Global Disruption of Three Terror Finance Cyber-Enabled Campaigns

The Justice Department on Thursday announced the dismantling of three terrorist financing cyber-enabled campaigns, involving the al-Qassam Brigades, Hamas’s military wing, al-Qaeda, and Islamic State of Iraq and the Levant (ISIS).


Largest Ever Seizure of Terrorist Organizations’ Cryptocurrency Accounts

The Justice Department on Thursday announced the dismantling of three terrorist financing cyber-enabled campaigns, involving the al-Qassam Brigades, Hamas’s military wing, al-Qaeda, and Islamic State of Iraq and the Levant (ISIS). 

This coordinated operation is detailed in three forfeiture complaints and a criminal complaint unsealed today in the District of Columbia.  These actions represent the government’s largest-ever seizure of cryptocurrency in the terrorism context.

These three terror finance campaigns all relied on sophisticated cyber-tools, including the solicitation of cryptocurrency donations from around the world.  The action demonstrates how different terrorist groups have similarly adapted their terror finance activities to the cyber age. 

Each group used cryptocurrency and social media to garner attention and raise funds for their terror campaigns.  Pursuant to judicially-authorized warrants, U.S. authorities seized millions of dollars, over 300 cryptocurrency accounts, four websites, and four Facebook pages all related to the criminal enterprise.

Funds successfully forfeited with a connection to a state sponsor of terrorism may in whole or in part be directed to the United States Victims of State Sponsored Terrorism Fund (http://www.usvsst.com/) after the conclusion of the case.

“It should not surprise anyone that our enemies use modern technology, social media platforms and cryptocurrency to facilitate their evil and violent agendas,” said Attorney General William P. Barr.   “The Department of Justice will employ all available resources to protect the lives and safety of the American public from terrorist groups.  We will prosecute their money laundering, terrorist financing and violent illegal activities wherever we find them.  And, as announced today, we will seize the funds and the instrumentalities that provide a lifeline for their operations whenever possible.  I want to thank the investigators from the Internal Revenue Service, Department of Homeland Security, Federal Bureau of Investigation, and the prosecutors from the D.C. United States Attorney’s Office and National Security Division for their hard and innovative work in attacking the networks that allow these terrorists to recruit for and fund their dangerous actions.”

“Terrorist networks have adapted to technology, conducting complex financial transactions in the digital world, including through cryptocurrencies. IRS-CI special agents in the DC cybercrimes unit work diligently to unravel these financial networks,” said Secretary of the Treasury Steven T. Mnuchin.  “Today’s actions demonstrate our ongoing commitment to holding malign actors accountable for their crimes.” 

“The Department of Homeland Security was born after the September 11, 2001 terrorist attacks and, nearly 20 years later, we remain steadfast in executing our critical mission to safeguard the American people, our homeland, and our values,” said Acting Secretary of Homeland Security Chad F. Wolf.  “Today’s announcement detailing these enforcement actions targeting foreign terrorist organizations is yet another example of the Department’s commitment to our mission. After launching investigations that identified suspected online payments being funneled to and in support of terrorist networks, Homeland Security Investigations skillfully leveraged their cyber, financial, and trade investigative expertise to disrupt and dismantle cyber-criminal networks that sought to fund acts of terrorism against the United States and our allies.  Together with our federal law enforcement partners, the Department will utilize every resource available to ensure that our Homeland is and remains secure.”    

“These important cases reflect the resolve of the D.C. United States Attorney’s Office to target and dismantle these sophisticated cyber-terrorism and money laundering actors across the globe,” stated Acting United States Attorney Michael R. Sherwin.  “While these individuals believe they operate anonymously in the digital space, we have the skill and resolve to find, fix and prosecute these actors under the full extent of the law.” 

“IRS-CI’s ability to trace funds used by terrorist groups to their source and dismantle these radical group’s communication and financial networks directly prevents them from wreaking havoc throughout the world,” said Don Fort, Chief, IRS Criminal Investigation.  “Today the world is a safer place.”

“As the primary law enforcement agency charged with defeating terrorism, the FBI will continue to combat illicit terrorist financing regardless of platform or method employed by our adversaries,” said FBI Director Christopher Wray. “As demonstrated by this recent operation, the FBI remains committed to cutting off the financial lifeblood of these organizations that seek to harm Americans at home and abroad.”

“Homeland Security Investigations continues to demonstrate their investigative expertise with these enforcement actions,” said ICE Deputy Director and Senior Official Performing the Duties of the Director Matthew T. Albence.  “Together with law enforcement partners, HSI has utilized their unique authorities to bring to justice those cyber-criminal networks who would do us harm.”

Al-Qassam Brigades Campaign

The first action involves the al-Qassam Brigades and its online cryptocurrency fundraising efforts.  In the beginning of 2019, the al-Qassam Brigades posted a call on its social media page for bitcoin donations to fund its campaign of terror.  The al-Qassam Brigades then moved this request to its official websites, alqassam.net, alqassam.ps, and qassam.ps.

The al-Qassam Brigades boasted that bitcoin donations were untraceable and would be used for violent causes.  Their websites offered video instruction on how to anonymously make donations, in part by using unique bitcoin addresses generated for each individual donor.   

However, such donations were not anonymous.  Working together, IRS, HSI, and FBI agents tracked and seized all 150 cryptocurrency accounts that laundered funds to and from the al-Qassam Brigades’ accounts.  Simultaneously, law enforcement executed criminal search warrants relating to United States-based subjects who donated to the terrorist campaign. 

With judicial authorization, law enforcement seized the infrastructure of the al-Qassam Brigades websites and subsequently covertly operated alqassam.net.   During that covert operation, the website received funds from persons seeking to provide material support to the terrorist organization, however, they instead donated the funds bitcoin wallets controlled by the United States.

The United States Attorney’s Office for the District of Columbia also unsealed criminal charges for two Turkish individuals, Mehmet Akti and Hüsamettin Karataş, who acted as related money launderers while operating an unlicensed money transmitting business.   

Al-Qaeda Campaign

The second cyber-enabled terror finance campaign involves a scheme by al-Qaeda and affiliated terrorist groups, largely based out of Syria.  As the forfeiture complaint details, these terrorist organizations operated a bitcoin money laundering network using Telegram channels and other social media platforms to solicit cryptocurrency donations to further their terrorist goals.  In some instances, they purported to act as charities when, in fact, they were openly and explicitly soliciting funds for violent terrorist attacks.  For example, one post from a charity sought donations to equip terrorists in Syria with weapons:

Undercover HSI agents communicated with the administrator of Reminder for Syria, a related charity that was seeking to finance terrorism via bitcoin donations.  The administrator stated that he hoped for the destruction of the United States, discussed the price for funding surface-to air missles, and warned about possible criminal consequences from carrying out a jihad in the United States.

Posts from another Syrian charity similarly explicitly referenced weapons and extremist activities:

Al-Qaeda and the affiliated terrorist groups together created these posts and used complicated obfuscation techniques, uncovered by law enforcement, to layer their transactions so to conceal their actions.  Today’s complaint seeks forfeiture of the 155 virtual currency assets tied to this terrorist campaign.   

ISIS Campaign

The final complaint combines the Department’s initiatives of combatting COVID-19 related fraud with combatting terrorism financing.  The complaint highlights a scheme by Murat Cakar, an ISIS facilitator who is responsible for managing select ISIS hacking operations, to sell fake personal protective equipment via FaceMaskCenter.com (displayed below)

The website claimed to sell FDA approved N95 respirator masks, when in fact the items were not FDA approved.  Site administrators claimed to have near unlimited supplies of the masks, in spite of such items being officially-designated as scarce.  The site administrators offered to sell these items to customers across the globe, including a customer in the United States who sought to purchase N95 masks and other protective equipment for hospitals, nursing homes, and fire departments.

The unsealed forfeiture complaint seized Cakar’s website as well as four related Facebook pages used to facilitate the scheme.  With this third action, the United States has averted the further victimization of those seeking COVID-19 protective gear, and disrupted the continued funding of ISIS. 

The claims made in these three complaints are only allegations and do not constitute a determination of liability.  The burden to prove forfeitability in a civil forfeiture proceeding is upon the government.  Further, charges contained in criminal complaint are merely allegations, and the defendants are presumed innocent unless and until proven guilty beyond a reasonable doubt in a court of law.

IRS-CI Cyber Crimes Unit (Washington, D.C.), HSI’s Philadelphia Office, and FBI’s Washington D.C., New York, and Los Angeles field offices are investigating the case. Assistant U.S Attorneys Jessi Camille Brooks and Zia M. Faruqui, and National Security Division Trial Attorneys Danielle Rosborough and Alexandra Hughes are litigating the case, with assistance from Paralegal Specialists Brian Rickers and Bria Cunningham, and Legal Assistant Jessica McCormick.  Additional assistance has been provided by Chainalysis and Excygent.

Blogs to Follow:

Justice.gov (August 2020) Global Disruption of Three Terror Finance Cyber-Enabled Campaigns

DEA Reports Significant Increase in Counterfeit Pills in Minnesota

Drug Enforcement Administration (DEA) agents from the Minneapolis/St. Paul District Office are reporting a significant increase in counterfeit pills entering Minnesota from drug trafficking organizations (DTOs) in California, Arizona and Mexico.


Drug Enforcement Administration (DEA) agents from the Minneapolis/St. Paul District Office are reporting a significant increase in counterfeit pills entering Minnesota from drug trafficking organizations (DTOs) in California, Arizona and Mexico.

In Minnesota, agents have recovered approximately 46,000 counterfeit pills during the first seven months of 2020, nearly four times the amount seized in all of 2019.  Agents note that the counterfeit pill trend took off in Minnesota in 2018, with pill numbers increasing each year.

Counterfeit pain pills and sedatives are flooding the illegal drug market and causing a significant number of fatal overdose deaths. 

These dangerous substances contain fentanyl, a powerful opioid 100 times more potent than morphine. Supplied by Mexican drug cartels, or coming directly from China, these pills look identical to legitimate medications such as hydrocodone, Xanax or other medications often prescribed for pain or anxiety.

Based on a sampling of tablets seized nationwide in 2019, DEA found that 27 percent contained potentially lethal doses of fentanyl.

“There is no quality control in these counterfeit pills,” Omaha Division Special Agent in Charge Richard Salter Jr., said.  “Drug trafficking organizations do not employ scientists or use professional laboratories to create these deadly pills and therefore they cannot create the safe chemical mixtures that their legitimate pharmaceutical counterparts do.  A lethal dosage of fentanyl is two milligrams, equivalent in size to a few grains of salt, as compared to a lethal dose of heroin at 30 milligrams. Each time someone takes a counterfeit pain pill, they are playing Russian roulette with their life.” 

Minnesota’s counterfeit pills are primarily sourced from Mexico, with traffickers bringing loads across the Southwest Border into Arizona and California before making their way to Minneapolis. Counterfeit pills have been hidden among coffee beans and candy in an attempt to camouflage the product in transport and have been smuggled underneath cars in strong magnetic boxes.

Additionally, agents are seeing more counterfeit pills being shipped through mail services, with Minneapolis investigators recently seizing a 4,000 count pill load with assistance from the United States Postal Inspection Service.

“If a doctor didn’t prescribe it, or if the pill isn’t coming from a pharmacy, it’s very likely counterfeit,” Salter said. “Mexican cartels are purchasing fentanyl and its analogs and setting up huge operations to manufacture these dangerous products.”

The most common counterfeit pill found in Minnesota is an illicit substitute for oxycodone, known as M30’s for its markings. It is important to note that there is no concern of counterfeit pills entering the legitimate prescription supply chain. 

Counterfeit pills are sold on the black market, either on the street by drug dealers or on the dark web.

As with other illicit drugs, agents have tied counterfeit pills back to gangs and violent crimes.

“We have documented events where opposing gangs are fighting for drug distribution territory,” Salter said. “As a result, gang members have been either shot or killed. The drug business and violence go hand-in-hand.”

The prices of counterfeit pills vary, with distributors in Arizona and California, selling a single pill for $4.  In Minnesota, the same pill can sell for upwards of $30, or $1 per milligram.  Agents have reported seeing prices as high as $100 a pill on Native Reservations.

“Please educate your high school and college-age kids on the extreme dangers of counterfeit medications,” Salter said. “Too often, the overdose victims are young and are not prior drug abusers.  They went to a party and someone offered them a pill to relax them – then they died.  Too many American parents have had to bury their children as a result of drug overdose.”

Minnesota is one of five states in the DEA Omaha Division including Iowa, Nebraska, North Dakota and South Dakota. 

Blogs to Follow:

DEA.gov (August 2020) DEA Reports Significant Increase in Counterfeit Pills in Minnesota

ICC: Beirut Explosion Sends Shockwaves Through Iraq

Last week’s catastrophe in Lebanon’s capital city of Beirut is one the most forceful and damaging non-nuclear explosions in world history. Over 2,700 tons of poorly stored ammonium nitrate ignited in an explosion that was reportedly felt in both Cyprus and Damascus. Most corners of Beirut have significant damage, and it is estimated that tens of thousands are now homeless.


(International Christian Concern (ICC)) – Last week’s catastrophe in Lebanon’s capital city of Beirut is one the most forceful and damaging non-nuclear explosions in world history.

Over 2,700 tons of poorly stored ammonium nitrate ignited in an explosion that was reportedly felt in both Cyprus and Damascus. Most corners of Beirut have significant damage, and it is estimated that tens of thousands are now homeless.

The entire global community was shocked by this disaster.

But nearby in Iraq, where militias run rampant, and the storage of explosives in residential areas is common, the shock was underscored by the thought, “This could have happened here.” It is a reality that has helped propel Christian immigration from the country.

One Christian living in Baghdad watched in disbelief at the events unfolding in Lebanon. “I would imagine that this explosion happens in Iraq rather than Beirut! I think Iranians have more influence in Iraq. We are geographically closer to Iran. In Iraq, there are many more military bases that belong to Iran. The Iraqi government should start looking for such materials, like ammonium nitrate, to avoid any similar disaster!”

Indeed, Beirut’s catastrophe did seem to hit home for some Iraqi officials. The head of Iraq’s Border Ports Authority quickly began forming a committee intended to clear out all hazardous inventory from the border ports. They were given 72 hours to complete the task. But in some ways, it was an order that missed the point: hazardous materials are stored everywhere in Iraq, not just the ports. These materials are connected to militias and their respective political parties, many of whom are heavily under Iranian influence.

“Iraq and Lebanon have similarities on so many things,” adds another Baghdad Christian. “Mainly the influence of Iran, which results in a militia existence in both countries. Those militias could be different in approaches, but there is one thing that they 100% share: corruption. Since they are recognized as terrorist groups and they can’t get resources unless it is under the table.”

“Corruption results in risking thousands of lives every day. Stocking explosive materials in Iraq among civilians’ houses is risking lives; bad storage at the border is risking lives. I think we can have examples as much as you can read,” he continues. “These militias one way or another are destroying the Middle East. Wherever there is Iran or its militia, there are disasters, crimes, and abuse of human rights. That results in the leaving of Christians and other people who can’t be a member of a militia for religious or social reasons.”

Such scenarios are already playing out, reminds a Christian business owner in Baghdad. He specifically remembers examples similar to Beirut occurring in the Christian areas of Iraq, thanks to both ISIS and Hashid militias. He says, “I would like to remind everyone of all the explosions that took place in Iraq; there were huge ones that result in damage to hundreds of houses. Go and look at Mosul and the Nineveh Plains!”

“All that results in the immigration of Christians and other minorities,” he adds. “When militias and Hashid come and store explosive materials next to your house, what will you do? You will get killed if you talk, and you will get killed if you stay at the same house. (There are) no options! How many explosions took place in Baghdad, such as because Hashid facilities have been targeted by the international coalition?!! ISIS and other extremist groups since 2003 have impacted Christians’ life so much.”

This reality has frustrated so many Iraqi Christians in the aftermath of the Beirut explosion. For those who had tried immigrating, Lebanon was a common destination during the intermediary stage. At least, unlike other neighboring countries, there was a sizeable Lebanese Christian population to integrate with during the interim. But now with Lebanon destroyed, immigration looks harder. Its destruction serves as a reminder of what so many Iraqi Christians were trying to flee.

A Christian from Qeraqosh explained, “I have experienced so many wars, since 1980 and 1991 and later. The safe place during the war was home, but not anymore. You could die even if you are at your home, just if any militia decided to store their weapons and rockets in your neighborhood.”

Such a reality sits uneasily in the minds of Christians. “Is there still a place to live in this country?” asks one woman. “When you lose someone close to your heart, that is the worst thing that could happen to someone, especially if the cause of death was avoidable. Militias are avoidable. After every explosion and targeting, I see people leaving the country. We ended up strangers. Friends and relatives are leaving one after one, can you tell me when that will have an end?”

The explosion in Lebanon was avoidable. But Iranian regional influence, militias, and their respective political parties, make it a possible scenario in many Middle East countries. For Iraqi Christians, it is an explosion that sends shockwaves throughout the community.

For there is no way to escape such a possibility, except to leave.

Blogs to Follow:

Persecution.org (August 2020) Beirut Explosion Sends Shockwaves Through Iraq

IDF Thwarts Terror Attack from Syria

On August 2, 2020, the IDF thwarted an attempt by four terrorists to place an improvised explosive device (IED) by the Israeli security fence. The terrorists crossed the buffer zone between Israel and Syria near the Alpha Line before they were stopped by IDF troops.


On August 2, 2020, the IDF thwarted an attempt by four terrorists to place an improvised explosive device (IED) by the Israeli security fence. The terrorists crossed the buffer zone between Israel and Syria near the Alpha Line before they were stopped by IDF troops.

This attack from Syria follows an attempted infiltration into Israel from Lebanon by a Hezbollah terror squad on July 27, 2020, which you can read about here.

Following the security incident in northern Israel on July 27, 2020, the IDF gave instructions to Israeli civilians living in northern Israel in close proximity to the Blue Line. Civilians were asked to temporarily stay in their homes and avoid any activity in open areas. In addition, the IDF closed roads in the area to minimize movement.

Iran and Hezbollah, an Iranian proxy, are using Syria as a launchpad for terror against Israeli civilians. Since the outbreak of conflict in Syria in 2011, Iran has provided significant military and financial support to the Syrian government led by Bashar al-Assad. Iran has long-sought influence over Syria as control over Syria increases Iran’s ability to threaten Israel with attacks and its overall control in the region.

The Quds Force of the Iranian Islamic Revolutionary Guard Corps and Iranian proxy groups—like Hezbollah—took advantage of the instability in Syria in the aftermath of conflict, and have used this opportunity to entrench themselves in Syria, to establish a permanent base for Iranian operations. In total, since the beginning of 2018, Iran and Hezbollah have launched eight separate attacks on Israel from Syria.

After the attempted terror attack of August 2nd, the IDF conducted a patrol of the area  and discovered weapons and a bag with explosives—ready to be used—left by the terror squad just 25 meters from the Israeli security fence.  

In response to the attempted terror attack on August 2, 2020, IDF aircraft and fighter jets struck Syrian Armed Forces military sites in southern Syria on August 3, 2020. Among the targets included: observation posts, intelligence collection systems, anti-aircraft artillery, and command and control systems. 

The IDF holds the Syrian government responsible for all activities on Syrian soil, and will continue operating with determination against any violation of Israeli sovereignty.

Blogs to Follow:

IDF.IL (August 2020) IDF Thwarts Terror Attack from Syria; IDF Thwarts Hezbollah Infiltration Into Northern Israel

Missile Agency Director Describes Threat, Countermeasures

In recent years, threats from new missile systems against the homeland, deployed forces and friends and allies have arisen from Russia, China, North Korea and Iran, the director of the Missile Defense Agency said.


In recent years, threats from new missile systems against the homeland, deployed forces and friends and allies have arisen from Russia, China, North Korea and Iran, the director of the Missile Defense Agency said.

Navy Vice Adm. Jon A. Hill spoke yesterday at the Space and Missile Defense Symposium in Washington.

“At one time, the MDA focused on the ballistic missile threat. However, adversaries have designed extremely fast and maneuverable advanced cruise missiles and hyper-sonic weapons that make for “a very tough environment for defense,” Hill said. “The Missile Defense Review addressed these new threats, laying out a path to follow in developing new offensive and defensive measures, he added.”

Though defense is a key part of deterrence, Hill said, “you can’t shoot what you don’t see.” Providing that sights are sensors and radars aboard ships, on the ground and in space.

Space-based sensors are the ultimate, Hill said, because they can provide global coverage. Space tracking and surveillance systems collect data, intelligence and real-world missile testing, he said, but that capability is nowhere near where it needs to be.

Sensors start the kill chain by sending out a warning, the admiral explained. Then, radars track the missile, and fire control launches a defensive projectile.

This projectile can come from a Patriot system or Terminal High Altitude Area Defense system, all operated by the Army, or the Standard Missile 3 Block IIA or the Aegis Ballistic Missile Defense System, both operated by the Navy. Besides those defenses, ground-based interceptors, operated by the Army, are deployed at Fort Greely, Alaska, and at Vandenberg Air Force Base, California.

The command and control and battle management system, fully protected with cybersecurity measures, ties these systems together with the operators.

Many missile defense components are in the research, science and technology and demonstration phase, Hill said. For example, work is being done on the next-generation interceptor and long-range discrimination radar, as well as space-based sensors.

“Where we live today is we don’t have everything we want deployed in space, nor do we have the terrestrial or mobile sea-based sensors where we want, where we need them at the right time,” the missile agency Director said.

Besides new, cutting-edge systems, Hill noted that current systems such as Aegis and command and control are receiving important upgrades as they become available.

MDA is working with the Army to integrate the THAAD and Patriot systems so operators can communicate with both and shoot with either, depending on the scenario, the admiral said.

Allies and partners are developing their own missile defense systems or buying them from the United States through the foreign military sales system, Hill said. These systems used by friends and partners furthers global security, he pointed out, and the Defense Department is working to better integrate those systems so they’re even more effective.

Though the COVID-19 pandemic has presented challenges, Hill said, that hasn’t affected MDA’s ability to perform its mission: “If you ask me where we took risk during the global pandemic, we never took any risk in supporting the warfighter,” he said. “We continue to deliver capability, we continue to support major movements around the globe.” Delivery of systems caused some delay, he acknowledged, because assembly lines require people in confined and enclosed places.

Hill termed his MDA team and those in the services as stellar, and he said there’s no nobler calling than defending America.

Blogs to Follow:

Defense.gov (August 2020) Missile Agency Director Describes Threat, Countermeasures