Dismantling of an Encrypted Network Sends Shock Waves Through Organized Crime Groups Across Europe

At a joint press conference on July 2, 2020, French and Dutch law enforcement and judicial authorities, Europol and Eurojust have presented the impressive results of a joint investigation team to dismantle EncroChat, an encrypted phone network widely used by criminal networks.


At a joint press conference on July 2, 2020, French and Dutch law enforcement and judicial authorities, Europol and Eurojust have presented the impressive results of a joint investigation team to dismantle EncroChat, an encrypted phone network widely used by criminal networks.

Over the last months, the joint investigation made it possible to intercept, share and analyze millions of messages that were exchanged between criminals to plan serious crimes. For an important part, these messages were read by law enforcement in real time, over the shoulder of the unsuspecting senders. 

The information has already been relevant in a large number of ongoing criminal investigations, resulting in the disruption of criminal activities including violent attacks, corruption, attempted murders and large-scale drug transports. Certain messages indicated plans to commit imminent violent crimes and triggered immediate action. The information will be further analyzed as a source of unique insight, giving access to unprecedented volumes of new evidence to profoundly tackle organized criminal networks. 

In recent years, European countries have been increasingly affected by organized crime groups who are pervasive and highly adaptive, posing one of the most pressing security challenges faced by law enforcement and judicial authorities. In this regard, the abuse of the encrypted communication technologies is a key facilitator of their criminal activities.

Since 2017, the French Gendarmerie and judicial authorities have been investigating phones that used the secured communication tool EncroChat, after discovering that the phones were regularly found in operations against organized crime groups and that the company was operating from servers in France. Eventually, it was possible to put a technical device in place to go beyond the encryption technique and have access to the users’ correspondence.

In early 2020, EncroChat was one of the largest providers of encrypted digital communication with a very high share of users presumably engaged in criminal activity. User hot-spots were particularly present in source and destination countries for cocaine and cannabis trade, as well as in money laundering centers.

Given the widespread use of the encrypted telephone solution by EncroChat among international criminal networks around the world, French authorities decided to open a case at Eurojust, the EU Agency for Criminal Justice Cooperation, towards the Netherlands in 2019. Further developments in the investigations led to organizing the processing of the data, which was captured on the basis of the provisions of French law and with judicial authorization, through the frameworks for international judicial and law enforcement cooperation.

The data was in first instance shared with the Netherlands. Eurojust facilitated the creation of a joint investigation team (JIT) between the two countries and with the participation of Europol, the European Union Agency for Law Enforcement Cooperation, in April 2020.

Europol has been actively involved in the investigations led by France and the Netherlands since 2018, relating to the provision and use of encrypted communication services by organized crime groups. Through its role as an information hub and its extensive analytical and technical support system, Europol was able to create and provide a unique and global insight on the scale and functioning of organized crime, as a result of this investigation. This will help law enforcement to combat organized crime in the future more successfully. Europol’s support from the early stages of this JIT included: promoting and arranging international cooperation, providing extensive analytical and financial support, technical expertise and a secured platform for the exchange of information between the countries involved.  A large dedicated team at Europol investigated in real time millions of messages and data that it received from the JIT partners during the investigation, cross-checked and analyzed the data, and provided and coordinated with the JIT partners the information exchange to concerned countries.

A large number of suspects have also been arrested in several countries which were not participating in the JIT but particularly affected by the illegal use of these phones by individuals active in organized crime, including in the UK, Sweden and Norway. Many of these investigations were connected with international drug trafficking and violent criminal activities.

At the same time, numerous operational meetings for the daily coordination between the law enforcement entities of the JIT partners and other countries took place at Europol, partly during COVID-19.

Eurojust intensively facilitated the judicial cooperation, during the extensive use of European judicial cooperation instruments such as European Investigation Orders. Throughout the investigation, the JIT members organized five coordination meetings at Eurojust to bring all involved parties together in a secure environment, identify parallel or linked investigations, decide on the most suitable framework for cooperation and solve potential conflicts of jurisdiction.  

In France, where the operation takes place under the code name “Emma 95”, the Gendarmerie has set-up a Taskforce since March 2020. With more than 60 officers, the Gendarmerie leads the investigations targeting the EncroChat encrypted telephone solution under the supervision of the magistrates of the JIRS of Lille. The Taskforce has been monitoring the communications of thousands of criminals, leading to the opening of a wide range of incidental proceedings. France does not wish to communicate further on these on-going investigations nor on the results obtained. The considerable resources deployed demonstrate the importance of these investigations and the importance attached to their success in France.

In the Netherlands, where the operation went under the code name “Lemont”, hundreds of investigators have, with authorization of the examining magistrate, followed the communications of thousands of criminals day and night since the operation began to unravel and act on the intercepted data stream. The criminal investigation has been led by prosecutors from the Dutch National Public Prosecution Service and the information has been made available to about a hundred ongoing criminal investigations. The investigation has so far led to the arrest of more than 100 suspects, the seizure of drugs (more than 8 000 kilo cocaine and 1 200 kilo crystal meth), the dismantling of 19 synthetic drugs labs, the seizure of dozens of (automatic) fire weapons, expensive watches and 25 cars, including vehicles with hidden compartments, and almost EUR 20 million in cash. The expectation is that information will be made available in more than 300 investigations. In a number of cases, more arrests are very likely to follow in the coming period. 

The interception of EncroChat messages came to an end on 13 June 2020, when the company realized that a public authority had penetrated the platform. EncroChat then sent a warning to all its users with the advice to immediately throw away the phones. 

While the activities on EncroChat have been stopped, this complex operation shows the global scope of serious and organized crime and the connectivity of criminal networks who use advanced technologies to cooperate on a national and international level. The effects of the operation will continue to echo in criminal circles for many years to come, as the information has been provided to hundreds of ongoing investigations and, at the same time, is triggering a very large number of new criminal investigations of organized crime across the European continent and beyond.

WHAT IS ENCROCHAT?

EncroChat phones were presented to customers as guaranteeing perfect anonymity (no device or SIM card association on the customer’s account, acquisition under conditions guaranteeing the absence of traceability) and perfect discretion both of the encrypted interface (dual operating system, the encrypted interface being hidden so as not to be detectable) and the terminal itself (removal of the camera, microphone, GPS and USB port). It also had functions intended to ensure the ‘impunity’ of users (automatic deletion of messages on the terminals of their recipients, specific PIN code intended for the immediate deletion of all data on the device, deletion of all data in the event of consecutive entries of a wrong password), functions that apparently were specially developed to make it possible to quickly erase compromising messages, for example at the time of arrest by the police. In addition, the device could be erased from a distance by the reseller/helpdesk.

EncroChat sold the cryptotelephones (at a cost of around EUR 1 000 each) at international scale and offered subscriptions with a worldwide coverage, at a cost of 1 500 EUR for a six-month period, with 24/7 support.

Blogs to Follow:

Europol.europa.eu (July 2020) DISMANTLING OF AN ENCRYPTED NETWORK SENDS SHOCKWAVES THROUGH ORGANISED CRIME GROUPS ACROSS EUROPE

Nigerian National Brought to U.S. to Face Charges of Conspiring to Launder Hundreds of Millions of Dollars from Cybercrime Schemes

A Dubai resident who flaunted his extravagant lifestyle on social media has arrived in the United States to face criminal charges alleging he conspired to launder hundreds of millions of dollars from business email compromise (BEC) frauds and other scams, including schemes targeting a U.S. law firm, a foreign bank and an English Premier League soccer club.


A Dubai resident who flaunted his extravagant lifestyle on social media has arrived in the United States to face criminal charges alleging he conspired to launder hundreds of millions of dollars from business email compromise (BEC) frauds and other scams, including schemes targeting a U.S. law firm, a foreign bank and an English Premier League soccer club.

Ramon Olorunwa Abbas, 37, a.k.a. “Ray Hushpuppi” and “Hush,” a Nigerian national, arrived in Chicago Thursday evening after being expelled from the United Arab Emirates (UAE). Abbas made his initial U.S. court appearance this morning in Chicago, and he is expected to be transferred to Los Angeles in the coming weeks.

Abbas was arrested last month by UAE law enforcement officials. FBI special agents earlier this week obtained custody of Abbas and brought him to the United States to face a charge of conspiring to engage in money laundering that is alleged in a criminal complaint filed on June 25 by federal prosecutors in Los Angeles.

According to an affidavit filed with the complaint, Abbas maintains social media accounts that frequently showed him in designer clothes, wearing expensive watches, and posing in or with luxury cars and charter jets. “The FBI’s investigation has revealed that Abbas finances this opulent lifestyle through crime, and that he is one of the leaders of a transnational network that facilitates computer intrusions, fraudulent schemes (including BEC schemes), and money laundering, targeting victims around the world in schemes designed to steal hundreds of millions of dollars,” according to the affidavit.

The affidavit describes BEC schemes as often involving a computer hacker gaining unauthorized access to a business’ email account, blocking or redirecting communications to and/or from that email account, and then using the compromised email account or a separate fraudulent email account to communicate with personnel from a victim company and to attempt to trick them into making an unauthorized wire transfer.

“BEC schemes are one of the most difficult cybercrimes we encounter as they typically involve a coordinated group of con artists scattered around the world who have experience with computer hacking and exploiting the international financial system,” said United States Attorney Nick Hanna. “This case targets a key player in a large, transnational conspiracy who was living an opulent lifestyle in another country while allegedly providing safe havens for stolen money around the world. As this case demonstrates, my office will continue to hold such criminals accountable, no matter where they live.”

“In 2019 alone, the FBI recorded $1.7 billion in losses by companies and individuals victimized through business email compromise scams, the type of scheme Mr. Abbas is charged with conducting from abroad,” said Paul Delacourt, the Assistant Director in Charge of the FBI’s Los Angeles Field Office. “While this arrest has effectively taken a major alleged BEC player offline, BEC scams represent the most financially costly type of scheme reported to the FBI. I urge anyone who transfers funds personally or on behalf of a company to educate themselves about BEC so they can identify this insidious scheme before losing sizable amounts of money.”

“This was a challenging case, one that spanned international boundaries, traditional financial systems and the digital sphere,” said Jesse Baker, Special Agent in Charge of the United States Secret Service, Los Angles Field Office. “Technology has essentially erased geographic boundaries leaving trans-national criminal syndicates to believe that they are beyond the reach of law enforcement. The success in this case was the direct result of our trusted partnerships between the Department of Justice and our federal law enforcement colleagues. These partnerships helped dismantle a sophisticated organized crime group who preyed upon unsuspecting businesses. It is thanks to these partnerships that the American people can feel a bit more secure today.”

The affidavit alleges that Abbas and others committed a BEC scheme that defrauded a client of a New York-based law firm out of approximately $922,857 in October 2019. Abbas and co-conspirators allegedly tricked one of the law firm’s paralegals into wiring money intended for the client’s real estate refinancing to a bank account that was controlled by Abbas and the co-conspirators.

The affidavit also alleges that Abbas conspired to launder funds stolen in a $14.7 million cyber-heist from a foreign financial institution in February 2019, in which the stolen money was sent to bank accounts around the world. Abbas allegedly provided a co-conspirator with two bank accounts in Europe that Abbas anticipated each would receive €5 million (about $5.6 million) of the fraudulently obtained funds.

Abbas and others further conspired to launder hundreds of millions of dollars from other fraudulent schemes and computer intrusions, including one scheme to steal £100 million (approximately $124 million) from an English Premier League soccer club, the complaint alleges.

         A criminal complaint contains allegations that a defendant has committed a crime. Every defendant is presumed innocent until and unless proven guilty beyond a reasonable doubt.

If convicted of conspiracy to engage in money laundering, Abbas would face a statutory maximum sentence of 20 years in federal prison.

The FBI led the investigation of Abbas, and the United States Secret Service was also involved and provided substantial assistance. The FBI further thanks the government of the United Arab Emirates and the Dubai Police Department for their substantial assistance.

This case is being prosecuted by Assistant United States Attorneys Anil J. Antony and Joseph B. Woodring of the Cyber and Intellectual Property Crimes Section.  The Criminal Division’s Office of International Affairs provided substantial assistance in this matter.

Blogs to Follow:

Justice.gov (July 2020) Nigerian National Brought to U.S. to Face Charges of Conspiring to Launder Hundreds of Millions of Dollars from Cybercrime Schemes

Is China planning a “Pearl Harbor” Electromagnetic Pulse (EMP) Attack on the US?

Dr. Peter Vincent Pry, the Executive Director of the EMP Task Force on National and Homeland Security and former Chief of Staff of the Congressional EMP Commission, published an informative, as well as a frightening essay, on “The People’s Republic of China Military Doctrine, Plans, and Capabilities for Electromagnetic Pulse (EMP) Attack” against the US and other nations.


Dr. Peter Vincent Pry, the Executive Director of the EMP Task Force on National and Homeland Security and former Chief of Staff of the Congressional EMP Commission, published an informative, as well as a frightening essay, on “The People’s Republic of China Military Doctrine, Plans, and Capabilities for Electromagnetic Pulse (EMP) Attack” against the US and other nations.

In the report, Dr. Peter Vincent Pry said:

China is on the verge of deploying or has already deployed hyper-sonic weapons that could potentially be armed with nuclear or non-nuclear EMP warheads, greatly increasing the threat of surprise attack against U.S. forces in the Pacific and against the United States.

HGVs are boosted by a missile to an altitude of 40-100 kilometers where they skim along the upper atmosphere un-powered, using control surfaces on the glide vehicle to maneuver unpredictably, evading missile defenses, and highly accurately when they descend to target.

HCMs are launched by an aircraft and have engines to power themselves to the upper atmosphere where, like HGVs, they speed toward target evasively and accurately.

Both HGVs and HCMs are capable of extraordinarily high speeds, depending upon design ranging from at least 5 times the speed of sound or 6,200 kilometers per hour to 25,000 kph.

The combination of hyper-sonic speed, a flat non-ballistic trajectory that flies below radar, and maneuverability that frustrates interception and provides for highly accurate delivery, makes HGVs and HCMs an unprecedented threat to strategic stability and the balance of power.

U.S. Strategic Command’s General John Hyten, chief of the nuclear Triad deterrent, in 2018 sounded alarms about developing hyper-sonic weapons threats from China and Russia.

Former chief of U.S. Pacific Command, Admiral Harry Harris, testified to the House Armed Service Committee in February 2018 that “hyper-sonic weapons were one of a range of advanced technologies where China was beginning to outpace the U.S. military, challenging its dominance in the Asia-Pacific region.”

The U.S. should be very concerned about a scenario where China uses nuclear space weapons, perhaps ICBMs and IRBMs with specialized warheads, to quickly sweep the skies of U.S. satellites, even at the risk of losing PRC satellites, which could then be replaced with a surge of satellites launched by China to capture the “high frontier” and cripple U.S. military capabilities.

If China is orbiting nuclear-armed satellites for HEMP surprise attack, this would be one of their deepest and best protected military secrets.

In addition to obvious strategic considerations, the Outer Space Treaty bans orbiting nuclear weapons in space, and China has pursued a long propaganda offensive criticizing the U.S. for “militarizing space” intended to deter the U.S. from orbiting space-based missile defenses and from improving U.S. military capabilities in space.

The full 14-page report can be accessed here.

SecureTheGrid.com (June 2020) The People’s Republic of China Military Doctrine, Plans, and Capabilities for Electromagnetic Pulse (EMP) Attack

Stopping Hackers in Their Tracks

Christian Kight used his computer programming skills to hack into various businesses for money while on parole for previous crimes. Kight downloaded scripts from hacker forums and used them to attack company networks.


FBI Arrests Hacker Who Stole Data from Tech Company

A nightmare scenario for many organizations recently became one Atlanta-based tech company’s reality.

But the steps the company took before and after their sensitive data was stolen by a hacker in 2018 helped the FBI identify and arrest the culprit.

Christian Kight used his computer programming skills to hack into various businesses for money while on parole for previous crimes.

Kight downloaded scripts from hacker forums and used them to attack company networks.

In the case of the Atlanta Company, Kight spent a few weeks hacking into the company’s network, using various tactics to hide his identity.

He then downloaded the data to his own computer and deleted it from the company’s systems.

Once he had the data, Kight emailed the company’s CEO to demand payment in exchange for the data—but he insisted that it wasn’t extortion.

“And no, I’m really NOT an extortionist, I would like to see how much you think it’s worth, and if it’s fair, we’ll leave it at that,” Kight wrote, according to court documents.

But whether you call it extortion or not, stealing data and demanding money to have it returned is illegal.

“The data that he took is really valuable,” said Special Agent Tyson Fowler, who investigated this case out of the FBI’s Atlanta Field Office. “He threatened to release this data if they didn’t pay him the ransom.”

The company contacted the FBI and got to work on both restoring their data and assisting in the investigation. Fortunately, the company had a robust backup system, so employees restored the data within days.

Additionally, the company shared critical information from its network’s access logs and other records, which helped the FBI track the IP address of the hacker. After getting a search warrant based on that information, agents found overwhelming evidence against Kight in his San Clemente, California home.

“In the cyber world, it’s very hard to secure a network to the point that it’s never breachable, but you can make it as difficult as possible to break in,” Fowler said.

If someone does break into a network, having strong activity logging on the network in place beforehand can help authorities track the hacker.

The cooperation from the victim company was critical in this case.

Last December, Kight pleaded guilty to extortion, computer fraud, and wire fraud. He was sentenced in March to more than seven years in prison. 

Fowler said it was clear that Kight was perfecting his hacking skills, and there would have been more victims had he not been caught and prosecuted. Imposing consequences on hackers who do harm to companies and individuals is vital. 

“I’ve arrested people all over the world for these types of crimes,” Fowler explained. “The FBI is uniquely positioned to address these crimes almost anywhere they happen.”

FBI.gov (June 2020) Stopping Hackers in Their Tracks

Fifteen Defendants Plead Guilty to Racketeering Conspiracy in International Cyber Fraud Scheme

Fifteen defendants have pleaded guilty to-date for their roles in a transnational and multi-million dollar scheme to defraud American victims through online auction fraud.


Fifteen defendants have pleaded guilty to-date for their roles in a transnational and multi-million dollar scheme to defraud American victims through online auction fraud.

Four of the guilty pleas took place in the past 24 days before U.S. Magistrate Judge Matthew A. Stinnett of the U.S. District Court for the Eastern District of Kentucky.

Bogdan-Stefan Popescu, 30, of Romania, pleaded guilty on June 11, 2020, to one count of RICO conspiracy.  According to plea documents, Popescu operated a car wash in Bucharest, Romania, where he managed co-conspirators in the RICO enterprise.  From at least December of 2013, Popescu oversaw an operation whereby he knowingly negotiated fraudulently obtained Bitcoin. 

He did so in many ways. 

For example, he would sometimes receive cryptocurrency from co-conspirators who obtained the funds through online fraud scams, transfer the cryptocurrency to other conspirators such as co-defendant Vlad-Călin Nistor. 

He would then direct that Nistor exchange the cryptocurrency for fiat currency, and deposit the fiat currency into bank accounts held in the names of various employees and family members.  According to court documents, in addition to providing money laundering services, Popescu also coordinated the dissemination of tools used to defraud American-based victims, such as the language and photographs for fake advertisements as well as usernames and passwords for IP address anonymizing services.  Popescu also assisted members of the RICO conspiracy by connecting them with other members who could provide call center services—that is, who would impersonate eBay customer service representatives over the phone.

Liviu-Sorin Nedelcu, 34, of Romania, pleaded guilty on June 11, 2020, to one count of RICO conspiracy.  According to court documents, Nedelcu worked in conjunction with others to post advertisements for goods online.  To maintain the appearance of legitimacy, Nedelcu created fictitious entities through which he purported to sell vehicles.  Once Nedelcu and his co-conspirators convinced victims to purchase falsely advertised goods, they sent the victims invoices for payment that appeared to be from legitimate sellers, such as eBay Motors.  Upon receiving payment, Nedelcu and his co-conspirators engaged in a sophisticated money laundering scheme to convert the victim payment into Bitcoin.

Vlad-Călin Nistor, 33, of Romania, pleaded guilty on May 19, 2020, to one count of RICO conspiracy.  According to plea documents, Nistor was the founder and owner of the Romania-based Bitcoin exchange Coinflux Services SRL.  He exchanged cryptocurrency into local fiat currency on behalf of the Romania-based members of the conspiracy, knowing that the Bitcoin represented the proceeds of illegal activity.  According to plea documents for example, Nistor exchanged over $1.8 million worth of Bitcoin for co-defendant Bogdan Popescu.

Beniamin-Filip Ologeanu, 30, of Romania, pleaded guilty on May 19, 2020, to one count of RICO conspiracy.  According to court documents, Ologeanu worked in conjunction with others in the conspiracy to post advertisements for goods to auction websites, including eBay, and sales websites, including Craigslist.  Once Ologeanu or his co-conspirators convinced victims to purchase and provide payment for falsely advertised items, Ologeanu reached out to U.S.-based conspirators to convert the victim payment into other forms of payment and transfer part of it to Ologeanu in Bitcoin.  Ologeanu also purchased fraud proceeds from other co-conspirators, typically in the form of prepaid debit cards, to be laundered by U.S.-based co-conspirators.

“Today’s modern cybercriminals rely on increasingly sophisticated techniques to defraud victims, often masquerading as legitimate businesses,” said Assistant Attorney General Brian A. Benczkowski of the Justice Department’s Criminal Division.  “These guilty pleas demonstrate that the United States will hold accountable foreign and domestic criminal enterprises and their enablers, including crooked bitcoin exchanges that swindle the American public.”

“The guilty pleas announced today are a direct result of the extraordinary cooperation and partnership among law enforcement agencies at the local, state, federal, and international levels,” said U.S. Attorney Robert M. Duncan Jr. for the Eastern District of Kentucky.  “These partnerships helped dismantle a sophisticated organized crime group who preyed upon victims across the United States.  I commend the exceptional work conducted by our law enforcement partners and trial team members who worked diligently to hold these defendants accountable.”                                         

“Through the use of digital currencies and trans-border organizational strategies, this criminal syndicate believed they were beyond the reach of law enforcement,” said Assistant Director Michael D’Ambrosio, U.S. Secret Service, Office of Investigations. “However, as this successful investigation clearly illustrates, with sustained, international cooperation, we can effectively hold cyber criminals accountable for their actions, no matter where they reside. I commend the hard work and perseverance of all those who joined together in this investigation and prosecution. This includes our partners in Europe, as well as those closer to home.”

“Today’s guilty pleas serve as a reminder that IRS-CI special agents will uncover illegal activity here and abroad, pierce the perceived veil of anonymity provided by cryptocurrencies, and bring those responsible for unlawful acts to justice,” said Special Agent in Charge Jonathan Larsen of the IRS-Criminal Investigation (IRS-CI) New York Field Office.  “We will continue to push the agency to the forefront of complex cyber investigations and work collaboratively with our law enforcement partners to ensure the United States financial system is protected.”

“These are scam artists who hide behind a wall of technology which allows them to prey upon innocent victims throughout the United States,” said Kentucky State Police Commissioner Rodney Brewer.  “The dismantling of this criminal enterprise was made possible because of the incredible level of cooperation between the law enforcement community here in Kentucky.”

According to court documents, the defendants participated in a criminal conspiracy that engaged in a large-scale scheme of online auction fraud.  Specifically, Romania-based members of the conspiracy posted false advertisements to popular online auction and sales websites—such as Craigslist and eBay—for high-cost goods (typically vehicles) that did not actually exist.  Members of the conspiracy would convince American victims to send money for the advertised goods by crafting persuasive narratives, for example, by impersonating a military member who needed to sell the advertised item before deployment.

According to court documents, members of the conspiracy created fictitious online accounts to post these advertisements and communicate with victims, often using the stolen identities of Americans to do so.  They also delivered invoices to the victims bearing trademarks of reputable companies in order to make the transaction appear legitimate.  Members of the conspiracy also set up call centers, impersonating customer support, to address questions and alleviate concerns over the advertisements.

Once victims were convinced to send payment, the conspiracy participants engaged in a complicated money laundering scheme wherein domestic associates would accept victim funds, convert these funds to cryptocurrency, and transfer proceeds in the form of cryptocurrency to foreign-based money launderers.

The 15 defendants who have pleaded guilty in this case have yet to be sentenced.  Two other defendants in the case are scheduled for trial starting on Sept. 14, 2020, before the Honorable Robert E. Wier of the U.S. District Court for the Eastern District of Kentucky.  Three others are fugitives.

In addition to pleading guilty in this case, on Jan. 13, 2020, Adrian Mitan pleaded guilty in a related money laundering conspiracy, arising from online schemes, including a credit card phishing and brute-force attack scheme, designed to steal money from Americans.  According to court documents, Mitan phished for payment card information of U.S. customers, hacked into the electronic systems of American businesses, and then conducted a brute-force attack on their point-of-sale systems for the purpose of stealing the remaining payment card information.  Mitan then directed American money launderers to create clone payment cards with the stolen information, which were used to extract money from the customers’ accounts.  These fraudulent proceeds were then returned to Mitan in the form of Bitcoin.

The investigation was conducted by the U.S. Secret Service, Kentucky State Police, Lexington Police Department, IRS Criminal Investigation, and U.S. Postal Inspection Service, and supported by the Justice Department’s Organized Crime Drug Enforcement Task Forces (OCDETF) and the International Organized Crime Intelligence and Operations Center (IOC-2).  Assistance was provided by the Romanian National Police (Service for Combating Cybercrime) and the Romanian Directorate for Investigating Organized Crime and Terrorism (Agency for Prosecuting Organized Crime).  The Criminal Division’s Money Laundering and Asset Recovery Section provided significant support and the Criminal Division’s Office of International Affairs provided significant support in securing and coordinating the arrests and extraditions from Romania of more than a dozen defendants. 

This case is being prosecuted by Senior Trial Attorney Timothy C. Flowers and Senior Counsel Frank H. Lin of the Criminal Division’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorneys Kathryn M. Anderson and Kenneth R. Taylor of the U.S. Attorney’s Office for the Eastern District of Kentucky.

Individuals believing they may be victims of the advanced fee and online auction fraud or brute-force attack schemes described herein are encouraged to visit the following website to obtain more information: https://justice.gov/usao-edky/information-victims-large-cases.  

Tips to avoid becoming a victim of online auction fraud can be found here on the U.S. Secret Service’s website.

Justice.gov (June 2020) Fifteen Defendants Plead Guilty to Racketeering Conspiracy in International Cyber Fraud Scheme