MIL Security Engine-1

Source: US FBI

Jairo Jaime Tinajero, 25, pleaded guilty yesterday in the Western District of Kentucky to the following charges contained in the superseding information: racketeering conspiracy, online enticement, three counts of production of child sexual abuse material, three counts of distribution of child sexual abuse material (CSAM), five counts of interstate communications of threats, cyberstalking, and conspiracy to murder Jane Doe 1 in aid of racketeering. The terms of the plea agreement specify that both parties agree to the applicability of the terrorism sentencing enhancement (U.S.S.G. § 3A1.4 n. 4).

On Oct. 11, 2023, a grand jury in the Western District of Kentucky returned an indictment charging Tinajero with online enticement and production of child sexual abuse material. On Oct. 4, 2023, in the Eastern District of Arkansas, Tinajero was arrested on a criminal complaint that was filed in the Western District of Kentucky.

According to the court documents, Tinajero is a self-identified member of the 764 network. The 764 network’s accelerationist goals include social unrest and the downfall of the current world order, including the U.S. Government. Beginning in 2020, Tinajero started communicating with, and grooming, several minor victims to obtain sexually explicit content from them, including Jane Doe 1. In 2023, Tinajero began to threaten the safety of Jane Doe 1 and her family. Tinajero posted online in encrypted platforms associated with 764 and related groups a “Lorebook” – commonly used in 764 blackmail schemes — containing Jane Doe 1’s identifying information along with nude pictures of the minor.

Between July 2023 and September 2023, during multiple discussions over social media, Tinajero and a co-conspirator agreed that Tinajero should kill Jane Doe 1. Tinajero and the co-conspirator specifically discussed that Tinajero should murder Jane Doe 1 and dispose of Jane Doe 1’s body in a barrel of acid after the murder. Tinajero posted multiple messages on various social media websites stating that he planned to kill Jane Doe 1 with a firearm because Jane Doe 1 refused to provide additional child sexual abuse material.

On Aug. 26, 2023, Tinajero posted on Telegram, “Im determined to die” and “If I gotta kill her I can’t let her live and f**k with dudes and girls while I’m sick and miserable” and “Im gonna live stream it.” Tinajero also posted a picture of Jane Doe 1. On Sept. 2, 2023, Tinajero posted on Telegram, “I wanna kill them so bad just show up at their cribs and shoot 100 rounds in 5 seconds” and, on Sept. 3, 2023, posted “I didn’t wanna do anything bc I was scared of dying or prison but now I’m determined to die if I have to after getting rid of [Jane Doe 1] . . . .” Tinajero also began soliciting others to assist with attempting to kill Jane Doe 1.

The FBI is investigating the case.

Assistant U.S. Attorney Erwin Roberts for the Western District of Kentucky and Trial Attorneys Justin Sher and James Donnelly of the National Security Division’s Counterterrorism Section are prosecuting the case. The Violent Crime and Racketeering Section for the Criminal Division and the Eastern District of Arkansas provided assistance.

Source: US FBI

Orlando, Florida – United States District Judge Carlos E. Mendoza has sentenced Alan W. Filion (18, Lancaster, CA) to four years in federal prison for making interstate threats to injure the person of another.

According to the plea agreement, from approximately August 2022 to January 2024, Filion made over 375 swatting and threat calls, including calls in which he claimed to have planted bombs in the targeted locations or threatened to detonate bombs and/or conduct mass shootings at those locations. Filion targeted religious institutions, high schools, colleges and universities, government officials, and numerous individuals across the United States.

Filion intended his calls to cause large-scale deployment of police and emergency services units to the targeted locations. During these calls, he provided information to law enforcement and emergency services agencies that he knew to be false, such as false names, false claims that he and others had placed explosives in particular locations, false claims that he and others possessed dangerous weapons, including firearms and explosives, and false claims that he and/or other individuals had committed, or intended to imminently commit, violent crimes. 

In some instances, armed law enforcement officers approached and entered a targeted residence with their weapons drawn and detained individuals that occupied the residence. Filion claimed in a post on January 20, 2023, that when he swats someone he “usually get[s] the cops to drag the victim and their families out of the house cuff them and search the house for dead bodies.” Additionally, Filion’s calls caused law enforcement officers and dispatchers to respond, and to be unavailable in response to other emergencies.

Filion became a serial swatter for both profit and recreation. He claimed in a January 19, 2023, online post that his “first” swatting was like “2 to 3 years ago” and that “6-9 months ago [he] decided to turn it into a business. . . .” On several occasions, Filion placed posts on social-media channels advertising his services and swatting-for-a-fee structure.

On January 18, 2024, Filion was arrested in California on Florida state charges arising from a May 2023 threat he made to a religious institution in Sanford, Florida. In that threat, he claimed to have an illegally modified AR-15, a Glock 17 pistol, pipe bombs, and Molotov cocktails. He said that he was going to imminently “commit a mass shooting” and “kill everyone” he saw. He pleaded guilty in federal court to making that threat.

Filion also pleaded guilty to making three other threatening calls: an October 2022 call to a public high school in the Western District of Washington, in which he threatened to commit a mass shooting and claimed to have planted bombs throughout the school; a May 2023 call to a Historically Black College & University in the Northern District of Florida, in which he claimed to have placed bombs in the walls and ceilings of campus housing that would detonate in about an hour; and a July 2023 call to a local police department dispatch number in the Western District of Texas, in which he falsely identified himself as a senior federal law enforcement officer, provided the federal law-enforcement officer’s residential address to the dispatcher, claimed to have killed his (the federal officer’s) mother, and threatened to kill any responding police officers.  

This case was investigated by the Federal Bureau of Investigation and the United States Secret Service. Valuable assistance was provided by the Seminole County (Florida) Sheriff’s Office; the Anacortes (Washington) Police Department; the Florida Department of Law Enforcement; the California Department of Justice; the Los Angeles County (California) Sheriff’s Office; and the Volusia County (Florida) Sheriff’s Office. The case is being prosecuted by Assistant United States Attorney Kara Wick, with valuable assistance from the State Attorney’s Office for Seminole County, Florida, 18^th Judicial Circuit; the Counterterrorism Section of the United States Department of Justice; and the United States Attorneys’ Offices for the Western District of Washington, the Northern District of Florida, the Western District of Texas, and the District of Columbia. 

Source: US FBI

Note: View the superseding indictment here.

Phobos Ransomware Group Alleged to have Attacked Over 1,000 Victims Worldwide

The Justice Department today unsealed criminal charges against Roman Berezhnoy, 33, and Egor Nikolaevich Glebov, 39, both Russian nationals, who allegedly operated a cybercrime group using the Phobos ransomware that victimized more than 1,000 public and private entities in the United States and around the world and received over $16 million in ransom payments. Berezhnoy and Glebov were arrested this week as part of a coordinated international disruption of their organization, which includes additional arrests and the technical disruption of the group’s computer infrastructure.

From May 2019, through at least October 2024, Berezhnoy, Glebov, and others allegedly caused victims to suffer losses resulting from the loss of access to their data in addition to the financial losses associated with the ransomware payments. The victims included a children’s hospital, health care providers, and educational institutions.

8Base Seizure Banner

According to court documents, Berezhnoy, Glebov, and others operated a ransomware affiliate organization, including under the names “8Base” and “Affiliate 2803,” among others, that victimized public and private entities through the deployment of Phobos ransomware.

As part of the scheme, Berezhnoy, Glebov, and others allegedly hacked into victim computer networks, copied and stole files and programs on the victims’ network, and encrypted the original versions of the stolen data with Phobos ransomware. The conspirators then allegedly extorted the victims for ransom payments in exchange for the decryption keys to regain access to the encrypted data by, among other things, leaving a ransom note on compromised victim computers and separately reaching out to victims to initiate ransom payment negotiations.

As alleged, the conspirators also threatened to expose victims’ stolen files to the public or to the victims’ clients, customers, or constituents if the ransoms were not paid. The conspirators are further alleged to have established and operated a darknet website where they repeated their extortionate threats and ultimately published the stolen data if a victim failed to pay the ransom.

After a successful Phobos ransomware attack, criminal affiliates paid fees to Phobos administrators for a decryption key to regain access to the encrypted files. Each deployment of Phobos ransomware was assigned a unique alphanumeric string in order to match it to the corresponding decryption key, and each affiliate was directed to pay the decryption key fee to a cryptocurrency wallet unique to that affiliate.

The charges unsealed today against Berezhnoy and Glebov follow the recent arrest and extradition of Evgenii Ptitsyn, a Russian national, on charges relating to his alleged administration of the Phobos ransomware variant.

In parallel with this week’s arrests, Europol and German authorities have announced an international operation involving the FBI and other international law enforcement partners to disrupt over 100 servers associated with this criminal network.

Berezhnoy and Glebov are charged in an 11-count indictment with one count of wire fraud conspiracy, one count of wire fraud, one count of conspiracy to commit computer fraud and abuse, three counts of causing intentional damage to protected computers, three counts of extortion in relation to damage to a protected computer, one count of transmitting a threat to impair the confidentiality of stolen data, and one count of unauthorized access and obtaining information from a protected computer. If convicted, Berezhnoy and Glebov face a maximum penalty of 20 years in prison on each wire fraud-related count; 10 years in prison on each computer damage count; and five years in prison on each of the other counts. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

Supervisory Official Antoinette T. Bacon of the Justice Department’s Criminal Division, U.S. Attorney Erek L. Barron for the District of Maryland, Assistant Director Bryan Vorndran of the FBI’s Cyber Division, and Special Agent in Charge William J. DelBagno of the FBI Baltimore Field Office made the announcement.

The FBI Baltimore Field Office is investigating the case. The Justice Department extends its thanks to international judicial and law enforcement partners in the United Kingdom, Germany, Japan, Spain, Belgium, Poland, Czech Republic, France, Thailand, Finland, Switzerland, and Romania, as well as Europol and the U.S. Department of Defense Cyber Crime Center, for their cooperation and coordination with the Phobos ransomware investigation. The National Security Division’s National Security Cyber Section and the Justice Department’s Office of International Affairs also provided valuable assistance.

Senior Counsel Aarash A. Haghighat of the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorney Thomas M. Sullivan for the District of Maryland are prosecuting the case. Former CCIPS Trial Attorney Riane Harper and former Assistant U.S. Attorneys Aaron S.J. Zelinsky and Jeffrey J. Izant for the District of Maryland provided substantial assistance.

Additional details on protecting networks against Phobos ransomware are available at StopRansomware.gov, including Cybersecurity and Infrastructure Security Agency Advisory AA24-060A.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Source: US FBI

Through the coordinated efforts of the FBI Cincinnati, Newark and New York field offices, the FBI arrested Dimitriy “Russo” Nezhinskiy, owner and manager of Big Apple General Buyers, and Juan Villar, an employee, in Manhattan’s Diamond District. They are accused in the Eastern District of New York of running the largest east coast “fence”, which is a hub to resell stolen goods. Additionally, a federal grand jury in Cincinnati indicted three defendants believed to be operating as part of the organized group and charged them with transporting stolen goods interstate and falsifying records in a federal investigation. The three men allegedly committed a burglary at the home of an NFL player last year.

In addition to high-end residential burglaries, SATGs are known to target traveling jewelry salesmen as they transport their inventory from location to location. They usually use facilitators, known as “fences,” to liquidate stolen merchandise. A fence is an individual or business who knowingly purchases stolen property and then resells it to others. In some scenarios, they send the stolen goods to Chile or Colombia. This week, a Chilean man, believed to be part of the South American Theft Group, was also charged for his involvement in a conspiracy to break into a jewelry store in New Jersey and then cross state lines with the stolen property.

Crimes committed by South American Theft Groups can victimize anyone, not just professional athletes. The FBI has an initiative targeting SATGs, which involves individuals from Chile and other South American countries exploiting illegal entry or tourist visas to travel in and out of the U.S. to facilitate theft and transportation of stolen goods internationally. This initiative dedicates resources through various active investigations and major theft task forces, which include our state and local partners, throughout the country and shares intelligence with law enforcement partners around the world.

You can visit tips.fbi.gov to report suspected South American Theft Group activity to the Bureau. Tips may be submitted anonymously.

Source: US FBI

The Federal Bureau of Investigation has named Mehtab Syed as the special agent in charge of the Salt Lake City Field Office. Ms. Syed most recently served as special agent in charge of Cyber and Counterintelligence Division in the Los Angeles Field Office.

Ms. Syed entered on duty as an FBI special agent in August 2005. She was assigned to the New York Field Office, where she worked counterterrorism investigations and was a member of the crisis negotiation team and the rapid deployment team. 

In 2008, Ms. Syed deployed to Islamabad, Pakistan, and served as acting assistant legal attaché. She was responsible for conducting extensive coordination between law enforcement, intelligence, and security services of multiple governments. She then returned to the New York Field Office until 2012.

Ms. Syed was assigned to an 18-month temporary duty assignment (TDY) at the Counterterrorism Division at FBI Headquarters in 2012. She worked as the program manager for extraterritorial counterterrorism cases in the Pakistan/Afghanistan region. 

In April 2015, Ms. Syed reported to LEGAT Amman as the assistant legal attaché. Ms. Syed returned to the New York Field Office as a supervisor for the New York Joint Terrorism Task Force (NY JTTF) in 2017. Ms. Syed was promoted to acting assistant special agent in charge of the NY JTTF’s Extraterritorial Branch in 2020.

In November 2020, Ms. Syed was selected as the assistant special agent in charge of the cyber and counterintelligence branch of the Newark Field Office. In 2022, Ms. Syed was promoted to section chief of China Operations II Branch of the Counterintelligence Division at FBI Headquarters. In April of 2023, Ms. Syed served as special agent in charge of Cyber and Counterintelligence Division in the Los Angeles Field Office

Prior to her career as a special agent for the FBI, Ms. Syed served at the Bureau as a contract linguist from 2004-2005. She has also worked as a financial analyst at the corporate office of Cosi, a restaurant chain with locations throughout the U.S. Ms. Syed received a bachelor’s degree in finance from Adelphi University in 2001.