ColdWarUSAF

ALERT: Ransomware Impacting Pipeline Operations

The Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday responded to a cyber-attack affecting control and communication assets on the operational technology (OT) network of a natural gas compression facility.

A cyber threat actor used a Spearphishing Link [T1192] to obtain initial access to the organization’s information technology (IT) network before pivoting to its OT network.

The threat actor then deployed commodity ransomware to Encrypt Data for Impact [T1486] on both networks. Specific assets experiencing a Loss of Availability [T826] on the OT network included human machine interfaces (HMIs), data historians, and polling servers. Impacted assets were no longer able to read and aggregate real-time operational data reported from low-level OT devices, resulting in a partial Loss of View [T829] for human operators.

The attack did not impact any programmable logic controllers (PLCs) and at no point did the victim lose control of operations. Although the victim’s emergency response plan did not specifically consider cyberattacks, the decision was made to implement a deliberate and controlled shutdown to operations.

This lasted approximately two days, resulting in a Loss of Productivity and Revenue [T828], after which normal operations resumed. CISA is providing this Alert to help administrators and network defenders protect their organizations against this and similar ransomware attacks.

The technical details stated that the victim failed to implement robust segmentation between the IT and OT networks, which allowed the adversary to traverse the IT-OT boundary and disable assets on both networks.

Cell Phones and Accessories

The threat actor used commodity ransomware to compromise Windows-based assets on both the IT and OT networks. Assets impacted on the organization’s OT network included HMIs, data historians, and polling servers and because the attack was limited to Windows-based systems, PLCs responsible for directly reading and manipulating physical processes at the facility were not impacted.

The victim was able to obtain replacement equipment and load last-known-good configurations to facilitate the recovery process and all OT assets directly impacted by the attack were limited to a single geographic facility.

US-Cert.gov (February, 2020) Alert (AA20-049A)- Ransomware Impacting Pipeline Operations

Help a veteran in need by donating here.

FBI Seeks Information on Disappearance, 15 Years Ago Today, of Danielle Imbo and Richard Petrone, Jr.

The FBI, Philadelphia Police Department, New Jersey State Police, Mount Laurel Police Department, and Burlington County Prosecutor’s Office are seeking the public’s assistance as we continue to investigate the disappearance, 15 years ago today, of Danielle (Ottobre) Imbo and Richard Petrone, Jr.

The FBI, Philadelphia Police Department, New Jersey State Police, Mount Laurel Police Department, and Burlington County Prosecutor’s Office are seeking the public’s assistance as we continue to investigate the disappearance, 15 years ago today(Feb. 19, 2020), of Danielle (Ottobre) Imbo and Richard Petrone, Jr.

Imbo and Petrone were last seen in the late evening hours of Saturday, February 19, 2005, leaving a bar on Philadelphia’s South Street for Petrone’s black 2001 Dodge Dakota pickup truck. An extensive investigation to date has generated some promising leads; however, neither they nor the vehicle have ever been located.

Soffe Men’s 3 Pack-USA Poly Cotton Military Tee

Danielle Imbo may also use the name Danielle Ottobre. She has a tattoo of flowers on her lower back. Imbo was last seen wearing a dark colored jacket, cream colored sweater, and blue jeans. She wears three small silver rings on either her left or right middle finger. Imbo was carrying a two-handle black purse at the time of her disappearance. She has worked as a loan mortgage processor.

Richard Petrone was last seen wearing a gray Polo brand sweatshirt and blue jeans. He has a tattoo of the word “Angela” on his left arm and a tattoo of clowns on his right arm.

This investigation into Danielle and Rich’s disappearance remains open and active, and there is still a $50,000 reward for information on the couple’s whereabouts or for information leading to the arrest of those responsible for their disappearance. The reward is being administered by the Philadelphia Citizens Crime Commission.

Anyone with information that may assist investigators is urged to call the Citizens Crime Commission tip line at 215-546-TIPS (215-546-8477).

Tipsters can remain anonymous.

FBI.gov (February, 2020) FBI Seeks Information on Disappearance, 15 Years Ago Today, of Danielle Imbo and Richard Petrone, Jr.

Help a veteran in need by donating here.

U.S. Marshal’s Arrest International Murder Fugitive in Reading, PA

Members of the U.S. Marshal’s Fugitive Task Force arrested Felix Aldencis Peguero Mendez, 61, for homicide and related charges, at approximately 3:30 p.m. on February 13th in the 600 block of East Lancaster Avenue in Reading Pennsylvania.

Peguero Mendez was wanted in the Dominican Republic for homicide since February 15, 2012. It is alleged that he shot his wife 6-8 times resulting in her death.

A Foreign Fugitive warrant was issued in the United States in February 2013, and Peguero Mendez had been on the run up and down the Northeast United States.

Soffe Men’s 3 Pack-USA Poly Cotton Military Tee

Early on February 13, 2020, U.S. Marshals from Massachusetts, New Jersey, and Eastern Pennsylvania developed information suggesting Peguero Mendez was currently hiding in Reading, PA.

Investigation determined he was in an unknown associate’s home in the 600 block of East Lancaster Avenue. Members of the Eastern Pennsylvania Fugitive Task Force searched the residence and Peguero Mendez was located and arrested without incident.

Peguero Mendez is currently being housed in federal custody pending an initial appearance before a U.S. Magistrate Judge where he will formally be charged as a foreign fugitive facing extradition back to the Dominican Republic.

Eric Gartner, U.S. Marshal for the Eastern District of Pennsylvania, said “Patience, persistence, and unfettered collaboration between our partner agencies has once again proven to be an unbeatable combination. Special thanks to our Task Force partners with the Berks County Sheriff’s Office, Pennsylvania State Police, New Jersey State Police, and Pennsylvania Board of Probation and Parole in concluding this long-term effort with the safe apprehension of this dangerous fugitive.”

The Eastern Pennsylvania Violent Crimes Fugitive Task Force is a team of law enforcement officers led by U.S. Marshals in Philadelphia and the surrounding counties.

The task force’s objective is to seek out and arrest violent crime fugitives.

USMarshals.gov (February, 2020) U.S. Marshals Arrest International Murder Fugitive in Reading, PA

Help a veteran in need by donating here.

Chicago Woman Found Guilty for Role in $7 Million Scheme to Defraud Medicare

A federal jury found a Chicago woman guilty on Friday for her role in a scheme to defraud Medicare of approximately $7 million between 2011 and 2017.

After a four-day trial, Angelita Newton, 42, was found guilty of one count of conspiracy to commit health care fraud and wire fraud. Sentencing has been scheduled for Oct. 13, 2020 before U.S. District Judge Virginia Kendall of the Northern District of Illinois, who presided over the trial.

According to evidence presented at trial, from approximately 2011 to 2017, Newton worked at Care Specialists, a home health company based in Chicago, Illinois, and owned by Ferdinand Echavia, 46, and Ma Luisa Echavia, 44, both of Chicago. Newton was the Echavias’ employee and personal assistant. In that role, Newton conspired with the Echavias and others to submit claims to Medicare for unnecessary home health services for unqualified patients or for visits that did not happen as billed, the evidence showed.

Newton created and completed visit notes and other documents purporting to reflect nursing services purportedly rendered by Ferdinand Echavia with the knowledge that he was not actually providing the services. Newton was aware that Ferdinand Echavia was making cash payments to patients, which Newton knew to be illegal, the evidence showed.

The evidence at trial showed that between 2011 and 2017, Medicare paid Care Specialists approximately $7 million for home health care services.

Three other defendants have been charged in connection with the fraud at Care Specialists. Ferdinand Echavia pleaded guilty to conspiracy to commit health care fraud and wire fraud on Jan. 28, 2020, and is awaiting sentencing. Ma Luisa Echavia pleaded guilty to conspiracy to commit health care fraud and wire fraud on Jan. 29, 2020, and is awaiting sentencing. A former nurse at Care Specialists, Reginald Onate, 31, of Aurora, Illinois, pleaded guilty to one count of conspiracy to commit health care fraud, and is awaiting sentencing.

Soffe Men’s 3 Pack-USA Poly Cotton Military Tee

This case was investigated by the FBI and HHS-OIG. Trial Attorneys Leslie S. Garthwaite and Patrick Mott of the Criminal Division’s Fraud Section are prosecuting the case. Former Trial Attorney Jessica Collins of the Fraud Section previously handled the prosecution.

Assistant Attorney General Brian A. Benczkowski of the Justice Department’s Criminal Division, U.S. Attorney John R. Lausch Jr. of the Northern District of Illinois, Special Agent in Charge Emmerson Buie Jr. of the FBI’s Chicago Field Office and Special Agent in Charge Lamont Pugh III of the United States Health and Human Services Office of Inspector General’s (HHS-OIG) Chicago Division Office made the announcement.

The Fraud Section leads the Medicare Fraud Strike Force. Since its inception in March 2007, the Medicare Fraud Strike Force, which maintains 15 strike forces operating in 24 districts, has charged more than 4,200 defendants who have collectively billed the Medicare program for nearly $19 billion. In addition, the HHS Centers for Medicare & Medicaid Services, working in conjunction with the HHS-OIG, are taking steps to increase accountability and decrease the presence of fraudulent providers.

Justice.gov (February, 2020) Chicago Woman Found Guilty for Role in $7 Million Scheme to Defraud Medicare

Help a veteran in need by donating here.

Statement by U.S. Department of State and U.S. Department of Health and Human Services on Repatriation of American Passengers from the Diamond Princess Cruise Ship

On February 16, the U.S. State Department facilitated the voluntary repatriation of over 300 U.S. citizens and their immediate family members who had been passengers on the Diamond Princess Cruise ship.

On February 16, the U.S. State Department facilitated the voluntary repatriation of over 300 U.S. citizens and their immediate family members who had been passengers on the Diamond Princess Cruise ship.

Passengers were evaluated by medical personnel from the United States Department of Health and Human Services (HHS), and all were deemed asymptomatic and fit to fly before being processed for evacuation.

During the evacuation process, after passengers had disembarked the ship and initiated transport to the airport, U.S. officials received notice that 14 passengers, who had been tested 2-3 days earlier, had tested positive for Coronavirus (COVID-19).

Soffe Men’s 3 Pack-USA Poly Cotton Military Tee

These individuals were moved in the most expeditious and safe manner to a specialized containment area on the evacuation aircraft to isolate them in accordance with standard protocols.

After consultation with HHS officials, including experts from the HHS Office of the Assistant Secretary for Preparedness and Response, the State Department made the decision to allow the 14 individuals, who were in isolation, separated from other passengers, and continued to be asymptomatic, to remain on the aircraft to complete the evacuation process. During the flights, these individuals will continue to be isolated from the other passengers. These flights departed Japan at approximately 4:30 PM Eastern time on February 16 and will arrive in the United States later this morning.

All passengers are being closely monitored by medical professionals throughout the flight, and any who become symptomatic will be moved to the specialized containment area, where they will be treated.

Upon landing in the United States, passengers will deplane at either Travis AFB or Joint Base San Antonio and will remain under quarantine for 14 days. Passengers that develop symptoms in flight and those with positive test results will remain isolated on the flights and will be transported to an appropriate location for continued isolation and care.

Every precaution to ensure proper isolation and community protection measures are being taken, driven by the most up-to-date risk assessments by U.S. health authorities.

We continue all possible efforts to protect the welfare of U.S. citizens.

Cell Phones and Accessories

We encourage U.S. citizens considering international travel to continue to review State Department Travel Advisories at Travel.State.gov, and to closely monitor and follow the guidance of the CDC and local health authorities.

State.gov (February, 2020) Joint Statement by U.S. Department of State and U.S. Department of Health and Human Services on Repatriation of American Passengers from the Diamond Princess Cruise Ship

Help a veteran in need by donating here.