“LockerGoga,” “MegaCortex,” and “Nefilim” Ransomware Administrator Charged with Ransomware Attacks

Source: United States Department of Justice Criminal Division

Defendant Used Ransomware to Attack Hundreds of Victims Worldwide; Proactive Law Enforcement Action Led to Prevention and Decryption

Earlier today, the U.S. District Court for the Eastern District of New York unsealed a superseding indictment charging Volodymyr Viktorovich Tymoshchuk — also known as deadforz, Boba, msfv, and farnetwork — a Ukrainian national, with serving as an administrator in the LockerGoga, MegaCortex, and Nefilim ransomware schemes.

“Volodymyr Tymoshchuk is charged for his role in ransomware schemes that extorted more than 250 companies across the United States and hundreds more around the world,” said Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department’s Criminal Division. “In some instances, these attacks resulted in the complete disruption of business operations until encrypted data could be recovered or restored. This prosecution and today’s rewards announcement reflects our determination to protect businesses from digital sabotage and extortion and to relentlessly pursue the criminals responsible, no matter where they are located.”

“Tymoshchuk is a serial ransomware criminal who targeted blue-chip American companies, health care institutions, and large foreign industrial firms, and threatened to leak their sensitive data online if they refused to pay,” said U.S. Attorney Joseph Nocella Jr. for the Eastern District of New York. “For a time, the defendant stayed ahead of law enforcement by deploying new strains of malicious software when his old ones were decrypted. Today’s charges reflect international coordination to unmask and charge a dangerous and pervasive ransomware actor who can no longer remain anonymous.”

“Volodymyr Tymoshchuk repeatedly used ransomware attacks to target hundreds of companies in the United States and around the globe in attempts to extort victims,” said Assistant Director in Charge Christopher G. Raia of the FBI New York Field Office. “Today’s announcement should serve as warning, cyber criminals may believe they act with impunity while conducting harmful cyber intrusions, but law enforcement is onto you and will hold you accountable. The FBI along with our law enforcement partners will continue to scour the globe to bring to justice any individual attempting to use the anonymity of the internet to commit crime.”

“The criminals behind Nefilim ransomware may believe they can profit from extortion and data leaks, but they are wrong,” said Special Agent in Charge Christopher J. S. Johnson of the FBI’s Springfield Field Office. “The FBI is actively pursuing them to disrupt their operations and bring them to justice. We urge all organizations to report these attacks immediately — because every report helps us dismantle these networks and ensure cybercriminals are held accountable.”

As alleged in the superseding indictment, between December 2018 and October 2021, Tymoshchuk used the LockerGoga, MegaCortex, and Nefilim ransomware variants to encrypt computer networks in countries around the world, including in the Eastern District of New York, elsewhere in the United States, France, Germany, the Netherlands, Norway, and Switzerland. These ransomware attacks caused millions of dollars of losses, including damage to victim computer systems, remediation costs, and ransomware payments to the perpetrators. In these attacks, the perpetrators typically customized the ransomware executable file (the ransomware file responsible for encryption) for each ransomware victim. The customization allowed the ransomware actors to create a decryption key that could only decrypt the network of the specific victim. If a victim paid the ransom demand, the perpetrators would send a decryption tool, which enabled the victim to decrypt the computer files locked by the ransomware program.

Between July 2019 and June 2020, Tymoshchuk and his co‑conspirators are alleged to have compromised the networks of more than 250 victim companies in the United States and hundreds of other companies around the world with LockerGoga and MegaCortex. However, many of these extortion attempts were unsuccessful because law enforcement often notified victims that their networks had been compromised before Tymoshchuk and his co-conspirators were able to deploy the ransomware. Subsequently, from July 2020 through October 2021, Tymoshchuk is alleged to have been one of the administrators of the Nefilim ransomware strain. Tymoshchuk and the other Nefilim administrators provided other Nefilim ransomware affiliates, including co‑defendant Artem Stryzhak, who was extradited from Spain and faces charges in the Eastern District of New York, with access to the Nefilim ransomware in exchange for 20 percent of the ransom proceeds extorted from Nefilim victims.

In September 2022, as part of an international coordinated effort against LockerGoga and MegaCortex ransomware, decryption keys associated with those ransomware variants were made available to the public via the “No More Ransomware Project,” an initiative to empower ransomware victims to decrypt encrypted computers without paying a ransom. These decryption keys enabled compromised victim companies and institutions to recover data previously encrypted with LockerGoga and MegaCortex ransomware.

Tymoshchuk is charged with two counts of conspiracy to commit fraud and related activity in connection with computers, three counts of intentional damage to a protected computer, one count of unauthorized access to a protected computer, and one count of transmitting a threat to disclose confidential information.

The FBI is investigating this case.

Trial Attorney Brian Z. Mund of the Justice Department’s Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorneys Alexander F. Mindlin and Ellen H. Sise for the Eastern District of New York are prosecuting the case.

The Justice Department’s Office of International Affairs provided critical assistance, as did the FBI’s Legal Attachés, authorities in France, Czech Republic, Germany, Lithuania, Luxembourg, Netherlands, Norway, Switzerland, and Ukraine, and Europol and Eurojust via ICHIP The Hague.

CCIPS investigates and prosecutes cybercrime in coordination with domestic and international law enforcement agencies, often with assistance from the private sector. Since 2020, CCIPS has secured the conviction of over 180 cybercriminals, and court orders for the return of over $350 million in victim funds.

Concurrent with the unsealing of the superseding indictment, the U.S. Department of State’s Transnational Organized Crime (TOC) Rewards Program is offering a rewards totaling up to $11 million for information leading to the arrest and/or conviction or location of Tymoshchuk or his conspirators.

Anyone with information on these malicious cyber actors, or associated individuals or entities, should contact the FBI via phone at +1-917-242-1407 or by email at TymoTips@fbi.gov. If you are in the United States, you can also contact your local FBI field office. If outside the United States, you can visit the nearest U.S. embassy. More information about the TOC reward offer is located on the State Department website.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Man Pleads Guilty to Attempting to Use a Weapon of Mass Destruction and Attempting to Destroy an Energy Facility in Nashville

Source: United States Department of Justice Criminal Division

Skyler Philippi, 24, of Columbia, Tennessee, pleaded guilty today to attempting to use a weapon of mass destruction and attempting to destroy an energy facility.

“For months, Philippi planned what he had hoped would be a devastating attack on Nashville’s energy infrastructure. He acquired what he believed to be explosives, surveilled his target, and equipped a drone to attack an electrical substation. Motivated by a violent ideology, Philippi wanted ‘to do something big.’ Instead, the FBI disrupted his plans, and Philippi now awaits sentencing,” said Assistant Attorney General for National Security John A. Eisenberg. “The National Security Division and the FBI will continue to protect our Nation’s critical infrastructure from would-be saboteurs.”

“Our office is fully committed to thwarting dangerous attacks motivated by hate,” said Acting U.S. Attorney Robert E. McGuire for the Middle District of Tennessee. “I commend the agents who investigated this conduct and stopped this attack from victimizing our community. I commend the prosecutors who held the defendant accountable for his terrible actions.”

“Skyler Philippi planned to attack an energy facility with a drone containing explosives, which had the potential to knock out power to thousands of American homes and to critical facilities like hospitals,” said Assistant Director Donald Holstead of the FBI’s Counterterrorism Division. “Through rigorous investigation, his plan was disrupted. Protecting our communities from threats to public safety is a priority for the FBI, and we will continue to work with our law enforcement partners to hold accountable those who attempt to damage critical infrastructure and threaten our national security.”

According to court documents, in June 2024, Philippi communicated to a confidential human source (CHS) that he wanted to commit a mass shooting at a YMCA facility located in or around Columbia, Tennessee. In July 2024, Philippi told another CHS about the impact of attacking large interstate substations and said that attacking several substations would “shock the system,” causing other substations to malfunction. Philippi researched previous attacks on electric substations and concluded that attacking with firearms would not be sufficient. Philippi, therefore, planned to use a drone with explosives attached to it and to fly the drone into the substation. Philippi said that his plan was to fly a drone with explosives attached to it into the electric substation, that he preferred to build a drone himself to avoid law enforcement detection, and that he wanted to attach TATP (Triacetone Triperoxide, a high-energy explosive material) or C-4 explosive material to the drone.

In August 2024, Philippi told an undercover employee (UCE) that he had written what he called a “manifesto” outlining his desire to attack “high tax cities or industrial areas to let the kikes lose money,” and about his previous affiliation with Atomwaffen Division and the National Alliance.

In September 2024, Philippi conducted reconnaissance of a specific electric substation. Philippi ordered a plastic explosive composition known as C-4 and other explosives from the UCEs. Philippi purchased black powder to be used in pipe bombs, which Philippi intended to use during the attack on the substation. Philippi texted: “if you want to do the most damage as an accelerationist, attack high economic, high tax, political zones in every major metropolis.” Referring to the substation, Philippi stated, “Holy sh**. This will go up like a fu**in fourth of July firework.”

On Nov. 2, 2024, Philippi met the undercover employees at a hotel and participated in a Nordic ritual, which included reciting a Nordic prayer and discussing the Norse god Odin. Philippi told the UCEs that “this is where the New Age begins” and that it was “time to do something big” that would be remembered “in the annals of history.” Philippi and the UCEs drove to the operation site. The UCEs moved to their assigned positions as lookouts for Philippi. Law-enforcement agents arrested Philippi. When he was taken into custody, Philippi was at the rear of the vehicle, with the drone powered up, and the explosive device was armed and located next to the drone. Philippi was prepared to attach the explosives to the drone when he was arrested.

Sentencing is scheduled for Jan. 8, 2026. Philippi faces a maximum penalty of life in prison and a maximum fine of $250,000. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

The FBI Nashville Field Office is investigating the case.

Assistant U.S. Attorney Josh Kurtzman for the Middle District of Tennessee and Trial Attorneys Justin Sher and James Donnelly of the National Security Division’s Counterterrorism Section are prosecuting the case.

Norfolk Southern Agrees to Give Amtrak Trains Highest Priority Over Freight Trains and Make its Delay Records for Amtrak Trains Available to the Department of Justice

Source: United States Department of Justice Criminal Division

The Justice Department today announced a settlement with Norfolk Southern Corporation and Norfolk Southern Railway Company (together, Norfolk Southern) to resolve allegations that Norfolk Southern delayed Amtrak passenger trains on Amtrak’s Crescent Route in violation of federal law by failing to give Amtrak trains preference over freight trains. As a result of the settlement, the Justice Department has moved to dismiss its lawsuit against Norfolk Southern.

As part of the settlement, Norfolk Southern agreed to provide all Amtrak trains the highest priority; train its employees to give priority to Amtrak trains; require supervisor approval for any dispatching decision that does not give priority to Amtrak trains in non-emergency situations; and provide records regarding delays suffered by Amtrak trains traveling on the Crescent Route controlled by Norfolk Southern. Norfolk Southern has also pledged to assist the Justice Department in determining the root cause of any delays to Amtrak Crescent Route trains. Norfolk Southern’s Vice President of Compliance will annually certify that Norfolk Southern is in compliance with the agreement and its obligations under the law to provide Amtrak trains preference.

“Americans traveling by train are entitled to trips free from delays caused by railroads failing to give Amtrak preference over freight trains,” said Assistant Attorney General Brett Shumate of the Justice Department’s Civil Division. “The settlement reached today, as well as Norfolk Southern’s improved performance on Amtrak’s Crescent Route, demonstrates the Department of Justice’s commitment to protecting everyday American train passengers.”

The Crescent Route, operated by Amtrak (also known as the National Railroad Passenger Corporation), is a 1,377-mile passenger line that stops at 33 cities and towns connecting rural areas in Virgina, North Carolina, South Carolina, Georgia, Mississippi, Alabama and Louisiana to each other and larger cities. Norfolk Southern controls 1,140 miles of rail line on the Crescent Route and handles dispatching for all trains along that segment. Approximately 304,000 passengers traveled on the Crescent Route during 2024 and year-over-year ridership has increased so far in 2025.

According to the complaint filed on July 30, 2024, federal law requires all rail carriers that contract with Amtrak to provide Amtrak passenger trains preference over freight trains. The complaint alleges that Norfolk Southern regularly failed to do so, leading to widespread delays to train passengers.

Since the Justice Department filed its complaint, passengers traveling on the Crescent Route have experienced widespread improvements. From 2024 to 2025, the number of delay minutes incurred by Amtrak’s Crescent trains has declined by 53%.

Trial Attorneys Max Goldman, Paulina Stamatelos and Oliver McDonald of the Civil Division’s Consumer Protection Branch are handling the case.

For more information about the Consumer Protection Branch and its enforcement efforts, visit www.justice.gov/civil/consumer-protection-branch.

The claims asserted against defendants are allegations only and there has been no determination of liability.

Court Enters Consent Order Requiring North Carolina to Fix Inaccurate Voter List

Source: United States Department of Justice Criminal Division

The Justice Department announced today that a federal court has entered a consent order that remedies North Carolina’s failure to maintain an accurate voter list in violation of the Help America Vote Act (HAVA). The successful resolution of the case is another step toward achieving the mandate in President Donald J. Trump’s Executive Order 14248 entitled “Preserving and Protecting the Integrity of American Elections,” to ensure that elections are being held in compliance with federal laws which guard against illegal voting, unlawful discrimination, and other forms of fraud, error, or suspicion.

In the lawsuit filed on May 27, the United States alleged that North Carolina, in violation of HAVA’s mandate and clear Congressional intent, used a State voter registration form that did not require a voter to provide identifying information such as a driver’s license number or last four digits of a social security number. When the lawsuit was filed, it is estimated that at least 100,000 voters did not have the required identifying information on North Carolina’s registration rolls. As of early September, that number has decreased as North Carolina engages in remedial actions to comply with HAVA.

“Unsuccessful intervenors showed breathtaking hubris when they made alarmist accusations against the Department of Justice, and yet claimed credit for the very relief that the Department actively pursued in the complaint,” said Assistant Attorney General Harmeet K. Dhillon of the Justice Department’s Civil Rights Division. “Nevertheless, we are pleased with the progress North Carolina has made and will continue to make as it cleans up its registration rolls, as required by federal law.”

The Civil Rights Division’s Voting Section enforces the civil provisions of federal statutes that protect the integrity of the vote, including the Voting Rights Act, National Voter Registration Act, Help America Vote Act, and the Uniformed and Overseas Citizens Absentee Voting Act.

More information about voting and elections is available on the Justice Department’s website at www.justice.gov/voting. Complaints about possible violations of federal voting rights laws can be submitted through the Civil Rights Division’s website at civilrights.justice.gov or by telephone at 1-800-253-3931.

U.S. Trustee Program Obtains More Than $1.1M in Monetary Relief Against 12 Defendants in Nationwide Foreclosure Defense Scheme

Source: United States Department of Justice Criminal Division

The Justice Department’s U.S. Trustee Program (USTP) recently obtained a judgment imposing more than $1.1 million in civil penalties, fines, damages, and fees against 12 defendants who collaborated in a nationwide scheme to defraud vulnerable homeowners facing foreclosure.

On Aug. 28, following an eight-day trial on the USTP’s complaint, the U.S. Bankruptcy Court for the Western District of Louisiana entered judgment against NVA Financial Services LLC; its president and sole member, Steven Nahas; Karen Kisch, the defendants’ managing attorney; and nine associates involved in the business. The court found “overwhelming evidence” that the defendants carried out a scheme in which homeowners were “shunted into frivolous pro se bankruptcy cases” so that the defendants could continue billing the homeowners under the pretense of gaining time to negotiate loan modifications. The USTP introduced evidence at trial showing that the scheme resulted in at least 186 abusive bankruptcy filings.

“This judgment makes clear that those who abuse the bankruptcy system to exploit struggling homeowners will be held accountable,” said Acting Director Ramona D. Elliott of the Executive Office for U.S. Trustees. “The USTP will remain vigilant to root out schemes that threaten the integrity of the bankruptcy system.”

The USTP’s complaint arose out of a chapter 13 bankruptcy case filed by a homeowner from West Monroe, Louisiana, who had sought mortgage assistance to avoid a foreclosure sale. The homeowner paid a $1,100 retainer for what he believed was legal representation, followed by multiple $500 monthly payments debited from his bank account. The defendants’ local counsel in Louisiana, who the homeowner believed was representing him, never communicated with him or provided any assistance. Instead, with the foreclosure sale date approaching, an NVA associate sent the homeowner a bare-bones bankruptcy petition — listing the mortgage lender as the only creditor — and told him how to file it on his own. The bankruptcy court dismissed the petition a month later for failure to provide proof of required pre-bankruptcy credit counseling and failure to pay the filing fee.

The defendants continued to debit the homeowner’s bank account for “loan modification services” while pressuring him to file another bankruptcy case. After the homeowner received notice of a rescheduled foreclosure sale, he hired a local bankruptcy attorney, but the defendants repeatedly urged him to fire the attorney and allow them to continue to “work his file.” The homeowner’s new attorney reopened the bankruptcy case and eventually negotiated a mortgage loan modification for the homeowner.

In an opinion accompanying the judgment, the bankruptcy court concluded that each of the 12 defendants had abused multiple sections of the Bankruptcy Code governing bankruptcy petition preparers, debt relief agencies, and attorneys, resulting in at least 186 abusive bankruptcy filings nationwide. While trying to hide their involvement in the fraudulent scheme, the defendants tried to earn as much money as possible and often abused the bankruptcy process.

Along with imposing $1.1 million in monetary relief, the court temporarily suspended Kisch and the defendants’ local counsel in Louisiana from practicing before the bankruptcy court and referred them to attorney disciplinary authorities for violations of professional conduct rules. Two associates involved in the business were referred to disciplinary authorities as well for their unauthorized practice of law.

The USTP’s mission is to promote the integrity and efficiency of the bankruptcy system for the benefit of all stakeholders — debtors, creditors and the public. The USTP consists of 21 regions with 88 field offices nationwide and an Executive Office in Washington, D.C. Learn more about the USTP at www.justice.gov/ust.   

Eight MS-13 Gang Members Plead Guilty to Multi-Year Racketeering Conspiracy Involving Murders and Witness Tampering

Source: United States Department of Justice Criminal Division

Eight members of the violent transnational criminal organization Mara Salvatrucha, commonly known as MS-13, pleaded guilty today to charges stemming from a multi-year racketeering conspiracy that included multiple murders and acts of witness tampering. The defendants—identified as Walter Antonio Chicas-Garcia, 28, aka “Mejia,” Wilson Jose Ventura-Mejia, 29, aka “Discreto,” Miguel Angel Aguilar-Ochoa, 40, aka “Darki,” and Marlon Miranda-Moran, 26, aka “Chinki,”—are all citizens of El Salvador and were unlawfully residing in Houston, Texas at the time of the offenses.

According to their plea agreements, Chicas-Garcia, Ventura-Mejia, and Aguilar-Ochoa will each be sentenced to 50 years of imprisonment while Miranda-Moran will be sentenced to 35 years of imprisonment.

“These defendants carried out brutal murders in the name of MS-13, killing victims with machetes, baseball bats, and their bare hands, and then sending photos of the victims’ bodies to MS-13 leaders in El Salvador,” said Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department’s Criminal Division. “The defendants committed these unthinkable acts to maintain their status in a gang that spread fear in local neighborhoods and targeted those brave enough to cooperate with law enforcement. Today’s guilty pleas send a powerful message that the Justice Department will aggressively pursue and hold accountable MS-13 members who use violence and murder to terrorize our communities.”

On August 11, four additional MS-13 members—Defendants Luis Ernesto Carbajal-Peraza, 33, aka “Destino,” Edgardo Martinez-Rodriguez, 35, aka “Largo,” Carlos Alexi Garcia-Gongora, 27, aka “Garcia,” and Wilman Rivas-Guido, 29, aka “Inquieto” —also pleaded guilty to the same racketeering conspiracy. All four are citizens of El Salvador and were residing in the Houston area. The parties stipulated to a sentencing range of 40 to 45 years of imprisonment for Carbajal-Peraza, and 45 to 50 years for Martinez-Rodriguez, Garcia-Gongora, and Rivas-Guido.

According to court documents and statements made in court, MS-13 is a violent international street gang involved in a variety of violent criminal activities across the United States, including Texas, Virginia, Maryland, New York, and California. MS-13 also has a large international presence in El Salvador and Honduras. To protect MS-13’s power, reputation, and territory, members and associates must use intimidation and violence, including murder and assault with deadly weapons, such as machetes.

As part of their plea agreement, the defendants admitted to being members of MS-13 and participating in a criminal enterprise responsible for multiple murders, extortion, drug trafficking, robbery, and obstruction of justice in and around the Houston, Texas area from 2017 through 2018. High-ranking MS-13 leaders based in El Salvador ordered and approved of the murders, sometimes listening by phone as MS-13 members carried out the murders. MS-13 members participated in the murders to increase or maintain their own position within MS-13’s ranks. MS-13 targeted the murder victims because they were believed to be members of rival gangs, cooperating with law enforcement, or working against MS-13’s interests. MS-13 members committed the murders using machetes, a baseball bat, and strangling. After the murder, MS-13 members sent photos of the victims’ bodies to high-ranking MS-13 members in El Salvador, sometimes further mutilating or dismembering the victim’s body before sending the photos.

According to their plea agreements, Chicas-Garcia, Ventura-Mejia, and Aguilar-Ochoa will each be sentenced to 50 years in federal prison while Miranda-Moran will receive a 35-year-term of imprisonment. Martinez-Rodriguez, Garcia-Gongora, and Rivas-Guido have agreed to a term from 45-50 years, while Carbajal-Peraza is expected to receive 40-45 years of imprisonment.

Sentencing hearings for all eight defendants are scheduled to take place later this year. A federal district court judge will consider the sentencing stipulations and impose any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

The FBI, Homeland Security Investigations, Houston Police Department, Harris County Sheriff’s Office, Galveston Police Department, Texas Department of Public Safety, Liberty County Sheriff’s Office, the Prince George’s County Police Department, the University of North Texas Center for Human Identification, the United States Marshal Service, and the Texas Office of the Attorney General led or contributed to the lengthy and complex investigation of this case.

Trial Attorney César S. Rivera-Giraud from the Criminal Division’s Violent Crime and Racketeering Section, along with Assistant U.S. Attorney Keri Fuller, and Special Assistant U.S. Attorney Britni Verdeja for the Southern District of Texas are prosecuting the case.

This case is part of Operation Take Back America, a nationwide initiative that marshals the full resources of the Department of Justice to repel the invasion of illegal immigration, achieve the total elimination of cartels and transnational criminal organizations and protect our communities from the perpetrators of violent crime. Operation Take Back America streamlines efforts and resources from the Department’s OCDETF and Project Safe Neighborhoods.
 

California Man Sentenced for Role in Global Digital Asset Investment Scam Conspiracy Resulting in Theft of More than $36.9M from Victims

Source: United States Department of Justice Criminal Division

A California man was sentenced today to 51 months in federal prison for his role in laundering more than $36.9 million from victims in an international digital asset investment scam conspiracy that was carried out from scam centers in Cambodia. The court also ordered him to pay $26,867,242.44 in restitution to victims.

“The defendant was part of a group of co-conspirators that preyed on American investors by promising them high returns on supposed digital asset investments when, in fact, they stole nearly $37 million from U.S. victims using Cambodian scam centers,” said Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department’s Criminal Division. “Foreign scam centers, purporting to offer investments in digital assets have, unfortunately, proliferated.  The Criminal Division is committed to bringing to justice those that steal from American investors, wherever the fraudsters may be located.”

“This defendant will spend years in federal prison for participating in a conspiracy in which victims lost tens of millions of dollars, starting with the simple step of responding to unsolicited messages on their phones,” said Acting U.S. Attorney Bill Essayli for the Central District of California. “The public should always remember to be vigilant and wary of strangers marketing promising investment opportunities. Your retirement fund or children’s college money may depend on it.”

Shengsheng He, 39, of La Puente, California, a former co-owner of the Bahamas-based Axis Digital Limited, pleaded guilty in the Central District of California to conspiracy to operate an unlicensed money transmitting business on April 7. 

According to court documents, He was part of an international criminal network that induced U.S. victims to transfer funds to accounts controlled by co-conspirators who then laundered victim money through U.S. shell companies, international bank accounts, and digital asset wallets.

As part of the conspiracy, co-conspirators residing overseas would contact U.S. victims directly through unsolicited social media interactions, telephone calls, text messages, and online dating services to gain the victims’ trust. The co-conspirators then promoted fraudulent digital asset investments to the victims. Scammers would tell victims that their investments were appreciating in value when, in fact, the funds the victims sent to the scammers had been stolen. More than $36.9 million in victim funds were transferred from U.S. bank accounts controlled by the co-conspirators to a single account at Deltec Bank in the Bahamas, opened in the name of Axis Digital Limited. He and other co-conspirators directed Deltec Bank to convert victim funds to the stablecoin Tether (USDT) and to transfer the converted funds to a digital asset wallet controlled by individuals in Cambodia. From there, co-conspirators in Cambodia transferred the USDT to the leaders of scam centers throughout the region including in Sihanoukville, Cambodia.

Eight co-conspirators have pleaded guilty so far, including Daren Li, a national of China and St. Kitts and Nevis who has been in U.S. custody since April 2024, and Lu Zhang, a Chinese national illegally in the United States who managed a network of U.S.-based money launderers. Li and Zhang each pleaded guilty to conspiracy to commit money laundering on Nov.12, 2024, and May 13, 2024, respectively.

He co-founded Axis Digital with defendant Jose Somarriba. Chinese national Jingliang Su joined Axis Digital as a director and participated in the digital asset conversions and transfers of victim funds. Somarriba and Su each pleaded guilty to conspiracy to operate an unlicensed money transmitting business on April 14, and June 9, respectively.

USSS’s Global Investigative Operations Center is investigating the case. The Homeland Security Investigations’ El Camino Real Financial Crimes Task Force, Customs and Border Protection’s National Targeting Center, U.S. Department of State’s Diplomatic Security Service, Dominican National Police, and U.S. Marshals Service provided valuable assistance.

Assistant U.S. Attorneys Maxwell Coll and Alexander Gorin of the Terrorism and Export Crimes Section, Nisha Chandran of the Major Frauds Section, and Trial Attorney Stefanie Schwartz of the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS) and Tamara Livshiz of the Criminal Division’s Fraud Section prosecuted this case.

CCIPS investigates and prosecutes cybercrime in coordination with domestic and international law enforcement agencies, often with assistance from the private sector. Since 2020, CCIPS has secured the conviction of over 180 cybercriminals, and court orders for the return of over $350 million in victim funds.

If you or someone you know is a victim of a digital asset investment fraud, report it to IC3.gov. 

Laboratory CEO, Marketers, and Physicians to Pay Over $6M to Settle Allegations of Management Service Organization and other Lab Testing Kickbacks

Source: United States Department of Justice Criminal Division

One-time laboratory CEO Christopher Grottenthaler, formerly of Frisco, Texas, has agreed to pay $4.25 million to resolve False Claims Act litigation with the United States alleging illegal payments to doctors for laboratory referrals in violation of the Anti-Kickback Statute. Two physicians — Hong Davis, M.D., of Plano, Texas, and Elizabeth Seymour, M.D., of Denton, Texas — and seven marketers — Courtney Love, of Dallas, Texas, Stephen Kash, of Winnie, Texas, Laura Howard, of Lucas, Texas, Jeffrey Parnell, of Tyler, Texas, Stanley Jones, of San Antonio, Texas, Jordan Perkins, of Conroe, Texas, and Ruben Marioni, of Spring, Texas — have agreed to pay an additional $1,818,462 to settle the United States’ laboratory kickback allegations against them in the case. The settling parties have agreed to cooperate with the Department of Justice’s investigations of, and litigation against, other participants in the alleged schemes. With these settlements, the Department of Justice has secured over $59 million in civil False Claims Act settlements for kickbacks to healthcare providers disguised as managed service organization (MSO) investment distributions, including recoveries from 50 physicians.

“The Department of Justice will continue to pursue and prioritize healthcare fraud, including redressing illegal kickbacks,” said Assistant Attorney General Brett A. Shumate of the Justice Department’s Civil Division. “Kickbacks to doctors can undermine medical decision-making, subject patients to wasteful medical treatments, and squander taxpayer money.”

“These settlements reflect the firm commitment of the Eastern District of Texas to punish those who use fraudulent means to profit at the expense of federal healthcare programs funded by the hard-working taxpayers of the United States,” said Acting U.S. Attorney Jay R. Combs for the Eastern District of Texas. “We will continue to pursue those who steal from federal healthcare programs through these types of schemes to pay improper kickbacks to providers.”

“Laboratory testing is an essential part of patient care, not a vehicle for greed and exploitation,” said Deputy Inspector General for Investigations Christian J. Schrank of the Department of Health and Human Services, Office of Inspector General (HHS-OIG). “In collaboration with our law enforcement partners, HHS-OIG will continue to investigate kickback schemes and false claims made to federal healthcare programs.”

“The Department of Defense Office of Inspector General’s Defense Criminal Investigative Service (DCIS) is committed to protecting the integrity of TRICARE, the healthcare benefit program for military members, retirees, and their families,” said Acting Special Agent in Charge Chad Gosch of DCIS’s Southwest Field Office. “Decisions that prioritize financial gain over patient health erodes taxpayer trust and negatively affects military readiness. DCIS, alongside our law enforcement partners, will relentlessly pursue those who commit fraud and exploit this critical healthcare program.”

The Anti-Kickback Statute prohibits offering, paying, soliciting, or receiving remuneration to induce referrals of items or services covered by Medicare, Medicaid, and other federally funded healthcare programs. It seeks to ensure that medical providers’ judgments are not compromised by improper financial incentives and are instead based on the best interests of their patients.

Christopher Grottenthaler, the former Chief Executive Officer of True Health Diagnostics, LLC (True Health), a laboratory in Frisco, Texas, agreed to pay $4.25 million to resolve allegations that he caused false claims for laboratory testing to Medicare, Medicaid, and TRICARE from January 2015 to May 2018. Grottenthaler allegedly agreed to a kickback scheme in which marketers, including True Health’s own employees, offered and paid doctors kickbacks disguised as MSO distributions to induce the doctors’ laboratory testing referrals. Grottenthaler allegedly facilitated True Health’s continued participation in the MSO kickback scheme after receiving warnings that the marketers “are a powder keg waiting to explode on us” and that “people are gonna go to prison.” The settlement also resolves allegations that Grottenthaler arranged for True Health to pay kickbacks disguised as consulting fees, processing and handling fees, and waivers of copayments and deductibles, to induce laboratory testing referrals.

The settlement with Grottenthaler resolves certain allegations in a lawsuit originally filed by STF LLC under the qui tam or whistleblower provisions of the False Claims Act, which permit private parties to sue on behalf of the government when they believe that a defendant has submitted false claims for government funds and receive a share of any recovery. The False Claims Act permits the United States to intervene in and take over the action, as it did here with respect to Grottenthaler. STF LLC, whose members are Christopher Riedel and Felice Gersh, M.D., will receive a $148,750 share of the Grottenthaler settlement. The United States also added claims to the lawsuit against additional defendants and some of those are resolved in the settlements announced today. The lawsuit, which continues as to other defendants, is captioned United States, et al. ex rel. STF LLC v. True Health Diagnostics LLC et al., No. 4:16-cv-547 (E.D. Tex.).

The settlements announced today resolve the United States’ allegations in the lawsuit that two physicians took kickbacks in violation of the Anti-Kickback Statute from laboratory marketers’ purported MSOs in return for laboratory testing referrals. Dr. Hong Davis agreed to pay $124,627 to resolve allegations that from October 2015 to March 2017, she received thousands of dollars in payments from two purported MSOs, Ascend MSO of TX LLC (Ascend MSO) and Herculis MG LLC, in return for ordering laboratory tests from Little River Healthcare (Little River), a critical access hospital in Rockdale, Texas, and Boston Heart Diagnostics Corporation (Boston Heart), a clinical laboratory in Framingham, Massachusetts. Dr. Elizabeth Seymour agreed to pay $234,215 to resolve allegations that from April 2016 to January 2018, she received thousands of dollars in payments from two purported MSOs, Ascend MSO and Eridanus MG LLC, in return for ordering laboratory tests from Little River, True Health, and Boston Heart. The civil settlement amounts that Drs. Davis and Seymour agreed to pay are in addition to amounts they were ordered to pay in a criminal proceeding captioned United States v. Susan Hertzberg, et al., No. 6:22-cr-3-JDK (E.D. Tex.).

Lastly, the following seven marketers and their associated entities agreed to pay a total of $1,459,620 to resolve the United States’ allegations in the civil litigation that they paid kickbacks disguised as MSO payments to doctors to induce the doctors’ laboratory testing referrals: Former True Health Account Executive Courtney Love; former True Health Director of Strategic Accounts Stephen Kash; former Boston Heart Area Sales Manager Laura Howard; former Boston Heart sales representative Jeffrey Parnell; Stanley Jones, part-owner with Parnell of Texas marketing company LGRB Management Services LLC; and Jordan Perkins and Ruben Marioni, co-owners of Texas marketing company Next Level Healthcare Consultants LLC. The settlement amounts for Kash and Howard were based on their ability to pay. The civil settlement amounts for Kash, Howard, Parnell, and Perkins are in addition to amounts they were ordered to pay in criminal proceedings captioned United States v. Susan Hertzberg, et al., No. 6:22-cr-3-JDK (E.D. Tex.), and/or United States v. Christopher Grottenthaler, et al., No. 6:22-cr-135-JDK (E.D. Tex.).

The settlements announced today were the result of a coordinated effort between the Civil Division’s Commercial Litigation Branch, Fraud Section and the U.S. Attorney’s Office for the Eastern District of Texas, with assistance from HHS-OIG and DCIS. They were handled by Trial Attorneys Christopher Terranova and Gavin Thole in the Civil Division’s Commercial Litigation Branch (Fraud Section) and Assistant U.S. Attorneys James Gillingham and Betty Young for the Eastern District of Texas.

The government’s pursuit of these matters illustrates the government’s emphasis on combating healthcare fraud. One of the most powerful tools in this effort is the False Claims Act. Tips and complaints from all sources about potential fraud, waste, abuse, and mismanagement can be reported to the Department of Health and Human Services, at 1-800-HHS-TIPS (800-447-8477).

The claims resolved by the settlements are allegations only, and there has been no determination of civil liability.