, this network of Iranian-backed sites will no longer broadcast anti-American hate,” said Attorney General Pamela Bondi. “Our cyber assets will remain ever-vigilant to root out and deactivate networks that pose a threat to American citizens.”

“Iran thought they could hide behind fake websites and keyboard threats to terrorize Americans and silence dissidents,” said FBI Director Kash Patel. “We took down four of their operation’s pillars and we’re not done. This FBI will hunt down every actor behind these cowardly death threats and cyberattacks and will bring the full force of American law enforcement down on them.”

“Iran, the leading state sponsor of terrorism worldwide, used the seized domains to dox and harass dissidents and journalists, incite violence against Jewish communities, and spread Tehran’s anti-American propaganda,” said Assistant Attorney General for National Security John A. Eisenberg.  “NSD is committed to dismantling Iran’s cyberwarfare infrastructure and detecting and preventing Iran’s cyber-enabled terrorism.”

“Unleashing terroristic ideology into the cybersphere is a direct threat to our national security.  The U.S. Attorney’s Office is committed to collaborating with our law-enforcement partners to identify threats, shut them down, and hold bad actors accountable,” said Kelly O. Hayes, U.S. Attorney for the District of Maryland. “We will not hesitate to use all our resources and available tools to do whatever is necessary to ensure the safety and security of our nation.”

“The Iranian regime exploits cyberspace to advance authoritarian objectives, suppress democratic institutions, and undermine our national and economic security,” said FBI Baltimore Special Agent in Charge Jimmy Paul. “The FBI will act swiftly, deliberately, and proactively to disable cyber threats to America and use every available authority to ensure those responsible are identified, apprehended, and held accountable.”

The FBI’s investigation revealed that the four seized domains were linked to each other through shared leak sites, Iranian IP ranges, and a common operational “playbook.” That playbook includes: destructive and disruptive cyber-attacks; and “faketivist” psychological operations using data stolen via hacking.

The Domains handala-hack[.]to and handala-redwanted[.]to

As alleged in court documents, after the U.S.-Iran conflict began on February 28, 2026, the MOIS-controlled domains handala-hack[.]to and handala-redwanted[.]to published personally identifiable information (“PII”) associated with targeted individuals. The domain handala-hack[.]to also claimed responsibility for hacks conducted by the group. Specifically:

  • On March 11, 2026, Handala Hack, via the Handala-hack[.]to domain, claimed credit for conducting a destructive malware attack against a U.S.-based multinational medical technologies firm. The Handala Hack persona claimed the hack was retaliation for “ongoing cyber assaults against the infrastructure of the Axis of Resistance.”
  • As of March 9, 2026, Handala Hack, via the Handala-redwanted[.]to domain, posted the names and sensitive PII of approximately 190 individuals associated with or employed by the Israeli Defense Force (IDF) and/or Israeli government. The Handala Hack posting contained threats indicating the individuals were being monitored, their residences were known, and that consequences would soon follow.
  • On March 6, 2026, Handala Hack, via the Handala-hack[.]to domain, posted names and confidential data corresponding to individuals Handala Hack claimed worked for the IDF. The post stated, in part, “Your iPhone 12 Pro Max holds no security for us; we even know your exact location…,” and urged “People of the Axis of Resistance! See these names and respond to these Zionist pigs yourselves.”
  • On March 6, 2026, Handala Hack, via the Handala-hack[.]to domain, claimed it stole 851 gigabytes of confidential data from members of the Sanzer Hasidic Jewish community, including “documents of financial cooperation, witchcraft ceremonies, and secret correspondences with Netanyahu …” The post continued “We warn the leaders and members of the Sanzer Hasidic community: No place is safe for you. Betrayal of the oppressed leads to nothing but disgrace and shame. Expect more documents to be revealed. Handala Hack[.]”

These threats and the related information were not just publicly posted. The FBI’s investigation also revealed that the email account Handala_Team@outlook[.]com was used to send death threats to Iranian dissidents and journalists living in the United States and abroad. In those communications, Handala Hack offered bounties and openly called for Mexican cartel “partners” to commit acts of violence against Handala Hack’s targets. Specifically, on or about March 1, 2026, the Handala_Team@outlook[.]com account was used to email two victims, located in the United States and abroad. In an email with the subject line “Death to [redacted victim names],” the sender wrote:

“We the Handala Hack team, the loyal followers of the supreme leader Ali Hosseini Khamenei, declare war on all the enemies of Islam in the West. Our partners, the CJNG [Jalisco New Generation Cartel] cartel in America and Canada have been given a list of our enemies who are responsible for our great leaders [sic] death. [Redacted names], you laughed like hyenas during the [redacted] show. We have hacked and revealed your home addresses in [redacted] and [redacted] to our partners in the CJNG who are in [redacted U.S. state] and [redacted foreign country] now. Both of you will be executed soon, and we have offered a reward of $250,000 for the operatives who kills [sic] and beheads both of you. ALLAHU AKBAR[.]”

The domain handala-hack[.]to was also used as part of a broader effort to intimidate and harass Iranian dissidents and journalists living in the United States and abroad. According to investigators, threat actors associated with the domain directed online threats toward individuals who publicly criticized the Iranian government. In those cases, the MOIS attempts to embarrass and discredit its targets by circulating messages and content intended to damage their reputation. By leveraging online platforms linked to the domain, MOIS sought to amplify its online threats, pressure critics, and discourage independent reporting, while creating fear among members of the Iranian diaspora critical of the regime.

The Domains Justicehomeland[.]org and Karmabelow80[.]org

The domains Justicehomeland[.]org and Karmabelow80[.]org were the official websites of a shell hacktivist entity used by MOIS. On or about July 15, 2022, and September 9, 2022, MOIS actors used the Justicehomeland[.]org domain to claim responsibility for stealing sensitive documents  from Albanian government organizations. The motivation for leaking this information appears to be the Albanian government’s decision to support an Iranian dissident group called Mujahedeen e-Khalq or “MEK.” MEK has, in the past, openly advocated for the overthrow of the Iranian government.

In addition to these enforcement actions, the Department of State’s Rewards for Justice program is offering a reward of up to $10 million for information on any person who, while acting at the direction or under the control of a foreign government, engages in certain malicious cyber activities against U.S. critical infrastructure in violation of the Computer Fraud and Abuse. Read more about this reward offer on the Rewards for Justice website.

The FBI Baltimore Field Office is investigating the case, in coordination with FBI Cyber Division.

The United States Attorney’s Office for the District of Maryland and the National Security Division’s National Security Cyber Section are prosecuting the case.

Four Illegal Aliens With Prior Felony Convictions and a Combined 14 Deportations Sentenced to Prison for Illegally Reentering the United States

Source: United States Department of Justice Criminal Division

LAS VEGAS – Three Mexican nationals and one Honduran national were all sentenced this week by United States District Judge Gloria Navarro to terms of imprisonment followed by terms of supervised release for illegally reentering the United States after being removed on a combined 14 prior occasions from the United States.