Posts

Posted on

Coordinated Global Operation Disrupted BEC Schemes

Source: US FBI

Operation Eagle Sweep, which was funded and coordinated by the FBI, serves as a model for international cooperation against specific threats that endanger the financial well-being of each member country’s residents.

The cases were investigated by the FBI and U.S. Postal Inspection Service. U.S. Attorney’s Offices in the Districts of Central California, Northern New York, Puerto Rico, Southern Texas, and the Justice Department’s Consumer Protection Branch have investigations ongoing, some of which have resulted in arrests in Nigeria. The Justice Department’s Consumer Protection Branch, Computer Crime and Intellectual Property Section, Money Laundering and Asset Recovery Section, and Office of International Affairs of the Criminal Division provided assistance. The Harris County District Attorney’s Office is handling state prosecutions.

Additionally, the Nigerian Economic and Financial Crimes Commission, South African Police Service, Toronto Police Service, Cambodian National Police, Australian Federal Police, New South Wales Police Force, Victoria Police, Tasmania Police, Queensland Police, Northern Territory Police, South Australia Police, Western Australia Police, the Australian Criminal Intelligence Commission, Australian Cyber Security Centre, Australian Transaction Reports and Analysis Centre, National Police Agency of Japan, the National Cyber-Forensics and Training Alliance, and the Microsoft Corporation’s Digital Crimes Unit provided valuable assistance.

Note: An indictment and criminal complaint are merely allegations, and the defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Posted on

Russian Government Employees Charged in Hacking Campaigns

Source: US FBI

The Department of Justice unsealed indictments against three Russians alleged to be responsible for a long-running and persistent campaign to target and infiltrate the networks of critical infrastructure in the United States and worldwide.

The charges allege Pavel Aleksandrovich Akulov, Mikhail Mikhailovich Gavrilov, and Marat Valeryevich Tyukov were part of a Russian intelligence operational unit that security experts dubbed “Dragonfly,” “Berserk Bear,” “Energetic Bear,” and “Crouching Yeti.” The unit is part of an entity called Center 16 in the Russian Federal Security Service (FSB)—a successor agency to the Soviet KGB.

The alleged operation occurred in two phases. The first involved deploying a custom malware implant known to cybersecurity experts as Havex, which infected a significant number of organizations in the global energy sector. The second phase included targeted compromises of energy sector entities and individuals and engineers who worked with industrial control systems (ICS) and supervisory control and data acquisition (SCADA) systems. Collectively, these intrusions could have had a devastating impact on energy delivery worldwide.

The first phase stretched between at least 2012 and 2014 and resulted in Havex being downloaded onto more than 17,000 unique devices in the United States and other nations. An FBI intelligence analyst who worked on the case said the group had used a combination of techniques to deploy Havex, including sweeping efforts to cast a wide net across the global energy sector, but also well-researched and targeted techniques to reach specific companies and individuals.

Among the more alarming techniques used with Havex was the conspiracy’s compromise of a company that manufactures equipment and software used by ICS/SCADA systems. These are the control and safety mechanisms that exist within energy production facilities and other operational environments. For safety reasons, these are typically closed systems. But because the group had gained access into the systems of a company that provides a component of these systems, they were able to hide their malware within software updates offered by the company—a technique known as a supply chain attack.

Regardless of how the Havex malware was deployed, the analyst said it could be tailored for a variety of uses, including gathering credentials and scanning for human-machine interfaces. “That means the ways a human may interface with the system to tell it what to do,” he said. “If that interface is connected to a network, you have the potential for a remote actor to send instructions to a critical network.” In 2014, the group ceased using Havex after it was publicly exposed, and they began evolving the operation.

The second phase involved targeted intrusions of energy sector companies, including an intrusion in 2017 of the business network of a nuclear power plant in Kansas. This business network was not directly connected to any ICS/SCADA devices. An FBI special agent who investigated the case said they found no evidence that the hackers took any sensitive data of intelligence value, and it appeared the goal was simply to gain and maintain access. “Meaning that, at a later date, they could have used this access to affect or damage the energy grid or other critical operations within the United States,” the agent explained.

The Kansas intrusion in 2017 was part of a multipronged attack. “When we peeled away at the onion, we found this was a much larger campaign targeting the global energy sector to the tune of about 500 companies worldwide,” said the agent. “We believe they targeted nearly 3,300 people through a months-long spearphishing campaign.” As part of this phase, the group is also accused of breaching the network of a U.S. construction company. Access to that network allowed the group to send legitimate looking emails with the resume of an individual claiming to have industry-specific skills. The resume contained malicious code that victims could inadvertently download when they reviewed the document.

The group had also compromised multiple websites, including those of industry publications read by engineers in the energy sector. Those sites became what cybersecurity experts call watering holes, where the site itself is seeded with malicious code that visitors can inadvertently download.

Investigators came to understand the group’s efforts in 2017 were a continuation of activity stretching back to their use of Havex years before, demonstrating Russia’s concerted efforts over many years to gain access to U.S. critical infrastructure. This group is still in operation, and it continues to evolve.

The analyst said some of the most disturbing elements in this case were signs that, as the group’s efforts evolved, they sought ways to re-access these systems without leaving detectable evidence. “Essentially, they wanted to steal the keys to the door, so they no longer needed to stick something in the doorjamb or leave something else behind,” he said. “It’s a stealthier way to maintain long-term access and a clear indication that the intent was to have that access available if they needed it in the future.”

All of this highlights why law enforcement action is so important. By naming these individuals, we limit their ability to travel outside of Russia, limit their future usefulness to their intelligence service employer, and limit future employment options with law-abiding private sector entities. All of this may also cause other Russian citizens with cyber skills to choose a more respectable employment path that does not limit their future opportunities. It also puts more attention and pressure in the international community on nation-states and the cybercriminals they sponsor, since exposing Russia’s activity against the energy sectors and critical infrastructure of countries worldwide shows Russia’s willingness and intent to engage in disruptive, destabilizing, and often counter-normative activity, even in peacetime.

This case is also a reminder that cybersecurity must be a priority for every organization—even those who don’t work with sensitive materials or on critical infrastructure. “In this case and so many others, victim companies that provide an easier entry point can provide criminals a way into higher-level, more critical targets,” the agent said. “Cybersecurity is quite simply at the heart of our national security.”

The Department of Justice also indicted an employee of a research entity within the Russian Ministry of Defense on charges that he infiltrated and compromised critical safety equipment within an energy facility in an identified foreign country and, as part of the same conspiracy, attempted to do the same to the equipment of similar facilities in the United States.

Evgeny Gladkikh is accused of using the Triton malware to gain control of the systems used to ensure the safe operation of a foreign natural gas refinery. The conspirators designed the malware to, among other things, disable safety controls on physical equipment without alerting employees monitoring that equipment. The malware caused the safety system to briefly shut down on two occasions and had the potential to cause an explosion or the release of a toxic gas by affecting the plant’s sulphur recovery efforts and burner management mechanisms.

Gladkikh’s later, similar intrusion attempts targeting a U.S. company that operated similar plants in the United States were unsuccessful.

An FBI Cyber Division special agent who worked on the case said the FBI has several important goals related to this announcement. The first is to help the American public better understand the ongoing threat from cyber actors supported by Russia. Disabling the safety controls at a power plant could not only shut off power—it could also cause physical damage to the plant, the release of toxic chemicals, or physical injury or death.

The Russian Ministry of Defense entity behind Triton has a more than century-long history of developing cutting-edge weapons, both cyber and physical. “We’ve seen ransomware attacks and other malware that can shut down a facility,” the agent said. “The potential impact here is more dangerous. This could actually allow an actor to trick a plant’s operators into thinking that the plant is functioning normally, while the actor leverages access to a plant’s system for destructive effect, with consequences for human life and safety at both the plant and the areas it serves.”

The second key goal is to raise greater awareness in the energy sector of the risks of cyberattacks. “We are seeing malware being developed specifically for this industry,” the agent said. The Triton malware was created to target the industrial control systems in these plants, which are specifically designed to support their safe operation. “The industry needs to take the risks seriously.”

“Downtime is a really worrying thing for these facilities,” the agent explained. It is a common reason companies resist addressing a growing cyber threat. The time and resources required is not an easy thing for any business or organization to absorb—and for an energy company or critical service provider, it’s even harder.

The final goal is to continue to impose consequences on cyber criminals and the nation-states that support this activity. “Our intention is to discourage the actors who have conducted or are considering similar cyberattacks,” the agent said. “If they ever wanted to participate in the international community—through work, travel, or otherwise—those opportunities will disappear.”

Posted on

FBI Continues Outreach and Recruiting at HBCUs

Source: US FBI

Panel participants discuss the FBI’s Civil Rights Cold Case Initiative at the Beacon regional event.

The Beacon Project embodies an understanding that recruiting efforts alone can’t address that gap; greater trust and creating strong and consistent connections are essential elements of drawing a more diverse pool of applicants into the FBI. And greater diversity isn’t a goal in and of itself, but something that is key to the FBI’s current and continued success. “The FBI’s intentional efforts to diversify are crucial to creating an inclusive workforce and to being increasingly effective and efficient in our investigations and keeping the American public safe,” said FBI Chief Diversity Officer Scott McMillion.

There have been some encouraging signs in recent years as special agent applicants have grown increasingly diverse. The Jackson Field Office event brings a more local focus to that work. By bringing together the heads of FBI field offices in Birmingham, Cincinnati, Dallas, Houston, Jackson, Little Rock, Memphis, Mobile, and New Orleans with executives from colleges and universities in those same regions, relationship-building and engagement can continue in shared cities, towns, and neighborhoods.

The FBI’s Office of Diversity and Inclusion plans to work closely with the Office of Public Affairs’ Community Relations Unit to plan other regionally focused Beacon events. This summer, the FBI will be hosting additional HBCU presidents as well as the leaders of other minority-serving institutions in Washington, D.C., to continue building these relationships.

Posted on

CEO’s Theft Leads to Closure of Credit Union

Source: US FBI

After the audit, the credit union reached out to the FBI. Through bank records, agents quickly pieced together what Shaw had done.

Luckily for the credit union members, insurance reimbursed them, so they didn’t lose their own money. But the loss to the small Beaver, Pennsylvania, credit union, founded in 1964, was so large, it had to permanently close.

“This credit union no longer exists because of her actions,” said Special Agent Samantha Bell, who investigated the case out of the FBI’s Pittsburgh Field Office.

Through financial records, investigators learned Shaw used the credit cards to go on trips, eat out at restaurants, buy clothes, and start a pig farm.

“She bought some land and spent a lot of money into outfitting that land for her use,” said Bell. “She bought ATVs, four-wheelers, four sheds, pigs. At one point, she had a horse and some really big rabbits. A lot of money went into funding that effort.”

Posted on

FBI Miami Marks One-Year Anniversary of Agents’ Deaths

Source: US FBI

They find solace in hard work—the office is as busy as ever—and leaning on each other. Special Agent Heather McPherson, who served with Alfin and Schwartzenberger on the dive team, said immediately after their deaths, she only found comfort in spending time with others on the dive team, who knew them as well as she did.

“Our first dive job after the event happened, the lack of their presence was definitely known. But everybody being together and continuing on together really helps the healing process,” she said.

As for Alfin and Schwartzenberger’s teammates on their violent crimes against children squad, they are also leaning on each other and into the work.

“We lost coworkers, we lost friends, but what the families lost is irreplaceable,” said Supervisory Special Agent Christina Bedford. “We try to remember them, with the ceremonies that we did this week, to show the families that we’ll never forget. There’s just nothing we can say or do to bring them back. We can only hope to carry on their legacy moving forward.”

Posted on

Community Outreach Seeks to Improve Hate Crime Reporting

Source: US FBI

Months later, the statistics collected by the FBI would show the reports coming into Stop AAPI Hate were no anomaly. The 2020 hate crime statistics showed 8,052 single-bias incidents involving 11,126 victims. These numbers are the highest since 2008 and showed an increase in crimes targeting Black, Asian, and Jewish individuals.

It is also highly likely that these numbers represent an incomplete count, in part because law enforcement agencies are encouraged to report these numbers but are not required to do so, and also because so many victims never come forward.

Among Jeung’s recommendations for addressing the reporting gap were to show how reporting makes a difference, recruit more FBI agents and personnel from diverse backgrounds, and use Asian-language media to encourage reporting. The professor was also able to explain the roots of racism against Asians and offer other suggestions for improving relationships.

“Many communities don’t always feel comfortable coming forward to law enforcement. That’s a big problem for us,” said Biebesheimer. “As investigators, we can’t do anything about the crimes we don’t know about. We have to get better.”

That commitment is echoed by FBI Supervisory Special Agent Daudshah Andish, the program coordinator for the Civil Rights Division in San Francisco. It’s why his squad assigned agents to be dedicated hate crime coordinators—and why he sees their work as an essential part of the FBI’s mission to defend civil rights.

“Hate crimes are not only an attack on the victim, but they also threaten and intimidate the entire community,” Andish said. “Everybody should be able to get out of their houses, enjoy the public spaces, and go about their business without any fear of violence or retribution.”

Posted on

FBI Director Travels to Africa to Meet with Vital Law Enforcement and Intelligence Partners

Source: US FBI

He also attended the first commander’s meeting of the Joint Terrorism Task Force in Kenya (JTTF-K), which included the heads of each participating agency. Kenya plays a leading role in regional counterterrorism cooperation, and is a critical partner in countering violent extremism and deterring terrorist attacks. The JTTF-K was established in 2020 following the DusitD2 attack in Nairobi to address serious and significant terrorism investigations. This multi-agency task force is modeled after the FBI-led JTTF and is the first of its kind established outside of the U.S.

“I know of no more effective way than a JTTF to bring all of a government’s resources to bear in a rule of law-based framework,” Director Wray said of the JTTF-K. “Collaboration, both within a country’s national security apparatus and among like-minded countries, is the only way to successfully fight the scourge of terrorism while protecting human rights. As we learned in the U.S. in the aftermath of September 11, no single agency has all the tools, knowledge, or resources to fight this battle alone.”

Nigeria

During his visit to Abuja, Nigeria, Director Wray met with Nigerian President Bola Ahmed Tinubu, National Security Advisor Nuhu Ribadu, and other senior law enforcement and security officials to discuss the FBI’s partnership with Nigeria to combat terrorism, violent crime, and cybercrime.

Director Wray expressed appreciation to Nigerian President Tinubu and the Office of the National Security Adviser (ONSA) for Nigeria’s commitment to collaborating with the FBI to confront transnational criminal and terrorist threats. He discussed the FBI’s work with the Nigerian National Counter Terrorism Center (NCTC) and ONSA to support counterterrorism investigations, an initiative closely aligned with both nations’ security priorities.

Director Wray also met with the chairman of the Economic and Financial Crimes Commission (EFCC) and commended the EFCC’s close cooperation with the FBI to combat cyber-enabled crimes and sextortion schemes emanating from Nigeria. He discussed opportunities for the FBI to provide additional training and resources to expand the EFCC’s capacity to investigate cyber threats.

Additionally, Director Wray addressed the concerning issue of kidnappings for ransom in Nigeria. He noted that the FBI’s International Violent Crimes Unit is engaging with Nigerian law enforcement to provide investigative assistance and training to help combat this threat.

Throughout his engagements in Africa, Director Wray underscored the robust relationship between the FBI and our law enforcement partners in Kenya and Nigeria. He thanked the U.S. Mission in both countries for their close collaboration with the FBI’s legal attaché offices to advance shared security objectives.

The FBI collaborates with international law enforcement through a network of legal attaché offices worldwide, including in Nairobi, Kenya, and Abuja, Nigeria. Joint investigations, information sharing, and capacity-building with global partners are key to the FBI’s mission to protect the American people and uphold the rule of law.

Resources:

Posted on

FBI Director Wray Travels to Nigeria, Meets with President Tinubu and Senior Officials

Source: US FBI

FBI Director Christopher Wray traveled to Abuja, Nigeria, this week and met with Nigerian President Bola Ahmed Tinubu, National Security Advisor Nuhu Ribadu, and senior law enforcement and security officials to discuss the FBI’s partnership with Nigeria to combat terrorism, violent crime, and cybercrime.

During his June 12-14 visit, Director Wray expressed appreciation to Nigerian President Tinubu and the Office of the National Security Adviser (ONSA) for Nigeria’s commitment to collaborating with the FBI to confront transnational criminal and terrorist threats. He discussed the FBI’s work with the Nigerian National Counter Terrorism Center (NCTC) and ONSA to support counterterrorism investigations, an initiative closely aligned with both nations’ security priorities.

Director Wray also met with the chairman of the Economic and Financial Crimes Commission (EFCC) and commended the EFCC’s close cooperation with the FBI to combat cyber-enabled crimes and sextortion schemes emanating from Nigeria. He discussed opportunities for the FBI to provide additional training and resources to expand the EFCC’s capacity to investigate cyber threats.

Additionally, Director Wray addressed the concerning issue of kidnappings for ransom in Nigeria. He noted that the FBI’s International Violent Crimes Unit is engaging with Nigerian law enforcement to provide investigative assistance and training to help combat this threat.

Throughout his engagements, Director Wray underscored the robust relationship between the FBI and Nigerian law enforcement. He thanked the U.S. Mission in Nigeria for its close collaboration with the FBI’s legal attaché office in Abuja to advance shared security objectives.

The FBI collaborates with international law enforcement through a network of legal attaché offices worldwide, including in Lagos, Nigeria. Joint investigations, information sharing, and capacity-building with global partners like Nigeria are key to the FBI’s mission to protect the American people and uphold the rule of law.

Resources:

Posted on

Jury Convicts Kentucky Man of Multiple Terrorism Charges

Source: US FBI

A federal jury in Bowling Green, Kentucky, convicted a Kentucky man yesterday of providing material support to the Islamic State of Iraq and al-Sham (ISIS), conspiring to provide material support to ISIS and receiving military-type training from ISIS. ISIS is a designated foreign terrorist organization.

According to court documents and evidence presented at trial, on June 3, 2014, Mirsad Hariz Adem Ramic, 34, and two co-conspirators coordinated their departure from the United States, arriving separately in Istanbul, Turkey. They abandoned the rest of their purchased travel itineraries, and purchased tickets to fly to Gaziantep, Turkey. Gaziantep is located near the Turkey-Syrian border, and from there, Ramic and the two co-conspirators crossed into Syria and joined ISIS.

The evidence at trial established that after joining ISIS, Ramic attended an ISIS training camp, where he received military-type training. A photograph of Ramic, posted on social media, depicted him, among other things, wearing camouflage clothing and standing in front of a truck outfitted with an anti-aircraft gun and the ISIS flag.

After joining ISIS, Ramic and his co-conspirators remained in contact with each other and discussed, among other things, his use of an anti-aircraft weapon to shoot at planes. Ramic and his co-conspirators also discussed jihad, martyrdom and fighting for ISIS. Ramic, a dual U.S.-Bosnian citizen, joined an ISIS fighting unit comprised primarily of Bosnian foreign fighters, and participated in an ISIS offensive in Kobane, Syria.

Ramic has been in federal custody since December 2021, after being deported to the United States from Turkey.

Ramic is scheduled to be sentenced on Sept. 5 and faces a maximum penalty of 50 years in prison, a fine of $750,000 and a term of supervised release up to life. A federal district judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

Assistant Attorney General Matthew G. Olsen of the Justice Department’s National Security Division, U.S. Attorney Michael A. Bennett for the Western District of Kentucky and Executive Assistant Director Larissa L. Knapp of the FBI’s National Security Branch made the announcement.  

The FBI is investigating the case.

Trial Attorneys Kevin C. Nunnally and Jessica Fender of the National Security Division’s Counterterrorism Section and Assistant U.S. Attorneys Joshua Judd and Christopher Tieke for the Western District of Kentucky are prosecuting the case.

Posted on

Texas Men Sentenced for Conspiracy to Sell Sanctioned Iranian Petroleum to China

Source: US FBI

Two Texas men, both of whom were convicted at trial, were sentenced today to 45 months in prison for attempting to violate the International Emergency Economic Powers Act (IEEPA), conspiracy to violate IEEPA and conspiracy to commit money laundering based on their attempt to transact in sanctioned petroleum and launder the proceeds. 

According to court documents, Zhenyu “Bill” Wang, 43, a Chinese citizen, and Daniel Ray Lane, 42, of McKinney, Texas, schemed with co-conspirators to evade U.S. economic sanctions against the Islamic Republic of Iran (Iran) from July 2019 to February 2020 by facilitating the purchase of sanctioned oil from Iran, masking its origins and selling the oil under masked origins to buyers in the People’s Republic of China. To accomplish their goal, the conspirators communicated among themselves and with third parties concerning, among other things, concealing the origin of the oil and the overall illegal transaction, financing the transaction, preparing contracts and other documents needed to effect the sale, shipping the sanctioned Iranian oil, obtaining Antiguan passports to facilitate the transaction and to establish offshore bank accounts to receive funds, distributing proceeds from the intended sale of the sanctioned Iranian oil and concealing and disguising the nature, location, source, ownership and control of the proceeds of the intended transaction. 

“Today, Mr. Lane and Mr. Wang are held accountable for attempting to broker illicit oil sales between Iran and China, and launder the proceeds, in violation of U.S. sanctions,” said Assistant Attorney General Matthew G. Olsen of the Justice Department’s National Security Division. “The court’s sentence makes clear that those who place personal profit over national security will face serious consequences.” 

“It’s one thing to be entrepreneurial and take risks, but when your business plan hinges on evading U.S. sanctions, you’re doing it wrong,” said U.S. Attoreny Jacqueline C. Romero for the Eastern District of Pennsylvania. “Wang, Lane and their co-conspirators’ scheme to make millions also would have enriched Iran, one of our government’s foreign adversaries, in direct contravention of measures meant to protect American interests and national security. Holding accountable those who violate our sanctions laws and export controls is a priority for my office and our partners at the FBI.” 

“The FBI will use all our lawful authorities to stop those who seek to evade sanctions on Iranian oil,” said Executive Assistant Director Larissa L. Knapp of the FBI’s National Security Branch. “Today’s sentencing of Zhenyu Wang and Daniel Ray Lane reflects our commitment to combatting these illegal actions and serves as a warning to others that violating U.S. sanctions impacts our national security and will not be tolerated.” 

Wang played a critical role in this conspiracy, providing the connection to the Chinese buyers who would purchase the Iranian oil. As part of his efforts, Wang communicated with multiple parties in China, secured a written offer from a Chinese buyer and brokered a contract of sale with this buyer. He also arranged for bribe payments to be made to Chinese officials to facilitate the illegal transaction. Lane agreed to help launder the Iranians’ proceeds from the transaction. He offered to use the mineral rights that he sold through his business, Stack Royalties, to conceal the Iranians’ profits, and even purchased a cash machine to count the millions of dollars of laundered proceeds quickly. Wang and Lane worked with three other conspirators who acted as intermediaries seeking buyers for the sanctioned oil.  

The conspirators believed that they would profit handsomely from the scheme to evade U.S. sanctions through significant shipments of sanctioned Iranian oil. They planned to start their scheme with a 500,000-barrel shipment of Iranian oil, but intended to increase the shipments to one or two million barrels per month for a year or more. Lane and another co-conspirator understood that the scheme was to be funded by an initial $5 million payment, which would include $4 million provided in cash. And the conspirators believed that they would make significant profits, with Wang stating that he planned to make $1.5 million in profit for each 500,000-barrel shipment.  

Wang and Lane acted fully aware that the scheme to sell sanctioned Iranian crude oil was in violation of U.S. sanctions against Iran. In fact, both defendants made statements explicitly acknowledging that their conduct was illegal. Wang, for example, acknowledged the profits he stood to make by engaging in illegal transactions, stating that “I love sanction to be honest with you and the sanctions make everybody money.” Similarly, Lane discussed concealing and disguising the proceeds of the transactions in sanctioned Iranian oil, noting that “sanctions can always be massaged . . . you know, there is always a way around it.”  

In January 2024, Wang and Lane’s co-conspirator, Nicholas Hovan, was sentenced to 12 months and a day in prison, and co-conspirators Nicholas Fuchs and Robert Thwaites were each sentenced to 10 months in prison.

The FBI investigated the case. 

Assistant U.S. Attorneys Patrick J. Murray and Mary E. Crawley for the Eastern District of Pennsylvania prosecuted the case, with valuable assistance provided by Trial Attorney Beau Barnes of the National Security Division’s Counterintelligence and Export Control Section.