NewzIntel.com

Category: Crime

  • MIL-OSI Canada: CBSA seizes 187.5 kg of cocaine at the Ambassador Bridge leading to criminal charges by the RCMP

    Source: Government of Canada News (2)

    July 22, 2025    Windsor, Ontario    Canada Border Services Agency 

    On May 23, 2025, Canada Border Services Agency (CBSA) border services officers at the Ambassador Bridge port of entry intercepted 187.5 kg of suspected cocaine concealed in the trailer of a commercial truck coming into Canada from the United States. 

    During a secondary examination of the trailer, CBSA officers discovered 2 suitcases and 5 garbage bags containing 161 bricks of suspected cocaine. The approximate value of the cocaine is $23.4 million.  

    CBSA officers seized the drugs and arrested the driver, Kambiz Karandish, 55, of Richmond Hill, Ontario, and transferred him and the suspected cocaine to the custody of the Royal Canadian Mounted Police (RCMP). Karandish has been charged by the RCMP with Importation of Cocaine, and Possession of Cocaine for the Purpose of Trafficking under the Controlled Drugs and Substances Act.

    The CBSA and the RCMP are committed to protecting our communities from harmful contraband and organized crime. 

    The investigation is ongoing. 

    MIL OSI Canada News –

  • MIL-OSI Europe: Eurojust helps catch alleged author of threatening emails to schools in Czechia, Slovakia and Latvia

    Source: European Union 2

    Eurojust has assisted the authorities in the Czech Republic, Slovakia and Latvia with the apprehension of the alleged perpetrator who was responsible for sending thousands of emails in September last year threatening schools with explosions. The mass threats, which were also sent to other educational institutions and leisure centres, caused major public concern and led to the suspension of classes at the beginning of the school year.

    Eurojust supported the national authorities involved by setting up a joint investigation team (JIT) dedicated to the case, as well as providing additional cross-border judicial support.

    The alleged perpetrator also used the social network Telegram to spread his threats. He was apprehended in the Ukrainian city of Dnipro last week but was released pending potential further steps to be taken by the authorities.

    © Dnipropetrovsk Regional Prosecutor’s Office

    Given the mass scale of the threats at the same time across three countries, the police authorities involved coordinated their investigations, assisted by the setting up of the JIT. The joint investigative efforts, using the cybercrime expertise of the police, led to the identification of an alleged perpetrator, operating from the Ukrainian city of Dnipro.

    With the participation of Czech and Slovak police officers, a joint action took place in Dnipro last week, during which the alleged perpetrator was apprehended and one individual was questioned. Furthermore, two locations were searched, which led to the seizure of computer equipment.

    Thanks to the good and close cooperation of all the authorities concerned, the operation was successfully carried out under extremely difficult circumstances, very close to the frontline of the war in Ukraine, with Ukrainian, Czech and Slovak officers exposed to heavy risks.

    Eurojust offered support not only through the establishment of the JIT but also by organising a coordination meeting to prepare for the joint action day in Ukraine. The operation was carried out at the request of and by the following authorities:

    • Czech Republic: High Public Prosecutor’s Office in Prague; National Counterterrorism, Extremism and Cybercrime Agency (NCTEKK)
    • Latvia: Rīga Pārdaugava Prosecution Office; 1st Unit of Cybercrime Enforcement Department of the Central Criminal Police Department of the State Police
    • Slovakia: General Prosecutor´s Office of the Slovak Republic; Police Department West, Anti-Crime Unit, Bureau for Combating Organized Crime of the Presidium of the Police Corps (Police ACU); Counter Terrorism Centre, Presidium of the Police Corps
    • Ukraine: Dnipropetrovsk regional Prosecutor’s Office; Main Department of National Police in Dnipropetrovsk region; Division for Combating Cybercrime in Dnipropetrovsk region of the Cyber Police Department of National Police of Ukraine

    MIL OSI Europe News –

  • MIL-OSI United Kingdom: New Forensic Science Regulator appointed for England and Wales

    Source: United Kingdom – Government Statements

    News story

    New Forensic Science Regulator appointed for England and Wales

    The regulator ensures that the highest standards in forensic science are met across the criminal justice system.

    Dr Marc Bailey has been appointed as the Forensic Science Regulator for England and Wales.

    Dr Bailey is a scientist who has significant regulatory experience. He has held multiple roles within the Medicines and Healthcare products Regulatory Agency (MHRA) and led international research in quality systems and standardisation, including whilst working at the National Physical Laboratory.

    The Forensic Science Regulator is responsible for ensuring that the provision of forensic science services across England and Wales meet the highest standards of quality and integrity. This includes assessing compliance, providing advice to ministers, setting quality standards and ensuring that all forensic science providers adhere to these standards.

    Dr Bailey will work closely with the police, forensic science providers and the legal profession to ensure that forensic science in England and Wales remains at the forefront of innovation and reliability.

    Dr Bailey will officially assume his duties after Gary Pugh’s term concludes on 25 July 2025.

    Crime and Policing Minister Dame Diana Johnson said:

    Dr Bailey is going to bring a wealth of experience and expertise as the new Forensic Science Regulator.

    This pivotal role is essential in ensuring the highest standards of forensic science are upheld.

    By setting rigorous standards and providing robust oversight, the Forensic Science Regulator will continue to ensure that forensic science supports the work of the police, allowing them to investigate crimes and bring justice for victims.

    I’d like to thank Gary Pugh for his previous work in this role.

    Dr Bailey said:

    I am delighted to be appointed to the post of Forensic Science Regulator.

    I look forward to enacting and developing the regulation of Forensic Science and working with the team that support my role to ensure that the criminal justice system has full confidence in forensic science evidence.

    Updates to this page

    Published 22 July 2025

    MIL OSI United Kingdom –

  • MIL-OSI Security: #StopRansomware: Interlock

    Source: US Department of Homeland Security

    Summary

    Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.

    The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Department of Health and Human Services (HHS), and Multi-State Information Sharing and Analysis Center (MS-ISAC)—hereafter referred to as “the authoring organizations”—are releasing this joint advisory to disseminate known Interlock ransomware IOCs and TTPs identified through FBI investigations (as recently as June 2025) and trusted third-party reporting.

    The Interlock ransomware variant was first observed in late September 2024, targeting various business, critical infrastructure, and other organizations in North America and Europe. FBI maintains these actors target their victims based on opportunity, and their activity is financially motivated. FBI is aware of Interlock ransomware encryptors designed for both Windows and Linux operating systems; these encryptors have been observed encrypting virtual machines (VMs) across both operating systems. FBI observed actors obtaining initial access via drive-by download from compromised legitimate websites, which is an uncommon method among ransomware groups. Actors were also observed using the ClickFix social engineering technique for initial access, in which victims are tricked into executing a malicious payload under the guise of fixing an issue on the victim’s system. Actors then use various methods for discovery, credential access, and lateral movement to spread to other systems on the network.

    Interlock actors employ a double extortion model in which actors encrypt systems after exfiltrating data, which increases pressure on victims to pay the ransom to both get their data decrypted and prevent it from being leaked. 

    FBI, CISA, HHS, and MS-ISAC encourage organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of Interlock ransomware incidents.

    Download the PDF version of this report:

    For a downloadable copy of IOCs, see:

    Note: This advisory uses the MITRE ATT&CK® Matrix for Enterprise framework, version 17. See the MITRE ATT&CK Tactics and Techniques section of this advisory for tables mapped to the threat actors’ activity.

    Overview

    Since September 2024, Interlock ransomware actors have impacted a wide range of businesses and critical infrastructure sectors in North America and Europe. These actors are opportunistic and financially motivated in nature and employ tactics to infiltrate and disrupt the victim’s ability to provide their essential services. 

    Interlock actors leverage a double extortion model, in which they both encrypt and exfiltrate victim data. Ransom notes do not include an initial ransom demand or payment instructions; instead, victims are provided with a unique code and are instructed to contact the ransomware group via a .onion URL through the Tor browser. To date, Interlock actors have been observed encrypting VMs, leaving hosts, workstations, and physical servers unaffected; however, this does not mean they will not expand to these systems in the future. To counter Interlock actors’ threat to VMs, enterprise defenders should implement robust endpoint detection and response (EDR) tooling and capabilities.

    The authoring agencies are aware of emerging open-source reporting detailing similarities between the Rhysida and Interlock ransomware variants.1 For additional information on Rhysida ransomware, see the joint advisory, #StopRansomware: Rhysida Ransomware.

    Initial Access

    FBI has observed Interlock actors obtaining initial access [TA0001] via drive-by download [T1189] from compromised legitimate websites, an atypical method for ransomware actors. Interlock ransomware methods for initial access have previously disguised malicious payloads as fake Google Chrome or Microsoft Edge browser updates, though a cybersecurity company recently reported a shift to payload filenames masquerading as updates for common security software (see Table 5 for a list of filenames).2

    In some instances, FBI has observed Interlock actors using the ClickFix social engineering technique, in which unsuspecting users are prompted to execute a malicious payload by clicking a fake Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA) [T1189]. The CAPTCHA contains instructions for users to open the Windows Run window, paste the clipboard contents, and then execute a malicious Base64-encoded PowerShell process [T1204.004].3

    Note: This ClickFix technique has been used in several other malware campaigns, including Lumma Stealer and DarkGate.4

    Execution and Persistence

    Based on FBI investigations, the fake Google Chrome browser executable functions as a remote access trojan (RAT) [T1105] designed to execute a PowerShell script [T1059.001] that drops a file into the Windows Startup folder. From there, the file is designed to run the RAT every time the victim logs in [T1547.001], establishing persistence [TA0003]. 

    FBI also observed instances in which Interlock actors executed a PowerShell command designed to establish persistence via a Windows Registry key modification [T1547.001]. To do so, Interlock actors used a PowerShell command [T1059.001] designed to add a run key value named “Chrome Updater” [T1036.005] that uses a specific log file as an argument upon user login.

    Reconnaissance

    To facilitate reconnaissance, a PowerShell script executes a series of commands [T1059.001] designed to gather information on victim machines (see Table 1).

    Table 1. PowerShell Commands for Reconnaissance
    PowerShell Command Description
    WindowsIdentity.GetCurrent() Returns a WindowsIdentity object that represents the current Windows user [T1033].
    systeminfo Displays detailed configuration information [T1082] about a computer and its operating system, including operating system configuration, security information, product ID, and hardware properties.
    tasklist/svc Lists unabridged service information [T1007] for each process currently running on the local computer.
    Get-Service Gets objects that represent the services [T1007] on a computer, including running and stopped services.
    Get-PSDrive

    Gets the drives [T1082] in the current session, such as:

    • Windows logical drives on the computer, including drives mapped to network shares.
    • Drives exposed by PowerShell providers.
    • Session-specified temporary drives and persistent mapped network drives.
       
    arp -a Displays and modifies entries in the Address Resolution Protocol (ARP) cache table [T1016], which contains entries on the IPv4 and IPv6 addresses on host endpoints.

    Command and Control

    FBI observed Interlock actors using command and control (C2) [TA0011] applications like Cobalt Strike and SystemBC. Interlock actors also used Interlock RAT5 and NodeSnake RAT (as of March 2025)6 for C2 and executing commands.

    Credential Access, Lateral Movement, and Privilege Escalation

    FBI observed that once Interlock actors establish remote control of a compromised system, they use a series of PowerShell commands to download a credential stealer (cht.exe) [TA0006] and keylogger binary (klg.dll) [T1056.001],[T1105]. According to open source reporting, the credential stealer collects login information and associated URLs for victims’ online accounts [T1555.003], while the keylogger dynamic link library (DLL) logs users’ keystrokes in a file named conhost.txt [T1036.005].7 As of February 2025, private cybersecurity analysts also observed Interlock ransomware infections executing different versions of information stealers [TA0006], including Lumma Stealer8 and Berserk Stealer, to harvest credentials for lateral movement and privilege escalation [T1078].9

    Interlock actors leverage compromised credentials and Remote Desktop Protocol (RDP)10 [T1021.001] to move between systems. They also use tools like AnyDesk to enable remote connectivity and PuTTY to assist with lateral movement [T1219].11 In addition to stealing users’ online credentials, Interlock actors have compromised domain administrator accounts (possibly by using a Kerberoasting attack [T1558.003])12 to gain additional privileges [T1078.002]. 

    Collection and Exfiltration

    Interlock actors leverage Azure Storage Explorer (StorageExplorer.exe) to navigate victims’ Microsoft Azure Storage accounts [T1530] prior to exfiltrating data. According to open source reporting, Interlock actors execute AzCopy to exfiltrate data by uploading it to the Azure storage blob [T1567.002].13 Interlock actors also exfiltrate data over file transfer tools, including WinSCP [T1048].

    Impact

    Following data exfiltration, Interlock actors deploy the encryption binary as a 64-bit executable named conhost.exe [T1486],[T1036.005]. FBI has observed Interlock ransomware encryptors for both Windows and Linux operating systems. Encryptors are designed to encrypt files using a combined Advanced Encryption Standard (AES) and Rivest-Shamir-Adleman (RSA) algorithm. In addition, cybersecurity researchers have identified Interlock ransomware samples using a FreeBSD ELF encryptor [T1486], a departure from usual Linux encryptors designed for VMware ESXi servers and VMs.14

    A cybersecurity company identified a DLL binary named tmp41.wasd—executed after encryption using rundll32.exe [T1218.011]—which uses the remove() function to delete the encryption binary [T1070.004];15 on Linux machines, the encryptor uses a similar technique to execute the removeme function. 

    Encrypted files are appended with either a .interlock or .1nt3rlock file extension, alongside a ransom note titled !__README__!.txt delivered via group policy object (GPO). Interlock actors use a double-extortion model [T1657], encrypting systems after exfiltrating data. The ransom note provides each victim with a unique code and instructions to contact the ransomware actors via a .onion URL. 

    Interlock actors do not leave an initial ransom demand or payment instructions on compromised networks, and do not relay this information until contacted by the victim. The actors instruct victims to make ransom payments in Bitcoin to cryptocurrency wallet addresses provided by the actors. The actors threaten to publish the victim’s exfiltrated data to their leak site on the Tor network unless the victim pays the ransom demand; the actors have previously followed through on this threat.16

    See Table 2 for publicly available tools and applications used by Interlock ransomware actors. This includes legitimate tools repurposed for their operations.

    Disclaimer: Use of these tools and applications should not be attributed as malicious without analytical evidence to support threat actor use and/or control.

    Table 2. Tools Used by Interlock Ransomware Actors
    Tool Name Description
    AnyDesk A common legitimate remote monitoring and management (RMM) tool maliciously used by Interlock actors to obtain remote access and maintain persistence. AnyDesk also supports remote file transfer.
    Cobalt Strike A penetration testing tool used by security professionals to test the security of networks and systems.
    PowerShell A cross-platform task automation solution made up of a command-line shell, a scripting language, and a configuration management framework, which runs on Windows, Linux, and macOS.
    PSExec A tool designed to run programs and execute commands on remote systems.
    PuTTY.exe An open source file transfer application commonly used to remotely connect to systems via Secure Shell (SSH). PuTTY also supports file transfer protocols like Secure File Transfer Protocol (SFTP) and Secure Copy Protocol (SCP).
    ScreenConnect A remote support, access, and meeting software that allows users to control devices remotely over the internet. CISA observed Interlock actors using a cracked version of this software in at least one incident. These versions may be standalone versions not connecting to ScreenConnect’s official cloud domains (domains available upon request from ConnectWise).
    SystemBC Enables Interlock actors to compromise systems, run commands, download malicious payloads, and act as a proxy tool to the actors’ C2 servers.
    Windows Console Host Windows Console Host (conhost.exe) manages the user interface for command-line applications in Windows, including Command Prompt and PowerShell. 
    WinSCP A free and open source SSH File Transfer Protocol (FTP), WebDAV, Amazon S3, and secure copy protocol client.

    See Table 3 and Table 4 for files used by Interlock ransomware actors. These were obtained from FBI investigations as recently as June 2025.

    Disclaimer: Some of the hashes are for legitimate tools and applications and should not be attributed as malicious without analytical evidence to support threat actor use and/or control. The authoring agencies recommend organizations investigate or vet these hashes prior to taking action, such as blocking.

    Table 3. Files Used by Interlock Ransomware Actors (SHA-256)
    File Name Hash
    1.ps1 fba4883bf4f73aa48a957d894051d78e0085ecc3170b1ff50e61ccec6aeee2cd 
    advanced_port_scanner.exe 4b036cc9930bb42454172f888b8fde1087797fc0c9d31ab546748bd2496bd3e5
    Aisa.exe 18a507bf1c533aad8e6f2a2b023fbbcac02a477e8f05b095ee29b52b90d47421
    AnyDesk.exe 1a70f4eef11fbecb721b9bab1c9ff43a8c4cd7b2cafef08c033c77070c6fe069
    autoservice.dll a4069aa29628e64ea63b4fb3e29d16dcc368c5add304358a47097eedafbbb565
    Autostart.exe d535bdc9970a3c6f7ebf0b229c695082a73eaeaf35a63cd8a0e7e6e3ceb22795
    cht FAFCD5404A992850FFCFFEE46221F9B2FF716006AECB637B80E5CD5AA112D79C
    cht.exe C20BABA26EBB596DE14B403B9F78DDC3C13CE9870EEA332476AC2C1DD582AA07
    cleanup.dll (SystemBC) 1845a910dcde8c6e45ad2e0c48439e5ab8bbbeb731f2af11a1b7bbab3bfe0127
    conhost 44887125aa2df864226421ee694d51e5535d8c6f70e327e9bcb366e43fd892c1
    conhost.dll a70af759e38219ca3a7f7645f3e103b13c9fb1db6d13b68f3d468b7987540ddf
    conhost.dll 96babe53d6569ee3b4d8fc09c2a6557e49ebc2ed1b965abda0f7f51378557eb1
    difxepi.dll (SystemBC) 1845a910dcde8c6e45ad2e0c48439e5ab8bbbeb731f2af11a1b7bbab3bfe0127
    iexplore.exe d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb
    klg.dll A4F0B68052E8DA9A80B70407A92400C6A5DEF19717E0240AC608612476E1137E
    !!!OPEN_ME!!!.txt 68A49D5A097E3850F3BB572BAF2B75A8E158DADB70BADDC205C2628A9B660E7A
    processhacker-2.39-bin.zip 88f26f3721076f74996f8518469d98bf9be0eaee5b9eccc72867ebfc25ea4e83
    PsExec.exe 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b
    putty.exe 7a43789216ce242524e321d2222fa50820a532e29175e0a2e685459a19e09069
    puttyportable.exe 97931d2e2e449ac3691eb526f6f60e2f828de89074bdac07bd7dbdfd51af9fa0
    PuTTYPortable.zip ff7ad2376ae01e4b3f1e1d7ae630f87b8262b5c11bc5d953e1ac34ffe81401b5
    qrpce91.exe.asd 64a0ab00d90682b1807c5d7da1a4ae67cde4c5757fc7d995d8f126f0ec8ae983
    ScreenConnect.ClientService.exe 2814b33ce81d2d2e528bb1ed4290d665569f112c9be54e65abca50c41314d462
    SophosendpointAgent.exe f51b3d054995803d04a754ea3ff7d31823fab654393e8054b227092580be43db
    SophosScaner.exe dfb5ba578b81f05593c047f2c822eeb03785aecffb1504dcb7f8357e898b5024
    Starship.exe 94bf0aba5f9f32b9c35e8dfc70afd8a35621ed6ef084453dc1b10719ae72f8e2
    start 28c3c50d115d2b8ffc7ba0a8de9572fbe307907aaae3a486aabd8c0266e9426f
    start.exe 70bb799557da5ac4f18093decc60c96c13359e30f246683815a512d7f9824c8f
    StorageExplorer.exe 73a9a1e38ff40908bcc15df2954246883dadfb991f3c74f6c514b4cffdabde66
    Sysmon.sys 1d04e33009bcd017898b9e1387e40b5c04279c02ebc110f12e4a724ccdb9e4fb
    upd_2327991.exe 7b9e12e3561285181634ab32015eb653ab5e5cfa157dd16cdd327104b258c332
    webujgd.lnk 70EE22D394E107FBB807D86D187C216AD66B8537EDC67931559A8AEF18F6B5B3
    WinSCP-6.3.5-Setup.exe 8eb7e3e8f3ee31d382359a8a232c984bdaa130584cad11683749026e5df1fdc3
    Proxy Tool e4d6fe517cdf3790dfa51c62457f5acd8cb961ab1f083de37b15fd2fddeb9b8f
    Encryptor e86bb8361c436be94b0901e5b39db9b6666134f23cce1e5581421c2981405cb1
    Encryptor c733d85f445004c9d6918f7c09a1e0d38a8f3b37ad825cd544b865dba36a1ba6
    Encryptor 28c3c50d115d2b8ffc7ba0a8de9572fbe307907aaae3a486aabd8c0266e9426f
    Table 4. Files Used by Interlock Ransomware Actors (SHA-1)
    File Name Hash
    autorun.log 514946a8fc248de1ccf0dbeee2108a3b4d75b5f6
    jar.jar b625cc9e4024d09084e80a4a42ab7ccaa6afb61d
    pack.jar 3703374c9622f74edc9c8e3a47a5d53007f7721e

    See Table 5 through Table 16 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.

    Table 5. Initial Access
    Technique Title ID Use
    Drive-By Compromise T1189

    Interlock actors obtain initial access by compromising a legitimate website that network users visit, or by disguising malicious payloads as fake browser updates or common security software, including the following:17

    • FortiClient.exe
    • Ivanti-Secure-Access-Client.exe
    • GlobalProtect.exe
    • Webex.exe
    • AnyConnectVPN.exe
    • Cisco-Secure-Client.exe
    • zyzoom_antimalware.exe

    Interlock actors also gain access via the ClickFix social engineering technique, in which users are tricked into executing a malicious payload by clicking on a fake CAPTCHA that prompts users to execute a malicious PowerShell script. 
     
    Table 6. Execution
    Technique Title ID Use
    Command and Scripting Interpreter: PowerShell T1059.001 

    Interlock actors implement PowerShell scripts to drop a malicious file into the Windows Startup folder.

    Interlock actors execute a PowerShell command for registry key modification.

    Interlock actors use a PowerShell script to execute a series of commands to facilitate reconnaissance.
    User Execution: Malicious Copy and Paste T1204.004 Via the ClickFix social engineering technique, users are tricked into clicking a fake CAPTCHA and prompted into executing a malicious Base64-encoded PowerShell process by following instructions to open a Windows Run window (Windows Button + R), pasting clipboard contents (“CTRL + V”), and then executing the malicious script (“Enter”).
    Table 7. Persistence
    Technique Title ID Use
    Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder T1547.001

    Interlock actors establish persistence by adding a file into a Windows StartUp folder that executes a RAT every time a user logs in.

    Interlock actors also implement registry key modification by using a PowerShell command to add a run key value (named “Chrome Updater”) that uses a log file as an argument every time a user logs in.
     
    Table 8. Privilege Escalation
    Technique Title ID Use
    Valid Accounts: Domain Accounts T1078.002 Interlock actors compromise domain administrator accounts to gain additional privileges. 
    Table 9. Defense Escalation
    Technique Title ID Use
    Defense Evasion TA0005 Interlock actors execute the removeme function on Linux systems to delete the encryption binary for defense evasion. 
    Masquerading: Match Legitimate Resource Name or Location T1036.005

    Interlock actors disguise a malicious run key value by naming it “Chrome Updater”; the run key value uses a specific log file as an argument upon user login.

    Interlock actors disguise files of keystrokes logged by one of their credential stealers with a legitimate Windows filename: conhost.txt.

    Interlock actors disguise an encryption binary, a 64-bit executable, by giving it the same name as the legitimate Console Windows Host executable: conhost.exe
    System Binary Proxy Execution: Rundll32 T1218.011 Interlock actors use rundll32.exe to proxy execution of a malicious DLL binary tmp41.wasd. 
    Indicator Removal: File Deletion T1070.004 Interlock actors execute a DLL binary tmp41.wasd that uses the remove() function to delete their encryption binary for defense evasion. 
    Table 10. Credential Access
    Technique Title ID Use
    Credential Access TA0006 Interlock actors download credential stealer cht.exe and execute other versions information stealers (including Lumma Stealer and Berserk Stealer) to harvest credentials.
    Credentials from Password Stores: Credentials from Web Browsers T1555.003 Interlock actors download a credential stealer that collects login information and associated URLs for victims’ online accounts.
    Input Capture T1056 Interlock actors execute Lumma Stealer and Berserk Stealer information stealers on victim systems.
    Input Capture: Keylogging T1056.001 Interlock actors download klg.dll, a keylogger binary, onto compromised systems, where it logs users’ keystrokes in a file named conhost.txt. 
    Steal or Forge Kerberos Tickets: Kerberoasting T1558.003 Interlock actors possibly use a Kerberoasting attack to compromise domain administrator accounts. 
    Table 11. Discovery
    Technique Title ID Use
    System Owner/User Discovery T1033 Interlock actors execute a PowerShell command WindowsIdentity.GetCurrent() on victim systems to retrieve a WindowsIdentity object that represents the current Windows user.
    System Information Discovery T1082

    Interlock actors execute a PowerShell command systeminfo on victim systems to access detailed configuration information about the system, including OS configuration, security information, product ID, and hardware properties.

    Interlock actors execute a PowerShell command Get-PSDrive on victim systems to discover the drives in the current session, such as: 

    • Windows logical drives on the computer, including drives mapped to network shares.
    • Drives exposed by PowerShell providers.
    • Session-specified temporary drives and persistent mapped network drives.
    System Service Discovery T1007

    Interlock actors execute a PowerShell command tasklist /svc on victim systems that lists service information for each process currently running on the system. 

    Actors also execute a PowerShell command Get-Service on victim systems that retrieves objects that represent the services (including running and stopped services) on the system.
    System Network Configuration Discovery T1016 Interlock actors execute a PowerShell command arp -a on victim systems that displays and modifies entries in the Address Resolution Protocol (ARP) cache table (which contains entries on the IPv4 and IPv6 addresses on host endpoints).
    Table 12. Lateral Movement
    Technique Title ID Use
    Valid Accounts T1078 Interlock actors harvest and abuse valid credentials for lateral movement and privilege escalation.
    Remote Services: Remote Desktop Protocol T1021.001 Interlock actors use RDP and valid credentials to move laterally between systems.
    Table 13. Collection
    Technique Title ID Use
    Data from Cloud Storage T1530 Interlock actors use StorageExplorer.exe, the cloud storage solution Azure Storage Explorer, to explore Microsoft Azure Storage accounts. 
    Table 14. Command and Control
    Technique Title ID Use
    Command and Control TA0011 Interlock actors use applications Cobalt Strike and SystemBC for C2. 
    Ingress Tool Transfer T1105

    Interlock actors use a fake Google Chrome or Microsoft Edge browser update to cause users to execute a RAT on the victimized system.

    Interlock actors download credential stealers (cht.exe) and keylogger binaries (klg.dll) once actors establish remote control of a compromised system. 
    Remote Access Tools T1219 Interlock actors use legitimate remote access tools such as AnyDesk to enable remote connectivity and PuTTY to assist with lateral movement.
    Table 15. Exfiltration
    Technique Title  ID Use
    Exfiltration Over Web Service: Exfiltration to Cloud Storage T1567.002 Interlock actors exfiltrate data to cloud storage by executing AzCopy to upload data to the Azure storage blob.
    Exfiltration Over Alternative Protocol T1048 Interlock actors use file transfer tools like WinSCP to exfiltrate data.
    Table 16. Impact
    Technique Title  ID Use
    Data Encrypted for Impact T1486

    Interlock actors encrypt victim data using a combined AES and RSA algorithm on compromised systems to interrupt availability to system and network resources. Actors code encryptors using C/C++. Interlock actors use encryptors for both Windows and Linux operating systems. 

    Interlock actors also use a FreeBSD ELF encryptor to encrypt victim data. 
    Financial Theft   T1657 Interlock actors deliver a ransom note titled !__README__!.txt via a GPO which provides victims with instructions to use a .onion URL to contact the actors over the Tor network. Actors use a double-extortion model, both encrypting victim data and threatening release of victim data on their Tor network leak site if the ransom is not paid.

    The authoring agencies recommend organizations implement the mitigations below to improve your organization’s cybersecurity posture on the basis of the Interlock ransomware actors’ activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats and TTPs. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections.

    In addition to the below mitigations, Healthcare and Public Health (HPH) organizations should use HPH Sector CPGs to implement cybersecurity protections to address the most common threats and TTPs used against this sector.

    At-risk organizations should implement the following mitigations:

    • Prevent Interlock ransomware actors from obtaining initial access:
      • Implement domain name system (DNS) filtering to block users from accessing malicious sites and applications.
      • Implement web access firewalls to mitigate and prevent unknown commands or process injection from malicious domains or websites.
      • Train users [CPG 2.I] to identify, avoid, and report social engineering attempts.
    • Implement a recovery plan [CPG 5.A] to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location (e.g., hard drive, storage device, the cloud) [CPG 2.R].
    • Require all accounts with password logins (e.g., service accounts, admin accounts, and domain admin accounts) to comply with NIST password standards.
      • Require employees to use long passwords [CPG 2.B] and consider not requiring recurring password changes, as these can weaken security.
    • Require MFA [CPG 2.H] for all services to the extent possible, particularly for webmail, virtual private networks (VPNs), and accounts that access critical systems.
      • Implement ICAM policies across the organization as a precursor to MFA.
    • Keep all operating systems, software, and firmware up to date; prioritize patching known exploited vulnerabilities in internet-facing systems [CPG 1.E].
      • Timely patching is efficient and cost effective for minimizing an organization’s exposure to cybersecurity threats.
    • Implement robust EDR capabilities on VMs, systems, and networks.
    • Segment networks [CPG 2.F] to prevent the spread of ransomware.
      • Network segmentation can help prevent the spread of ransomware by controlling traffic flows between—and access to—various subnetworks and by restricting adversary lateral movement.
    • Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware [CPG 3.A] with a networking monitoring tool [CPG 2.T].
      • To aid in detecting ransomware, implement a tool that logs and reports all network traffic, including lateral movement activity on a network.
      • Implement EDR tools; these are useful for detecting lateral connections as they provide insight into common and uncommon network connections for each host.
    • Filter network traffic by preventing unknown or untrusted origins from accessing remote services on internal systems.
      • This prevents threat actors from directly connecting to remote access services that they have established for persistence.
    • Install, regularly update, and enable real time detection for antivirus software on all hosts.
    • Review domain controllers, servers, workstations, and active directories for new and/or unrecognized accounts.
    • Audit user accounts with administrative privileges and configure access controls according to the principle of least privilege [CPG 2.E].
    • Disable unused ports.
    • Consider adding an email banner to emails received from outside of your organization [CPG 2.M].
    • Disable hyperlinks in received emails.
    • Implement time-based access for accounts set at the admin level and higher; for example, the just-in-time (JIT) access method provisions privileged access when needed and can support enforcement of the principle of least privilege (as well as the Zero Trust model):
      • This is a process where a network-wide policy is set in place to automatically disable admin accounts at the Active Directory level when the account is not in direct need.
      • Individual users may submit their requests through an automated process that grants them access to a specified system for a set timeframe when they need to support the completion of a certain task.
    • Disable command line and scripting activities and permissions [CPG 2.N].
      • Disabling software utilities that run from the command line makes it more difficult for threat actors to escalate privileges and move laterally.
    • Maintain offline backups of data and regularly maintain backups and restorations [CPG 2.R]; this avoids severe service interruption and irretrievable data in the event of a compromise.
    • Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted), and covers the entire organization’s data infrastructure [CPG 2.R].

    In addition to applying mitigations, the authoring agencies recommend exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory. The authoring agencies recommend testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.

    To get started:

    1. Select an ATT&CK technique described in this advisory (see Table 5 through Table 16).
    2. Align your security technologies against the technique.
    3. Test your technologies against the technique.
    4. Analyze your detection and prevention technologies’ performance.
    5. Repeat the process for all security technologies to obtain a set of comprehensive performance data.
    6. Tune your security program, including people, processes, and technologies, based on the data generated by this process.

    The authoring agencies recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.

    Your organization has no obligation to respond or provide information back to FBI in response to this joint advisory. If, after reviewing the information provided, your organization decides to provide information to FBI, reporting must be consistent with applicable state and federal laws.

    FBI is interested in any information that can be shared, to include boundary logs showing communication to and from foreign IP addresses, a sample ransom note, communications with threat actors, Bitcoin wallet information, decryptor files, and/or a benign sample of an encrypted file.

    Additional details of interest include a targeted company point of contact, status and scope of infection, estimated loss, operational impact, transaction IDs, date of infection, date detected, initial attack vector, and host- and network-based indicators.

    The authoring agencies do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, FBI and CISA urge you to promptly report ransomware incidents to FBI’s Internet Crime Complain Center (IC3), a local FBI Field Office, or CISA via the agency’s Incident Reporting System or its 24/7 Operations Center (contact@mail.cisa.dhs.gov) or by calling 1-844-Say-CISA (1-844-729-2472).

    State, local, tribal, and territorial governments should report incidents to the MS-ISAC (SOC@cisecurity.org or 866-787-4722).

    HPH Sector organizations should report incidents to FBI or CISA but also can reach out to HHS at HHScyber@hhs.gov for cyber incident support focused on mitigating adverse patient impacts.

    The information in this report is being provided “as is” for informational purposes only. The authoring agencies do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favor by the authoring agencies. 

    Cisco Talos contributed to this advisory.

    July 22, 2025: Initial version.

    1 Elio Biasiotto, et. al., “Unwrapping the Emerging Interlock Ransomware Attack,” Talos Intelligence (blog), Cisco Talos, last modified November 7, 2024, https://blog.talosintelligence.com/emerging-interlock-ransomware/.

    2 Sekoia Threat Detection and Research team, “Interlock Ransomware Evolving Under the Radar,” Sekoia (blog), Sekoia, last modified April 16, 2025, https://blog.sekoia.io/interlock-ransomware-evolving-under-the-radar/.

    3 Yashvi Shah and Vignesh Dhatchanamoorthy, “ClickFix Deception: A Social Engineering Tactic to Deploy Malware,” McAfee Labs (blog), McAfee,last modified June 11, 2024, https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clickfix-deception-a-social-engineering-tactic-to-deploy-malware/ and “HC3 Sector Alert: ClickFix Attacks,” Health Sector Cybersecurity Coordination Center, Department of Health and Human Services, last modified October 29, 2024, https://www.hhs.gov/sites/default/files/clickfix-attacks-sector-alert-tlpclear.pdf.

    4 Shah, “ClickFix Deception: A Social Engineering Tactic to Deploy Malware.”

    5 Sekoia Threat Detection and Research team, “Interlock Ransomware Evolving Under the Radar.”

    6 Bill Toulas, “Interlock Ransomware Gang Deploys New NodeSnake RAT on Universities,“ Bleeping Computer, May 28, 2025, https://www.bleepingcomputer.com/news/security/interlock-ransomware-gang-deploys-new-nodesnake-rat-on-universities/.

    7 Biasiotto, “Unwrapping the Emerging Interlock Ransomware Attack.”

    8 International law-enforcement and Microsoft took down the Lumma Stealer malware in May 2025 by seizing internet domains the actors used to distribute the malware to actors and taking down domains that hosted the malware’s infrastructure. For more information, see Tara Seals, “Lumma Stealer Takedown Reveals Sprawling Operation,” Dark Reading, May 21, 2025, https://www.darkreading.com/cybersecurity-operations/lumma-stealer-takedown-sprawling-operation, and Steven Masada, “Disrupting Lumma Stealer: Microsoft Leads Global Action Against Favored Cybercrime Tool,” Microsoft On the Issues (blog), Microsoft, last modified May 21, 2025, https://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/.

    9 Sekoia Threat Detection and Research team, “Interlock Ransomware Evolving Under the Radar.”

    10 Biasiotto, “Unwrapping the Emerging Interlock Ransomware Attack.”

    11 Biasiotto, “Unwrapping the Emerging Interlock Ransomware Attack.”

    12 Biasiotto, “Unwrapping the Emerging Interlock Ransomware Attack.”

    13 Biasiotto, “Unwrapping the Emerging Interlock Ransomware Attack.”

    14 Lawrence Abrams, “Meet Interlock — The New Ransomware Targeting FreeBSD Servers,” Bleeping Computer, November 3, 2024, https://www.bleepingcomputer.com/news/security/meet-interlock-the-new-ransomware-targeting-freebsd-servers/.

    15 Biasiotto, “Unwrapping the Emerging Interlock Ransomware Attack.”

    16 Graham Cluley, “Interlock Ransomware: What You Need to Know,” Fortra (blog), Fortra, last modified May 30, 2025, https://www.tripwire.com/state-of-security/interlock-ransomware-what-you-need-know.

    17 Sekoia Threat Detection and Research team, “Interlock Ransomware Evolving Under the Radar.”

    MIL Security OSI –

  • MIL-OSI Submissions: Dog thefts: what really happened during the COVID pandemic

    Source: The Conversation – UK – By Daniel Allen, Animal Geographer, Keele University

    smrm1977/Shutterstock

    Dog theft can be a devastating crime. During the COVID pandemic, newspapers suggested there was an epidemic of “dognapping” in the UK. If you have a dog, the reports may have alarmed you at a time when there were already many reasons to feel afraid.

    There are mixed views on whether or not lockdown triggered an increase in dog ownership. Animal welfare charity Battersea attributed a 53% increase in dog adoption to lockdown, and online pet adoption service Pets4Homes said in their 2022 report that demand for puppies rose 104% at the peak of lockdown in May 2020.

    But animal charity PDSA said its survey data pointed to a gradual increase in dog ownership since 2011 rather than a dramatic surge during lockdown. However, we do know lockdown saw inflated prices for dogs, with some fashionable breeds going for £9,000.

    In terms of criminal activity, social distancing restrictions seemed to lead to a decline in some forms of crime, including shoplifting and burglary. But many media outlets reported the number of dog thefts had increased up to 250% during the pandemic.

    Get your news from actual experts, straight to your inbox. Sign up to our daily newsletter to receive all The Conversation UK’s latest coverage of news and research, from politics and business to the arts and sciences.

    We wanted to explore if the data supported claims of a dognapping epidemic and whether patterns in dog theft could suggest ways to help reduce it. Our recent study found new insights into dog theft patterns and showed the situation was more complicated than it seemed at first glance.

    Under the Theft Act 1968, dog theft is not a specific offence. It comes under other theft offences, such as burglary or theft from a person.

    This means police records on dog theft were not included in crime statistics. The only way to access such information is through Freedom of Information (FOI) requests to individual police forces. There are 45 territorial and three special police forces in the UK, and each has its own reporting and recording practices.

    Although police FOI data for dog theft must be approached with caution, it is useful. Previous studies exploring police FOI data found an upward trend in recorded dog thefts in England and Wales: rising nearly 20% from 2015 (1,545) to 2018 (1,849) for 41 police forces combined; and up 3.5% year on year from 2019 (1,452) to 2020 (1,504) for 33 police forces.

    DogLost, a UK online community for reuniting lost and stolen dogs with their owners, reported a 170% increase in stolen dogs (with Crime Reference Numbers) registered on their website in 2020 (465), compared to 2019 (172). This figure was widely quoted as a national increase “since lockdown started” by the media.

    The 250% increase figure first quoted in December 2020 was actually a comparison of two seven-month periods (January-July 2019 and 2020) for only one police force.

    Patterns and trends

    Our study found the data for the period covering the COVID pandemic is also incomplete. Data was provided by 32 forces (71%) for 2020, by 27 forces (60%) for 2021, and 23 forces (51%) for 2022.

    Patterns and trends do, however, emerge. Between 2020 and 2022, the available data shows a 3.7% rise in dog thefts in the UK, from 1,573 to 1,631. When making adjustments for the number of police forces providing data (which decreased over the period), the estimated national figures suggest there may have been more significant rise of up to 44.2%.

    While we cannot assume that the forces who supplied data are representative of all 45 regional forces, if this were the case, it would equate to 2,212 recorded dog thefts in 2020, 2,645 in 2021, and 3,191 in 2022.

    There was a lot of variation between different areas. For example, Cambridgeshire, Gwent and Northumbria police forces experienced increases of 36%, 49% and 80% respectively in the number of recorded dog thefts between 2020 and 2021.

    Monthly analysis of data from regional police forces and DogLost, show that the number of reports of stolen dogs started to go up when the UK entered its first national lockdown and again during part of the third lockdown. But the average number of police-recorded dog thefts was actually slightly higher outside of lockdown periods than during them between 2020 and 2022.

    However, in contrast with police trends, DogLost data shows a 65.2% drop in dogs reported stolen on DogLost’s website in 2022 compared to 2020. Lower DogLost numbers may reflect limited visibility or presence of their networks, the use of alternative lost and stolen dog services, or reluctance to share personal details online due to scams targeting dog theft victims.

    Dogs are often stolen from inside their own homes.
    GoodFocused/Shutterstock

    Our study found that, overall, there probably was an increase in dog theft from
    2020 to 2022, following already identified increases in the preceding years. This rise was probably driven by a combination of opportunity (more dogs, higher value) and situational factors (accessibility, dogs unattended in gardens while owners were inside).

    Our evidence does not support the notion of a widespread epidemic as portrayed by the media. However, increased media interest probably amplified awareness of the issue, and influenced the creation of the Pet Theft Taskforce, a UK government initiative set up in May 2021 to investigate and tackle dog thefts.

    New research appears to confirm the idea that dog abduction has significant welfare effects on both dogs and their owners. We also know that few dog thefts are successfully resolved, with under a quarter of stolen dogs likely to be returned and around 1%-5% of reported dog thefts result in someone being charged.

    However, there is potential good news. Our ongoing research suggests the number of police-recorded dog thefts decreased slightly in 2023, and again in 2024. This is supported by research from pet insurer Direct Line, which has estimated a 21% decrease in the number of stolen dogs from 2,290 in 2023 to 1,808 in 2024 in the UK.

    Daniel Allen is founder of Pet Theft Reform and patron of the Stolen and Missing Pets Alliance (Sampa).

    Melanie Flynn is a member of the Research Advisory Committee of the Vegan Society (UK).

    John Walliss does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.

    – ref. Dog thefts: what really happened during the COVID pandemic – https://theconversation.com/dog-thefts-what-really-happened-during-the-covid-pandemic-252061

    MIL OSI –

  • MIL-OSI Security: Swedish Man Who Licensed Rights to Late Colombian Drug Lord Pablo Escobar Pleads Guilty to Fraud, Money Laundering Charges

    Source: US FBI

    LOS ANGELES – A Swedish national who licensed the rights of the late Colombian narco-terrorist Pablo Escobar pleaded guilty today to six federal criminal charges for defrauding investors by marketing and selling products – including flamethrowers and cellphones – that he never delivered.

    Olof Kyros Gustafsson, 32, a.k.a. “El Silencio,” pleaded guilty to one count of conspiracy to commit wire fraud and mail fraud, one count of wire fraud, one count of mail fraud, one count of conspiracy to commit money laundering, one count of concealment money laundering, and one count of international concealment money laundering.

    Gustafsson has been in federal custody since March 28, when he was extradited to the United States from Spain, where he was arrested in December 2023. 

    According to his plea agreement, Gustafsson was the CEO of Escobar Inc., a corporation registered in Puerto Rico that held successor-in-interest rights to the persona and legacy of Pablo Escobar, the deceased Colombian narco-terrorist and late head of the Medellín Cartel. Escobar Inc. used Pablo Escobar’s likeness and persona to market and sell purported consumer products to the public.

    From July 2019 to November 2023, Gustafsson identified existing products in the marketplace that were being manufactured and sold to the public. He then used the Escobar persona to market and advertise similar and competing products purportedly being sold by Escobar Inc., advertising them at a price substantially lower than existing counterparts being sold by other companies.

    Gustafsson then purportedly sold the products – including an Escobar Flamethrower, an Escobar Fold Phone, an Escobar Gold 11 Pro Phone, and Escobar Cash (marketed as a “physical cryptocurrency”) – to customers, receiving payments via PayPal, Stripe, Coinbase, among other payment processors, as well as bank and wire transfers.

    Despite receiving customer payments, Gustafsson did not deliver the Escobar Inc. products to paying customers because the products did not exist.

    In furtherance of the scheme, Gustafsson sent crudely made samples of the purported Escobar Inc. products to online technology reviewers and social media influencers to attempt to increase the public’s demand for them. For example, Gustafsson sent Samsung Galaxy Fold Phones wrapped in gold foil and disguised as Escobar Inc. phones to online technology reviewers to attempt to induce victims who watched the online reviews into buying the products that never would be delivered.

    Also, rather than sending paying customers the actual products, Gustafsson mailed them a “Certificate of Ownership,” a book, or other Escobar Inc. promotional materials so there was a record of mailing from the company to the customer. When a paying customer attempted to obtain a refund when the product was never delivered, Gustafsson fraudulently referred the payment processor to the proof of mailing for the Certificate of Ownership or other material as proof that the product itself was shipped and that the customer had received it so the refund requests would be denied.

    Gustafsson also caused bank accounts to be opened under his name and entities he controlled to be used as funnel accounts – bank accounts into which he deposited and withdrew proceeds derived from his criminal activities. The purpose was to conceal and disguise the nature, location, source, ownership, and control of the proceeds. The bank accounts were located in the United States, Sweden, and the United Arab Emirates.

    United States District Judge Fernando L. Aenlle-Rocha scheduled a December 5 sentencing hearing, at which time Gustafsson will face a statutory maximum sentence of 20 years in federal prison for each fraud-related count and up to 10 years in federal prison for each money laundering-related count. 

    As part of his plea agreement, Gustafsson agreed to pay up to $1.3 million in restitution to victims, as well as to forfeiture to funds that were proceeds of the fraud schemes, including money currently held in a bank account in Sweden.

    IRS Criminal Investigation, the FBI, and the Federal Deposit Insurance Corporation-Office of Inspector General are investigating this matter, with assistance from the Department of Justice’s Office of International Affairs, the United States Marshals Service, Eurojust, Spanish authorities, and French judicial authorities.

    Assistant United States Attorney Joshua O. Mausner of the Violent and Organized Crime Section is prosecuting this case.

    MIL Security OSI –

  • MIL-OSI Security: Swedish Man Who Licensed Rights to Late Colombian Drug Lord Pablo Escobar Pleads Guilty to Fraud, Money Laundering Charges

    Source: US FBI

    LOS ANGELES – A Swedish national who licensed the rights of the late Colombian narco-terrorist Pablo Escobar pleaded guilty today to six federal criminal charges for defrauding investors by marketing and selling products – including flamethrowers and cellphones – that he never delivered.

    Olof Kyros Gustafsson, 32, a.k.a. “El Silencio,” pleaded guilty to one count of conspiracy to commit wire fraud and mail fraud, one count of wire fraud, one count of mail fraud, one count of conspiracy to commit money laundering, one count of concealment money laundering, and one count of international concealment money laundering.

    Gustafsson has been in federal custody since March 28, when he was extradited to the United States from Spain, where he was arrested in December 2023. 

    According to his plea agreement, Gustafsson was the CEO of Escobar Inc., a corporation registered in Puerto Rico that held successor-in-interest rights to the persona and legacy of Pablo Escobar, the deceased Colombian narco-terrorist and late head of the Medellín Cartel. Escobar Inc. used Pablo Escobar’s likeness and persona to market and sell purported consumer products to the public.

    From July 2019 to November 2023, Gustafsson identified existing products in the marketplace that were being manufactured and sold to the public. He then used the Escobar persona to market and advertise similar and competing products purportedly being sold by Escobar Inc., advertising them at a price substantially lower than existing counterparts being sold by other companies.

    Gustafsson then purportedly sold the products – including an Escobar Flamethrower, an Escobar Fold Phone, an Escobar Gold 11 Pro Phone, and Escobar Cash (marketed as a “physical cryptocurrency”) – to customers, receiving payments via PayPal, Stripe, Coinbase, among other payment processors, as well as bank and wire transfers.

    Despite receiving customer payments, Gustafsson did not deliver the Escobar Inc. products to paying customers because the products did not exist.

    In furtherance of the scheme, Gustafsson sent crudely made samples of the purported Escobar Inc. products to online technology reviewers and social media influencers to attempt to increase the public’s demand for them. For example, Gustafsson sent Samsung Galaxy Fold Phones wrapped in gold foil and disguised as Escobar Inc. phones to online technology reviewers to attempt to induce victims who watched the online reviews into buying the products that never would be delivered.

    Also, rather than sending paying customers the actual products, Gustafsson mailed them a “Certificate of Ownership,” a book, or other Escobar Inc. promotional materials so there was a record of mailing from the company to the customer. When a paying customer attempted to obtain a refund when the product was never delivered, Gustafsson fraudulently referred the payment processor to the proof of mailing for the Certificate of Ownership or other material as proof that the product itself was shipped and that the customer had received it so the refund requests would be denied.

    Gustafsson also caused bank accounts to be opened under his name and entities he controlled to be used as funnel accounts – bank accounts into which he deposited and withdrew proceeds derived from his criminal activities. The purpose was to conceal and disguise the nature, location, source, ownership, and control of the proceeds. The bank accounts were located in the United States, Sweden, and the United Arab Emirates.

    United States District Judge Fernando L. Aenlle-Rocha scheduled a December 5 sentencing hearing, at which time Gustafsson will face a statutory maximum sentence of 20 years in federal prison for each fraud-related count and up to 10 years in federal prison for each money laundering-related count. 

    As part of his plea agreement, Gustafsson agreed to pay up to $1.3 million in restitution to victims, as well as to forfeiture to funds that were proceeds of the fraud schemes, including money currently held in a bank account in Sweden.

    IRS Criminal Investigation, the FBI, and the Federal Deposit Insurance Corporation-Office of Inspector General are investigating this matter, with assistance from the Department of Justice’s Office of International Affairs, the United States Marshals Service, Eurojust, Spanish authorities, and French judicial authorities.

    Assistant United States Attorney Joshua O. Mausner of the Violent and Organized Crime Section is prosecuting this case.

    MIL Security OSI –

  • MIL-OSI Security: Illinois Tax Preparer Sentenced for Role in $3.6M Covid-19 Fraud Scheme

    Source: United States Department of Justice Criminal Division

    An Illinois man was sentenced yesterday to 42 months in prison for his role in a scheme to fraudulently obtain over $3.6 million in small business loans under the Coronavirus Aid, Relief, and Economic Security Act Paycheck Protection Program (PPP) and COVID19 Economic Injury Disaster Loan (EIDL) program implemented by the Small Business Administration (SBA). 

    According to court documents, Farooq Khan, 31, of Chicago, owned and operated Hannan Tax Services (Hannan Tax), a tax preparation company located in Chicago. From approximately May 2020 through October 2021, through Hannan Tax, Khan prepared and facilitated the submission of at least 30 fraudulent applications for loans through the PPP and EIDL program. At the time Kahn prepared and submitted the applications, he knew that the companies for which he sought the loans were non-operational and did not qualify. He also knowingly falsified the information contained in the applications, including the number of employees and tax records attributed to the defunct companies. Khan caused approximately $3.6 million to be fraudulently distributed by the SBA and PPP lenders. He also attempted to obtain at least an additional $588,900 in loans through other EIDL applications that were never funded for nonexistent companies. He personally obtained approximately $1.2 million of the fraudulent loan proceeds.     

    Khan pleaded guilty to one count of wire fraud on Feb. 19. At sentencing, he was also ordered to pay $3,645,104 in restitution. 

    Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department’s Criminal Division, Special Agent in Charge Douglas S. DePodesta of the FBI Chicago Field Office, and Special Agent-in-Charge Matthew J. Scarpino of Immigration and Customs Enforcement Homeland Security Investigations (ICE-HSI) Chicago made the announcement.   

    The FBI Chicago Field Office and ICE-HSI are investigating the case. 

    Trial Attorney Claire Sobczak Pacelli of the Criminal Division’s Fraud Section is prosecuting the case. 

    Anyone with information about allegations of attempted fraud involving COVID-19 can report it by calling the Justice Department’s National Center for Disaster Fraud (NCDF) Hotline at 8667205721 or via the NCDF Web Complaint Form at www.justice.gov/disaster-fraud/ncdf-disaster-complaint-form. 

    MIL Security OSI –

  • MIL-OSI: Thomas Financial Group Secures $19.975 Million USDA Loan for Major Mendocino Hotel Restoration

    Source: GlobeNewswire (MIL-OSI)

    ATLANTA, July 22, 2025 (GLOBE NEWSWIRE) — Thomas Financial Group, a wholly owned subsidiary of Community Bankshares Inc., is proud to announce the successful closing of a $19.975 million USDA Business & Industry (B&I) loan for the refinance and full renovation of two historic hospitality assets in downtown Mendocino: The Mendocino Hotel & Garden Suites and Hill House Inn.

    This milestone project, originated and underwritten by Thomas Financial Group, was financed through the USDA’s B&I program. The project will preserve and revitalize all guest rooms across the two properties, relaunch a centerpiece food and beverage destination, reactivate the largest indoor event space on California’s North Coast, and create over 50 new high-paying jobs, tripling the current staff and restoring these historic landmarks to full operation.

    Once thriving anchors of the Mendocino community, both the Mendocino Hotel & Garden Suites and Hill House Inn had fallen into disrepair. With this USDA loan, the new owners, Castle Peak Holdings, will launch a comprehensive restoration that enhances the guest experience while preserving the charm and history that define this iconic coastal village.

    The planned improvements include:

    • Expansive renovations across both properties.
    • Restoration of a three-meal restaurant and historic lobby bar at Mendocino Hotel.
    • Reopening of North Coast’s largest indoor wedding venue.
    • Upgrades to room layouts, ADA compliance, and coastal-facing suites.
    • Activation of public gathering spaces for locals and tourists alike.

    The Mendocino Hotel & Garden Suites, the only full-service hotel in the downtown district, will be a dynamic center of gravity for the North Coast on Mendocino’s historic Main Street, while Hill House Inn – famed as the setting for the drama TV series “Murder She Wrote” – will be restored as a hilltop retreat featuring the largest and most flexible meeting and event spaces on the North Coast, with ocean views and walking access to downtown Mendocino. Both properties will feature authentic local design elements and highlight regional artisans and makers through curated programming.

    “This is what rural revitalization looks like,” said Zach Chandler, SVP, Government Guaranteed Lending for Thomas Financial Group. “We delivered a complex, long-term loan structure to support two of Northern California’s most irreplaceable hospitality assets, and did it with the stability of USDA financing.”

    With an 80% USDA guarantee, a 30-year term, and no balloon payments, the loan provides unmatched peace of mind for the borrower, particularly in a volatile rate environment.

    Situated in a town with a regulatory moratorium on new hotel development, these properties represent a significant portion of Mendocino’s total hotel room inventory. With over 2 million annual visitors and no new supply on the horizon, the business case for reinvesting in these assets is as compelling as the historic preservation effort itself.

    “This project is about more than restoring two historic hotels,” said David Better, Partner at Castle Peak Holdings. “It’s about breathing life back into community gems, reactivating jobs, and celebrating the unique cultural legacy and spirit of Mendocino. These hotels are deeply woven into the historic fabric of what makes Mendocino special. Everyone in the area has a story about these hotels; whether they worked there as a kid, had their high school prom there, or shared a memorable meal there with family and friends. We look forward to delivering a successful project and creating the next generation of memories, for locals and guests alike. The USDA loan gave us the ability to do that in a thoughtful, sustainable way—and the team at Thomas Financial made the process seamless from start to finish.”

    This project is part of a growing trend where USDA financing is used to support economic development in iconic rural destinations, and Thomas Financial Group is leading the charge.

    “We’re not just closing loans—we’re reactivating communities,” added Chandler. “If you have a hospitality, manufacturing, or rural development project in the pipeline, we can help you close faster, structure smarter, and build for the long term.”

    If you’re looking to fund a rural acquisition, repositioning, or expansion project and need a lender who can bridge the gap and deliver USDA takeout, contact Thomas Financial Group today.

    About Thomas Financial Group

    Thomas Financial Group, a wholly owned subsidiary of Community Bankshares Inc., is a nationally recognized leader in USDA and SBA lending. In partnership with Phoenix Lender Services and Community Bank & Trust, TFG specializes in complex capital solutions that support rural economic development, small business growth, and infrastructure expansion.

    About Community Bankshares Inc.

    Community Bankshares Inc. is a privately held financial holding company headquartered in LaGrange, Georgia, with subsidiaries including Community Bank & Trust, Thomas Financial Group, and Phoenix Lender Services. Through its network of specialized financial institutions, Community Bankshares Inc. delivers innovative, relationship-driven banking and lending services across the United States, with a strong emphasis on rural development and community reinvestment.

    Media Contact
    Abigail Davison
    Uproar by Moburst for Community Bankshares, Inc.
    abigail.davison@moburst.com

    The MIL Network –

  • MIL-OSI USA: Vietnamese national dies in ICE custody

    Source: US Immigration and Customs Enforcement

    SAN ANTONIO — Tien Xuan Phan, a 55-year-old citizen of Vietnam in the custody of U.S. Immigration and Customs Enforcement, was pronounced deceased by the Methodist Hospital Northeast at 5:48 p.m. July 19. The cause of death is still under investigation.

    Phan was being detained at the Karnes County Immigration Processing Center in Karnes City. Phan was taken to Otto Kaiser Memorial Hospital on July 18 for evaluation due to seizures, vomiting and unresponsiveness, and was later airlifted to the Methodist Hospital Northeast for further evaluation. 

    ICE Enforcement and Removal Operations deportation officers arrested Phan June 2. Phan was ordered removed by an immigration judge on April 2, 2012, but failed to leave the U.S. as ordered. 

    Consistent with ICE policy, ERO notified the U.S. Department of Homeland Security, the Office of Inspector General, and the ICE Office of Professional Responsibility via the Integrity Coordination Center. ERO provided notification of the death to the Vietnam Embassy.

    ICE makes official notifications to Congress, nongovernmental organization stakeholders, and the media upon an official report of a detained illegal alien’s death and posts a news release with relevant details on the ICE public website within two business days per agency policy. This information may be accessed in the ICE.gov Newsroom. Additionally, congressional requirements described in the DHS Appropriations Bill of 2018 require ICE to make public all reports regarding an in-custody death within 90 days.

    These reports may be accessed on the Detainee Death Reporting page.

    ICE remains committed to ensuring that all those in its custody reside in safe, secure, and humane environments. Comprehensive medical care is provided from the moment individuals arrive and throughout the entirety of their stay. All people in ICE custody receive medical, dental and mental health intake screening within 12 hours of arriving at each detention facility, a full health assessment within 14 days of entering ICE custody or arrival at a facility, access to medical appointments and 24-hour emergency care. At no time during detention is a detained illegal alien denied emergent care.

    MIL OSI USA News –

  • MIL-OSI USA: Illinois Tax Preparer Sentenced for Role in $3.6M Covid-19 Fraud Scheme

    Source: US State of North Dakota

    An Illinois man was sentenced yesterday to 42 months in prison for his role in a scheme to fraudulently obtain over $3.6 million in small business loans under the Coronavirus Aid, Relief, and Economic Security Act Paycheck Protection Program (PPP) and COVID19 Economic Injury Disaster Loan (EIDL) program implemented by the Small Business Administration (SBA). 

    According to court documents, Farooq Khan, 31, of Chicago, owned and operated Hannan Tax Services (Hannan Tax), a tax preparation company located in Chicago. From approximately May 2020 through October 2021, through Hannan Tax, Khan prepared and facilitated the submission of at least 30 fraudulent applications for loans through the PPP and EIDL program. At the time Kahn prepared and submitted the applications, he knew that the companies for which he sought the loans were non-operational and did not qualify. He also knowingly falsified the information contained in the applications, including the number of employees and tax records attributed to the defunct companies. Khan caused approximately $3.6 million to be fraudulently distributed by the SBA and PPP lenders. He also attempted to obtain at least an additional $588,900 in loans through other EIDL applications that were never funded for nonexistent companies. He personally obtained approximately $1.2 million of the fraudulent loan proceeds.     

    Khan pleaded guilty to one count of wire fraud on Feb. 19. At sentencing, he was also ordered to pay $3,645,104 in restitution. 

    Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department’s Criminal Division, Special Agent in Charge Douglas S. DePodesta of the FBI Chicago Field Office, and Special Agent-in-Charge Matthew J. Scarpino of Immigration and Customs Enforcement Homeland Security Investigations (ICE-HSI) Chicago made the announcement.   

    The FBI Chicago Field Office and ICE-HSI are investigating the case. 

    Trial Attorney Claire Sobczak Pacelli of the Criminal Division’s Fraud Section is prosecuting the case. 

    Anyone with information about allegations of attempted fraud involving COVID-19 can report it by calling the Justice Department’s National Center for Disaster Fraud (NCDF) Hotline at 8667205721 or via the NCDF Web Complaint Form at www.justice.gov/disaster-fraud/ncdf-disaster-complaint-form. 

    MIL OSI USA News –

  • MIL-OSI Security: Hermandad de Pistoleros Latinos gang member sentenced to 100 months for heroin trafficking

    Source: United States Bureau of Alcohol Tobacco Firearms and Explosives (ATF)

    LAREDO, Texas – A 33-year-old Laredo man has been sentenced for possession with the intent to distribute 100 grams or more of heroin, announced U.S. Attorney Nicholas J. Ganjei.

    Raul Garcia Jr. aka Rule pleaded guilty Aug. 6. 2024.

    U.S. District Judge Keith P. Ellison has now ordered Garcia to serve 100 months in federal prison to be immediately followed by four years of supervised release. At the hearing, the court heard about Garcia’s numerous prior convictions and contacts with law enforcement. In handing down the sentence, the court noted this was a serious crime.

    The investigation began in January 2024 when law enforcement learned Garcia may have been selling fentanyl in the Laredo area. Over the next three months, authorities discovered Garcia was selling narcotics out of his home.

    A search warrant in March of that year resulted in the discovery of heroin packaged for street sale. A month later, law enforcement obtained a second search warrant and again found heroin. Similar to previously found drugs, the heroin was also packaged for street sale.

    The searches also revealed methamphetamine, crack cocaine, fentanyl, marijuana, money and stolen firearm.

    At the time of his plea, Garcia admitted to possessing the drugs located and seized throughout the investigation.

    He will remain in custody pending transfer to a Federal Bureau of Prisons facility to be determined in the near future.

    The Drug Enforcement Administration, Bureau of Alcohol, Tobacco, Firearms and Explosives and the Laredo Police Department’s Narcotics Division conducted the investigation with assistance from Immigration and Customs Enforcement – Homeland Security Investigations and Border Patrol. Assistant U.S. Attorneys Steven Chamberlin and Leslie Cortez prosecuted the case.

    This case is being prosecuted as part of an Organized Crime Drug Enforcement Task Forces (OCDETF) investigation. OCDETF is the largest anti-crime task force in the country. OCDETF identifies, disrupts and dismantles the highest-level criminal organizations that threaten the United States using a prosecutor-led, intelligence-driven, multi-agency approach. Additional information about the OCDETF Program can be found on the Department of Justice’s OCDETF webpage.

    MIL Security OSI –

  • MIL-OSI Security: Spree of Violent Robberies Nets Previously Convicted Killer an Additional 42 Months in Federal Prison

    Source: US FBI

                WASHINGTON – Glenn Dolford, 32, of the District of Columbia, was sentenced today in U.S. District Court to 42 months in federal prison for his role in a spree of Hobbs Act offenses that included the violent robberies in June 2020 of a Maryland pharmacy and a Maryland phone store, announced U.S. Attorney Jeanine Ferris Pirro.

                Dolford pleaded guilty on February 28, 2025, before U.S. District Court Judge Amy Berman Jackson to two counts of interference with interstate commerce by threat or violence. In addition to the prison term, Judge Berman Jackson ordered three years of supervised release.

                Joining in the announcement was FBI Assistant Director in Charge Steven J. Jensen of the Washington Field Office.

                Dolford was previously convicted in 2023 of second-degree murder while armed, aggravated assault while armed, and assault with a deadly weapon for killing one man and shooting two others on Super Bowl Sunday in February 2020. For those crimes he was arrested in June 2020 and sentenced in June 2023 to more than 22 years in prison.

                According to court documents, on June 8, 2020, Dolford and three co-conspirators traveled from the District to a CVS Pharmacy in Nottingham, Maryland. As one subject stayed in their car, Dolford and two others entered the store. As a store employee was attempting to run away from the subjects, Dolford threw him to the floor, punched him in the head, and held him down with his foot on the employee’s back.

                Dolford’s two co-conspirators demanded narcotics and ordered another employee to empty the safe and hand over his phone and wallet. Dolford and the co-conspirators fled in a silver VW Jetta with $1,000 worth of hydrocodone and the one employee’s personal items.

                On June 9, 2020, Dolford and two co-conspirators traveled from the District to a T-Mobile store in College Park. Dolford forced the store employees to the back of the store as another conspirator said “give me all the phones or I’ll kill you.” Dolford and his co-conspirators fled the store in a silver VW Jetta with phones valued at about $20,000.

                Investigators determined Dolford rented the silver Jetta on May 28, 2020, from Enterprise Rent-a-Car. In June 2023, Dolford was indicted in U.S. District Court on Conspiracy and Hobbs Act robbery charges for his involvement in the June 8 and 9 robberies.

                Co-defendant Floyd Neal, 32, of Washington, D.C., was sentenced on July 17, 2024, to more than 157 months in prison for his role in a rash of 2021 gunpoint robberies of pharmacies in Maryland and Virginia.

                Co-defendant Ashawntea Henderson, 32, of Washington, D.C., was sentenced on Feb. 18, 2025, to 52 months in federal prison for participating in an early morning robbery of a drug store at the Jersey Shore. During the May 2020 robbery, he and his co-conspirators jumped the counter, overpowered the night pharmacist, stole thousands of prescription narcotics, and then – as they attempted to flee to the District – crashed into a responding police cruiser.

                This case was investigated by the FBI Washington Field Office’s Violent Crimes Task Force, the Metropolitan Police Department, and the Prince George’s County Police Department. The matter is being prosecuted by Assistant U.S. Attorneys Cameron Tepfer, Kyle McWaters, Sarah Martin, and Josh Gold.

    23cr190

    MIL Security OSI –

  • MIL-OSI Security: U.S. Attorney’s Office, Law Enforcement, Community Partners to Host National Night Out Event in East St. Louis

    Source: US FBI

    EAST ST. LOUIS, Ill. – To strengthen relationships between residents and law enforcement, the U.S. Attorney’s Office in the Southern District of Illinois, event organizers and police officials are inviting the East St. Louis community to a free event with activities for attendees of all ages to celebrate National Night Out.

    The event will be held from 5 to 7:30 p.m. on Tuesday, Aug. 5 at 8206 State St. in East St. Louis.

    Community partners will give out school supplies to students, provide food to families and offer an array of activities like competitive games, police demonstrations, and a live DJ. This National Night Out is a free event for East St. Louis residents.

    Ameren Illinois, ATF, Catholic Urban Programs, the City of East St. Louis, Community Development Sustainable Solutions, Community Life Line, DEA, the East St. Louis Police Department, the FBI Springfield Field Office, Illinois State Police, IRS Criminal Investigation, the U.S. Attorney’s Office and the U.S. Marshals Service are partnering to host the event.

    National Night Out is an annual community-building campaign that promotes community partnerships with police and neighborhood camaraderie.

    MIL Security OSI –

  • MIL-OSI Security: IAEA Reviews Progress of Sri Lanka’s Nuclear Infrastructure Development

    Source: International Atomic Energy Agency – IAEA

    INIR mission team leader John Haddad presents the draft report to Thushara Rathnayake, Chairperson of the Sri Lanka Atomic Energy Board, at the closing meeting on 18 July. (Photo: Ministry of Energy of Sri Lanka)

    As Sri Lanka embarks on the development of its nuclear power programme, the country is making progress in establishing the necessary nuclear infrastructure, according to an International Atomic Energy Agency (IAEA) review mission that recently concluded.

    The follow-up Integrated Nuclear Infrastructure Review (INIR) mission, conducted at the request of the Government of Sri Lanka, took place from 14 to 18 July 2025.

    The mission team, comprising two international experts from Bulgaria and Türkiye and two IAEA staff,  assessed the progress made to address the recommendations and suggestions of the Phase 1 2022 INIR mission. A Phase 1 INIR mission assesses the readiness of a country to make a knowledgeable commitment to a nuclear power programme using the Phase 1 criteria of the IAEA Milestones Approach and Evaluation Methodology. The 2022 mission made 26 recommendations and 6 suggestions to assist Sri Lanka in advancing its infrastructure development.

    In 2010, Sri Lanka’s Cabinet approved the initiation of studies for implementing a nuclear power programme in the country. In 2019, a Nuclear Energy Programme Implementing Organization (NEPIO) was established to coordinate related efforts, which included the Ministry of Energy, the Sri Lanka Atomic Energy Board (SLAEB), the Ceylon Electricity Board (CEB) and the Sri Lanka Atomic Energy Regulatory Council (SLAERC). In 2024, the government decided on further actions to consider a nuclear power programme.

    The INIR team concluded that Sri Lanka has made good progress to address recommendations and suggestions from the Phase 2 INIR mission in 2022. Sri Lanka has already identified five candidate sites for the nuclear power plant, established a management structure to oversee the procurement process for nuclear reactors, drafted a comprehensive nuclear law and included nuclear power in its current long-term energy planning for the period 2025-2044.

    Sri Lanka hosted a national workshop on nuclear law in November 2023, as well as an IAEA  Site and External Events Design Review Service (SEED) mission in 2024, which reviewed the country’s selection process to identify candidate sites to build its first nuclear power plant. A SEED follow up mission was also conducted, which took place in July this year.

    “Sri Lanka is actively working on addressing the recommendations and suggestions from the main INIR mission in 2022,” said mission team leader John Haddad from IAEA’s Nuclear Infrastructure Development Section. “This indicates the level of commitment of Sri Lanka to conduct the required studies and make a knowledgeable decision regarding the nuclear power programme.”

    In the opening ceremony for the INIR Mission, Hon. Eng. Kumara Jayakody, Cabinet Minister of Energy, welcomed the INIR mission as “a significant milestone in Sri Lanka’s journey towards a secure, sustainable and forward-looking energy future as we take decisive steps forward in exploring the role of nuclear power in our national energy mix.”

    Nuclear Power is included as an energy source within the CEB Least Cost Long Term Generation and Expansion Plan 2025-2044. According to the plan, accommodating a nuclear power unit above 600 MWe to the Sri Lankan network will be technically challenging due to the network’s condition, projected demand growth, and the generation mix which is expected to be dominated by variable renewable energy sources. The team said that further work is needed related to the finalization of strategies and studies in various areas of infrastructure development such as, among others, management, human resource development, stakeholder involvement, radioactive waste management and industrial involvement.

    About Integrated Nuclear Infrastructure Review (INIR) Missions

    INIR missions are based on the IAEA Milestones Approach, with its 19 infrastructure issues, three phases (consider, prepare and construct) and three milestones (decide, contract and operate). INIR missions enable IAEA Member State representatives to have in-depth discussions with international experts about experiences and best practices in different countries.

    In developing its recommendations, the INIR team considers the comments made by the relevant national organizations. Implementation of any of the team’s recommendations and suggestions is at the discretion of the Member State requesting the mission. The results of the INIR mission are expected to help the Member State develop an action plan to fill any gaps, which in turn will help the development of the national nuclear infrastructure.

    INIR follow-up missions assess the implementation of the recommendations and suggestions provided during the main mission.

    MIL Security OSI –

  • MIL-OSI NGOs: IAEA Reviews Progress of Sri Lanka’s Nuclear Infrastructure Development

    Source: International Atomic Energy Agency (IAEA) –

    INIR mission team leader John Haddad presents the draft report to Thushara Rathnayake, Chairperson of the Sri Lanka Atomic Energy Board, at the closing meeting on 18 July. (Photo: Ministry of Energy of Sri Lanka)

    As Sri Lanka embarks on the development of its nuclear power programme, the country is making progress in establishing the necessary nuclear infrastructure, according to an International Atomic Energy Agency (IAEA) review mission that recently concluded.

    The follow-up Integrated Nuclear Infrastructure Review (INIR) mission, conducted at the request of the Government of Sri Lanka, took place from 14 to 18 July 2025.

    The mission team, comprising two international experts from Bulgaria and Türkiye and two IAEA staff,  assessed the progress made to address the recommendations and suggestions of the Phase 1 2022 INIR mission. A Phase 1 INIR mission assesses the readiness of a country to make a knowledgeable commitment to a nuclear power programme using the Phase 1 criteria of the IAEA Milestones Approach and Evaluation Methodology. The 2022 mission made 26 recommendations and 6 suggestions to assist Sri Lanka in advancing its infrastructure development.

    In 2010, Sri Lanka’s Cabinet approved the initiation of studies for implementing a nuclear power programme in the country. In 2019, a Nuclear Energy Programme Implementing Organization (NEPIO) was established to coordinate related efforts, which included the Ministry of Energy, the Sri Lanka Atomic Energy Board (SLAEB), the Ceylon Electricity Board (CEB) and the Sri Lanka Atomic Energy Regulatory Council (SLAERC). In 2024, the government decided on further actions to consider a nuclear power programme.

    The INIR team concluded that Sri Lanka has made good progress to address recommendations and suggestions from the Phase 2 INIR mission in 2022. Sri Lanka has already identified five candidate sites for the nuclear power plant, established a management structure to oversee the procurement process for nuclear reactors, drafted a comprehensive nuclear law and included nuclear power in its current long-term energy planning for the period 2025-2044.

    Sri Lanka hosted a national workshop on nuclear law in November 2023, as well as an IAEA  Site and External Events Design Review Service (SEED) mission in 2024, which reviewed the country’s selection process to identify candidate sites to build its first nuclear power plant. A SEED follow up mission was also conducted, which took place in July this year.

    “Sri Lanka is actively working on addressing the recommendations and suggestions from the main INIR mission in 2022,” said mission team leader John Haddad from IAEA’s Nuclear Infrastructure Development Section. “This indicates the level of commitment of Sri Lanka to conduct the required studies and make a knowledgeable decision regarding the nuclear power programme.”

    In the opening ceremony for the INIR Mission, Hon. Eng. Kumara Jayakody, Cabinet Minister of Energy, welcomed the INIR mission as “a significant milestone in Sri Lanka’s journey towards a secure, sustainable and forward-looking energy future as we take decisive steps forward in exploring the role of nuclear power in our national energy mix.”

    Nuclear Power is included as an energy source within the CEB Least Cost Long Term Generation and Expansion Plan 2025-2044. According to the plan, accommodating a nuclear power unit above 600 MWe to the Sri Lankan network will be technically challenging due to the network’s condition, projected demand growth, and the generation mix which is expected to be dominated by variable renewable energy sources. The team said that further work is needed related to the finalization of strategies and studies in various areas of infrastructure development such as, among others, management, human resource development, stakeholder involvement, radioactive waste management and industrial involvement.

    About Integrated Nuclear Infrastructure Review (INIR) Missions

    INIR missions are based on the IAEA Milestones Approach, with its 19 infrastructure issues, three phases (consider, prepare and construct) and three milestones (decide, contract and operate). INIR missions enable IAEA Member State representatives to have in-depth discussions with international experts about experiences and best practices in different countries.

    In developing its recommendations, the INIR team considers the comments made by the relevant national organizations. Implementation of any of the team’s recommendations and suggestions is at the discretion of the Member State requesting the mission. The results of the INIR mission are expected to help the Member State develop an action plan to fill any gaps, which in turn will help the development of the national nuclear infrastructure.

    INIR follow-up missions assess the implementation of the recommendations and suggestions provided during the main mission.

    MIL OSI NGO –

  • MIL-OSI: Landlord Sentiment Shifts in 2025: Fewer Acquisitions, More Spending on Existing Properties

    Source: GlobeNewswire (MIL-OSI)

    NEW YORK, July 22, 2025 (GLOBE NEWSWIRE) — New survey results from RentRedi, the fastest-growing rental management software, including joint data from BiggerPockets, show a measurable shift in landlord priorities for 2025. Compared to late 2024, fewer landlords plan to expand their portfolios, while more are investing in property improvements and optimizing operations. RentRedi’s rental market survey examines notable shifts in trends relating to investment strategies, renovation spending, and business priorities over time.

    As a follow-up to a survey that was conducted in November 2024, the same questions were posed to U.S. landlords between June 3-26, 2025, and responses were analyzed by region and landlord size. Over the past six months, the share of landlords planning to buy new properties dropped from 67% in November 2024 to 53% in June 2025—a 14-point decline. During the same period, the portion of landlords with no plans to change their portfolio rose by 11% from 32% to over 43%. Fewer than 1 in 25 landlords say they plan to sell a rental property this year.

    Regionally, the West experienced the biggest shift in sentiment, with the number of landlords saying they have no plans to make portfolio changes rising from 39% to 53%, a 14-point increase. In contrast, the Northeast was the most acquisition-oriented region, with 57% of investors still planning to buy property in 2025, outpacing the national average.

    Differences by landlord size also emerged. While all portfolio sizes saw a decline in buying plans, landlords with 20 or more units remain more active than their smaller counterparts. A little over 1 in 5 large landlords plan to both buy and sell property this year, compared to just 5% of small landlords. Nearly half of small landlords say they have no plans to change their portfolio, compared to 38% of large landlords.

    Another major shift is visible in home improvement plans. As of June, 35% of landlords expect to spend more than $20,000 on property upgrades this year, up from 27% in November. Nearly 2 in 3 respondents anticipate spending over $5,000 in total. Landlords with large portfolios are leading the charge: nearly two-thirds expect to spend more than $20,000, up from 36% in November. Small landlords remained more conservative, with nearly half still budgeting under $5,000.

    Regionally, the Midwest and West saw the most dramatic increases in high-dollar spending. In both regions, the share of landlords expecting to invest more than $20,000 rose by 10 points or more. At the same time, a June joint survey with BiggerPockets found that exactly half of landlords have paused some or all home improvement projects planned for 2025, suggesting a range of financial strategies and priorities depending on portfolio structure and resources.

    A separate July survey from RentRedi and BiggerPockets explored the reasons behind declining acquisition plans. More than half of landlords cited property prices as the biggest barrier to buying, while nearly a quarter pointed to interest rates. Others said slow revenue growth or time commitment were their main challenges.

    When asked what they hoped to achieve by using tools or resources in their rental business, more than one-third said increasing revenue was most important. Another one-third prioritized saving time and effort, followed by reducing costs and increasing property value.

    “With tools like RentRedi, landlords are managing their properties more efficiently, even as they face evolving challenges,” said RentRedi Co-founder and CEO Ryan Barone. “From automation to mobile access to financial reporting, we’re focused on giving landlords the control and visibility they need to make smarter decisions—whether they’re expanding, renovating, or holding steady.”

    Landlord motivations remained consistent across the board. Income generation continues to be the top reason for managing rental properties, selected by over 40% of respondents, followed by long-term investment and financial freedom. Larger landlords are more focused on income—more than half selected it as their primary goal, compared to about one-third who emphasized long-term investment and 16% who cited financial freedom, which is slightly below the 18% national average.

    Diversification appears to be a low priority in 2025. About 40% of landlords said they do not plan to diversify their portfolios by property type or location, and another quarter are unsure. Slightly more than 1 in 3 landlords say they plan to diversify in any way this year.

    This report is part of RentRedi’s ongoing initiative to surface real-world insights from landlords and property managers through data, direct surveys, and collaborations with trusted communities like BiggerPockets. For more data insight and survey result reports, visit RentRedi’s Rental Market Insights.

    Survey Methodology

    RentRedi landlords were surveyed between June 3-26, 2025. There were 1,623 respondents in total. Landlords were classified into U.S. regions by their primary business location as follows: Northeast (CT, MA, ME, NH, NJ, NY, PA, RI); Midwest (IA, IL, IN, KS, MI, MN, MO, ND, NE, OH, SD, WI, VT); South (AL, AR, DC, DE, FL, GA, KY, LA, MD, MS, NC, OK, SC, TN, TX, VA, WV); and West (AK, AZ, CA, CO, HI, ID, MT, NM, NV, OR, UT, WA, WY). Landlords were also classified by real estate portfolio size as follows: small landlords (1-4 rental units); medium landlords (5-19 rental units); and large landlords (20+ rental units). Percentages have been rounded to the nearest whole number, and therefore the values in each barchart may not equal 100%. Separately, BiggerPockets conducted its own surveys via YouTube in June and July 2025. The full survey results can be found here.

    About RentRedi

    RentRedi offers an award-winning, comprehensive rental property management platform that simplifies the renting process for landlords and renters by automating and streamlining processes. Investors can quickly grow their rental businesses by using RentRedi’s all-in-one web and mobile app for rent collection, market listings, tenant screening, lease signing, maintenance coordination, and accounting. Tenants enjoy the convenience and benefits of RentRedi’s easy-to-use mobile app that allows them to pay rent, set up auto-pay, build credit by reporting rent payments to all three major credit bureaus, prequalify and sign leases, and submit 24/7 maintenance requests.

    Founded in 2016, RentRedi is VC-backed and a proven leader in the PropTech market. The company ranks No. 180 on the Inc. 5000 list and No. 13 on the Inc. 5000 Regionals list. It was also named an Inc. Power Partner in 2023 and 2024, and to Fast Company’s Next Big Things in Tech list in 2024, as well as HousingWire’s Tech100 list in 2025. To date, RentRedi has more than $28 billion in assets under management with nearly 200,000 landlords and tenants using its platform. The company partners with technology leaders such as Zillow, TransUnion, Experian, Equifax, Realtor.com, Lessen, Thumbtack, Plaid, and Stripe to create the best customer experience possible. For more information visit RentRedi.com.

    Photos accompanying this announcement are available at

    https://www.globenewswire.com/NewsRoom/AttachmentNg/1e1f54bc-0e48-44d2-ac3d-91e5bc17b910

    https://www.globenewswire.com/NewsRoom/AttachmentNg/caf18e40-7b6f-4476-813a-0e363f878e93

    https://www.globenewswire.com/NewsRoom/AttachmentNg/8172cf42-500a-4823-9640-3a5dbf32fa91

    The MIL Network –

  • MIL-OSI NGOs: Iran: Deliberate Israeli attack on Tehran’s Evin prison must be investigated as a war crime 

    Source: Amnesty International –

    The Israeli military’s deliberate air strikes on Evin prison in Tehran on 23 June 2025 constitute a serious violation of international humanitarian law and must be criminally investigated as war crimes, Amnesty International said today, following an in-depth investigation. 

    Verified video footage, satellite imagery and interviews with eyewitnesses, prisoners’ families and human rights defenders indicate that the Israeli military carried out multiple air strikes on Evin prison, killing and injuring scores of civilians and causing extensive damage and destruction in at least six locations across the prison complex. The attack took place during the working day, at a time when many parts of the prison were packed with civilians. Hours later, the Israeli military confirmed it had attacked the prison and senior Israeli officials boasted about it on social media. According to the Iranian authorities, at least 80 civilians – 79 men and women and a five-year-old boy – were killed.  

    Under international humanitarian law, a prison or place of detention is presumed a civilian object and there is no credible evidence in this case that Evin prison constituted a lawful military objective. 

    The evidence establishes reasonable grounds to believe that the Israeli military brazenly and deliberately attacked civilian buildings.

    Erika Guevara Rosas, Senior Director for Research, Advocacy, Policy and Campaigns. 

    “The evidence establishes reasonable grounds to believe that the Israeli military brazenly and deliberately attacked civilian buildings. Directing attacks at civilian objects is strictly prohibited under international humanitarian law. Carrying out such attacks knowingly and deliberately constitutes a war crime,” said Erika Guevara Rosas, Senior Director for Research, Advocacy, Policy and Campaigns. 

    It is believed that Evin prison held around 1,500-2,000 prisoners at the time of the attack, including arbitrarily detained human rights defenders, protesters, political dissidents, members of persecuted religious minorities, and dual and foreign nationals frequently held for diplomatic leverage. At any given time, there were also hundreds of other civilians in the prison complex. The attack took place during prison visitation hours. 

    “The Israeli forces should have known that any air strikes against Evin prison could result in significant civilian harm. Prosecution authorities around the world must ensure that all those responsible for this deadly attack are brought to justice, including through use of the principle of universal jurisdiction. The Iranian authorities must also grant the International Criminal Court jurisdiction over all Rome Statute crimes committed on or perpetrated from its territory, said Erika Guevara Rosas. 

    An overview of Evin prison, with the exterior walled perimeter marked in orange. The six yellow circles highlight areas with the most significant destruction, indicating these were the locations where the munitions landed. The blasts and resulting damage extended beyond the six areas. 
    A map of Evin prison indicating building names or functions based on Amnesty International’s interviews with former prisoners. 
    Scores of civilians killed and injured  

    Between 11am to 12pm Tehran time on 23 June 2025, Israeli air strikes hit multiple locations over 500 metres apart inside Evin prison, destroying or damaging numerous buildings and other structures within the prison complex, as well as nearby residential buildings outside the complex.  

    Evin prison is located in a populated area with residential buildings to its east and south. A nearby resident described the scene following the attack to Amnesty International: 

    “I suddenly heard a terrible sound. I looked out of the window and realised that smoke and dust were rising from Evin prison. Both the sound of the explosion and the appearance of the dust and smoke were horrific… I had thought our home would be safe [as] we are near a prison… I couldn’t believe it.” 

    The authorities have so far named 57 civilians who were killed in the attack including five female social workers, 13 young men performing mandatory national service as prison guards or administrators, and 36 other prison staff – 30 men and six women – and the child of one of the social workers. After drawing public criticism for failing to disclose the identities of prisoners, their relatives and nearby residents killed, the authorities published a report on 14 July 2025 revealing two names: a nearby resident – Mehrangiz Imanpour – and a woman volunteering to help raise funds for debt prisoners – Hasti Mohammadi. Amnesty International had already verified the name of Mehrangiz Imanpour, as well as the names of one prisoner, Masoud Behbahani, a prisoner’s relative, Leila Jafarzadeh, and a passerby Aliasghar Pazouki, who were also killed. 

    Israeli officials’ self-incriminating admissions  

    Within hours of the attack, senior Israeli officials boasted about it on social media, framing it as a “targeted strike” against a “symbol of oppression for the Iranian people.” 

    Israel’s Defence Minister, Israel Katz, said on X that Israeli forces were attacking with “unprecedented force regime targets and government repression bodies in the heart of Tehran including…Evin prison.” 

    Minutes later, Foreign Affairs Minister Gideon Sa’ar posted on X: “We warned Iran time and again: stop targeting civilians! They continued, including this morning. Our response: [Long live freedom…].” Alongside this post was a video purporting to show CCTV footage of the prison gate being blown up. Analysis of the video by Amnesty International indicates the footage was digitally manipulated likely using an old photograph of the prison gate. The video was first posted on Persian-language Telegram channels, but Amnesty International could not trace its original source. 

    Later the same day, the Israeli military confirmed in a statement that they had carried out “a targeted strike” on “the notorious Evin Prison”. The statement appeared to justify the attack by saying that “enemies of the regime” were held and tortured there and alleging that “intelligence operations against the State of Israel, including counter espionage” were carried out in the prison. However, the interrogation of detainees accused of spying for Israel or the presence of intelligence officials within the prison compound would not render the penal facility itself a legitimate military objective under international humanitarian law. 

    Entrance gate and prosecution office in the south 

    Before and after false-colour, near infrared satellite imagery from 10 April 2025 and 30 June 2025 reveals the destruction in four distinct locations in the south and central parts of Evin prison where munitions likely landed (shown with yellow circles) and signs of burning (visible in near-infrared in dark black hues) in many areas, likely from vehicles that caught fire and spread to buildings in the area.  

    In the south of the prison, the main entrance gate, along with the adjoining wall and the visitor information building to the east of the gate were destroyed. The building to the west of the gate and the adjoining Shahid Moghaddas prosecution office were extensively damaged. Further inside the southern part of the prison, the car park and a building next to the Quarantine section were damaged. 

    An informed source told Amnesty International that a woman named Leila Jafarzadeh, 35, was killed while visiting the prosecution office to post bail to secure the release of her imprisoned husband. 

    The destruction of the entrance gate and its surroundings was captured in a verified video showing rescue workers carrying at least one injured person on a stretcher amid scenes of destruction and extensive rubble on the ground. 

    Footage published by state media and verified by Amnesty International also shows structural damage to the prosecution office’s walls and building framework, indicating that the force of the blast penetrated deep into the building. 

    Satellite imagery from 30 June 2025 reveals a location (shown with a yellow circle) where munitions likely landed. Ground images (right) geolocated to the north and south areas of the southern entrance gate show major destruction. 
    Administrative building and quarantine section housing prisoners  

    Deeper inside the southern area of the prison, the administrative building and a smaller adjoining building which, according to a former prisoner, contained an office of the prison’s security force called the Protection Cohort, were significantly impacted, while several nearby structures were destroyed. 

    Satellite imagery from 30 June 2025 shows significant damage to part of the roof on the west side of the Protection Cohort building. Satellite imagery further shows that to the east of the building, an internal gate, perimeter wall and two small structures – likely guard posts – were all destroyed in the strike. 

    The two identified locations are consistent with the analysis of video footage and information received from two former prisoners of conscience Atena Daemi and Hossein Razagh.  

    Verified videos also depict destroyed windows, collapsed walls and extensive rubble on both the western and eastern sides of the administrative building. The first floor appears to be largely obliterated, with missing structural walls visible in multiple sections. 

    An image published by state media and verified by Amnesty International shows what appears to be a crater inside the west side of the administrative building showing the first floor collapsed downward. 

    According to a state media report on 6 July 2025, at least nine women, one man and a child were killed in the administrative building. Shargh Daily and Hammihan, two prominent newspapers in Iran, named three of the victims in reports published on 25 June and 1 July 2025, respectively. They included social worker Zahra Ebadi, 52, who was killed along with her five-year-old son, Mehrad Kheiri; and an administrative staff member, Hamid Ranjbari, 40. 

    Satellite imagery (left) from 30 June 2025 reveals two locations (shown with yellow circles) where munitions likely landed. Ground images (right) show extensive damage to the administrative building. 

    Analysis of a verified video footage also shows that the quarantine section housing newly admitted prisoners, located near the administrative building, also sustained damage. 

    Medical clinic, kitchen and sections housing prisoners in the central part 

    In the central part of the prison, the medical clinic, central kitchen, section 4 housing male prisoners, section 209 which consists of solitary confinement cells where female and male prisoners are detained by the Minister of Intelligence, and the women’s section were extensively damaged. 

    Satellite imagery shows significant damage to structures adjacent to the medical clinic, while verified videos reveal damage to the clinic from the blast and burning cars.  

    A verified video shows the outside of the medical clinic covered in black soot and black smoke billowing from the windows. Another video shows significant destruction inside, with shattered windows, beds and medical equipment overturned and extensive rubble. 

    Satellite imagery (left) from 30 June 2025 reveals two locations (shown with yellow circles) where munitions likely landed. Geolocated photos and videos (right) show that the vehicle entrance gate collapsed. The clinic’s interior was significantly damaged, with walls and windows blown out, while the exterior shows severe fire damage and smoke.  

    The verified video evidence supports accounts from human rights defenders Narges Mohammadi and Sepideh Gholian, both based in Iran, who told Amnesty International that multiple eyewitnesses in Evin prison described to them extensive damage to the medical clinic. Narges Mohammadi shared that male prisoners in section 4, which is opposite the medical clinic, informed her the prison’s ambulance was destroyed, an account supported by video showing nearby vehicles reduced to wreckage. She also said the prisoners told her they witnessed an individual with extensive burns on their body walking out of the medical clinic and collapsing on the ground. 

    Two prisoners – Abolfazl Ghodiani and Mehdi Mahmoudian – who survived the Evin prison attack and were transferred to Greater Tehran Penitentiary wrote in a letter from inside prison published online on 1 July 2025: 

    “Evin prison shook with several consecutive explosions. Two or three blasts occurred near Section 4 and when prisoners exited the section’s door, they saw the medical clinic burning… Prisoners recovered the bodies of around 15-20 people, including medical clinic personnel, prisoners, warehouse staff, guards and agents from beneath the rubble.” 

    Saeedeh Makarem, a doctor volunteering in Evin prison who was injured, including with burns, described in a series of posts on Instagram in July 2025 how prisoners helped her:  

    “They dragged me to the corner of the wall. I was half-conscious. They brought me water and a blanket, put a splint in my leg, wiped the blood from my face… They could have left, but they didn’t… They saved me.” 

    Political dissident Hossein Razagh also told Amnesty International that section 4 prisoners described to him how prisoners were thrown against the walls due to the force of the blast and sustained head and face injuries. 

    These testimonies are corroborated by a verified video showing extensive damage to the front parts of sections 4 and 209. External doors and windows of sections 4 and 209 appear to have been shattered, with parts of the roof structure collapsed and large piles of rubble visible in the road.Multiple vehicles are destroyed and burned out, with black smoke damage on the surrounding building walls, indicating some of the fire may have originated from the cars. Satellite imagery from 30 June 2025 shows the burned buildings and black scorch marks from the cars The blast also appears to have affected the roof of the prison kitchen and damaged its windows. 

    According to Amnesty International’s research, the blast also affected section 209 staff offices, trapping some agents and guards under the rubble. Authorities have provided no information about the fate and whereabouts of prisoners held in solitary confinement in section 209, raising concerns about possible deaths or injuries. 

    Image showing the road with Section 209 on one side (left) and the vehicle entrance gate on the opposite side (right). 

    Amnesty International confirmed through an informed source the name of a prisoner in section 4, Masoud Behbahani, aged 71, who was killed. He suffered a heart attack when the blast threw him onto a chair and several prisoners fell on him. According to the source, instead of transferring him to a hospital, authorities transferred him to Greater Tehran Penitentiary where he died two days later after a second heart attack. 

    Amnesty International also analysed an image taken from inside the Women’s section showing visible damage to the ceiling and electrical infrastructure. 

    Entrance gate, judicial complex, visitation building and sections housing prisoners in the North 

    Before and after false-colour, near infrared imagery from 10 April 2025 and 27 June 2025 reveals the destruction in two distinct locations where munitions likely landed in the northern part of Evin prison (shown with yellow circles): the internal security walls and road in front of sections 240 and 241 and the north entrance gate in front of the visitation building and Shaheed Kachouyee judicial complex. 

    In the northern part of the prison, as visible in satellite imagery and verified videos, the entrance gate and adjacent wall were destroyed; the front part of the building containing the Shahid Kachouyee judicial complex and visitation building were extensively damaged; and two internal walls near sections 240 and 241 housing prisoners were destroyed. 

    Verified video and photographs also show blast-related damage to nearby high-rise residential buildings and vehicles outside the northern area of Evin prison. One video captures dozens of distressed people in Ahmadpour Street, at least one of whom appears to be injured. 

    An informed source described to Amnesty International how a nearby resident, Mehrangiz Imanpour, a 61-year-old painter who lived in Ahmadpour Street, was killed on her way home. 

    Shargh Daily reported that another passerby, Ali Asghar Pazouki, 69, was killed in front of the judicial complex and visitation building. 

    State media published videos and photographs which show blast damage in this area.  

    Satellite imagery (left) from 30 June 2025 reveals a location (shown with a yellow circle) where munitions likely landed. Geolocated images and videos (right) show extensive damage to the exterior and interior of the visitation building with windows shattered and parts of the roof and facade collapsed.  

    Satellite imagery analysed by Amnesty International indicates that a road and two security walls deeper within the northern part of the prison, near a building containing sections 240 and 241, were also destroyed. These sections are known to contain hundreds of solitary confinement cells, but no images showing the condition of the building have emerged and the authorities have not released any information about the fate of prisoners held there. 

    Amnesty International received accounts from prisoners’ families indicating that section 8, near sections 240 and 241, was damaged. Human rights lawyer Nasrin Sotoudeh told Amnesty International that her arbitrarily imprisoned husband, human rights defender, Reza Khandan, and other prisoners, were injured when rubble was propelled into the courtyard. 

    Political dissident Mohammad Nourizad, who was in section 8, called his family while the air strikes were ongoing. A recording of his call was published online on 24 June: 

    “They are dropping bombs on us. Some people are injured, the windows have broken, and everyone has scattered… They just hit again. I don’t know, it seems intentional… but bombing a prison is incompatible with any logic or code of conduct…They [prison authorities] closed the doors on us and we have no news.” 

    International law and standards 

    Under international humanitarian law, direct attacks on civilians and civilian objects are prohibited. Attacks may only be directed at combatants and military objectives. Military objectives are limited to those objects which by their nature, location, purpose or use make an effective contribution to military action and whose partial or total destruction, capture or neutralization, in the circumstances ruling at the time, offers a definite military advantage.  

    Attacking forces have an obligation to do everything feasible to protect civilians including by distinguishing between military targets and civilian objects; verifying whether their intended target is a military objective and canceling an attack if there is doubt; choosing means and methods of attack that will avoid, or in any event, minimize civilian harm; and providing effective advance warning to civilians unless circumstances do not permit. Even when targeting a legitimate military objective, an attack must not be carried out which may cause civilian harm that would be disproportionate in relation to the concrete and direct military advantage anticipated. If distinguishing between civilian objects and military targets is not feasible, the attack must not proceed. 

    States responsible for violations of international humanitarian law are required to make full reparations for the loss or injury caused. The UN Basic Principles and Guidelines on the Right to a Remedy and Reparation for Victims of Gross Violations of International Human Rights Law and Serious Violations of International Humanitarian Law enshrine the duty of states to provide effective remedies, including reparation to victims, including restitution, compensation, rehabilitation, satisfaction and guarantees of non-repetition. 

    Methodology 

    Amnesty International’s Evidence Lab analyzed satellite images from before and after the strikes and verified 22 videos and 59 photographs, which show extensive damage and destruction to six areas in the south, central, and northern parts of Evin prison complex.  

    Additionally, Amnesty International reviewed statements by Israeli and Iranian authorities and interviewed 23 people inside and outside Iran, including seven prisoners’ relatives; a nearby resident who witnessed the attack; two sources with information about two victims killed; two journalists; and 11 former prisoners including dissidents and human rights defenders who received information from prisoners, prisoners’ families, prison staff and emergency services attending the site. The organization also obtained from a source the recordings of four telephone calls between four prisoners and their families hours after the attack. 

    Amnesty International sent questions regarding the attack to the Israeli Minister of Defence on 3 July. At the time of publication, no response had been received. 

    Background 

    During the escalation of hostilities between Israel and Iran, at least 1,100 people were killed in Iran, including 132 women and 45 children, according to Iran’s Foundation for Martyrs and Veterans Affairs. At least 29 people, including women and children, were killed in Israel, according to the Israeli Health Ministry. 

    As part of Amnesty International’s ongoing investigations into violations of international humanitarian law and other human rights violations in the context of the escalation of hostilities between Israel and Iran, the organization will also publish findings relating to attacks by the Iranian authorities against Israel. 

    MIL OSI NGO –

  • MIL-OSI NGOs: Iran: Deliberate Israeli attack on Tehran’s Evin prison must be investigated as a war crime – new evidence

    Source: Amnesty International –

    Video footage, satellite imagery, and eyewitness accounts reveal extensive civilian casualties and destruction

    According to Iranian authorities, at least 80 civilians – 79 men and women and a five-year-old boy – were killed

    Israeli military quickly claimed responsibility for the attack – senior officials boasted about it online

    ‘The evidence establishes reasonable grounds to believe that the Israeli military brazenly and deliberately attacked civilian buildings’ – Erika Guevara Rosas

    The Israeli military’s deliberate air strikes on Evin prison in Tehran on 23 June constitute a serious violation of international humanitarian law and must be criminally investigated as war crimes, Amnesty International said today following a detailed investigation. 

    Verified video footage, satellite imagery, and interviews with eyewitnesses, prisoners’ families and human rights defenders indicate that the Israeli military carried out multiple air strikes on Evin prison, killing and injuring scores of civilians and causing extensive damage and destruction in at least six locations across the prison complex.

    The attack occurred during the working day and prison visiting hours, when many parts of Evin prison were packed with civilians. At the time, the prison reportedly held between 1,500 and 2,000 detainees, including arbitrarily detained human rights defenders, protesters, political dissidents, persecuted religious minorities, and dual or foreign nationals often used as diplomatic leverage. Hundreds of civilians were also present within the complex. Hours after the strike, the Israeli military confirmed the attack, with senior officials publicly boasting about it on social media. According to Iranian authorities, at least 80 civilians – 79 men and women and a five-year-old boy – were killed.

    Under international humanitarian law, a prison or place of detention is presumed a civilian object and there is no credible evidence in this case that Evin prison constituted a lawful military objective. 

    Erika Guevara Rosas, Amnesty International’s Senior Director for Research, Advocacy, Policy and Campaigns, said:

    “The evidence establishes reasonable grounds to believe that the Israeli military brazenly and deliberately attacked civilian buildings. Directing attacks at civilian objects is strictly prohibited under international humanitarian law. Carrying out such attacks knowingly and deliberately constitutes a war crime.

    “The Israeli forces should have known that any air strikes against Evin prison could result in significant civilian harm. Prosecution authorities around the world must ensure that all those responsible for this deadly attack are brought to justice, including through use of the principle of universal jurisdiction. The Iranian authorities must also grant the International Criminal Court jurisdiction over all Rome Statute crimes committed on or perpetrated from its territory.”

    Scores of civilians killed and injured  

    Between 11am to 12pm Tehran time on 23 June, Israeli air strikes hit multiple locations over 500 metres apart inside Evin prison, destroying or damaging numerous buildings and other structures within the prison complex, as well as nearby residential buildings outside it.  

    An overview of Evin prison, with the exterior walled perimeter marked in orange. The six yellow circles highlight areas with the most significant destruction, indicating these were the locations where the munitions landed. The blasts and resulting damage extended beyond the six areas. 
    A map of Evin prison indicating building names or functions based on Amnesty’s interviews with former prisoners. 

    Evin prison is located in a populated area with residential buildings to its east and south. A nearby resident described the scene following the attack to Amnesty: 

    “I suddenly heard a terrible sound. I looked out of the window and realised that smoke and dust were rising from Evin prison. Both the sound of the explosion and the appearance of the dust and smoke were horrific… I had thought our home would be safe [as] we are near a prison… I couldn’t believe it.” 

    The authorities have so far named 57 civilians who were killed in the attack including five female social workers, 13 young men performing mandatory national service as prison guards or administrators, and 36 other prison staff – 30 men and six women – and the child of one of the social workers. After drawing public criticism for failing to disclose the identities of prisoners, their relatives and nearby residents who were killed, the authorities published a report on 14 July revealing two names: a nearby resident – Mehrangiz Imanpour – and a woman volunteering to help raise funds for debt prisoners – Hasti Mohammadi.

    Amnesty had already verified the name of Mehrangiz Imanpour, as well as the names of one prisoner, Masoud Behbahani, a prisoner’s relative, Leila Jafarzadeh, and a passerby Aliasghar Pazouki, who were also killed. 

    Israeli officials’ self-incriminating admissions  

    Within hours of the attack, senior Israeli officials boasted about it on social media, framing it as a “targeted strike” against a “symbol of oppression for the Iranian people.” 

    Israel’s Defence Minister, Israel Katz, said on X that Israeli forces were attacking with “unprecedented force regime targets and government repression bodies in the heart of Tehran including…Evin prison”. 

    Minutes later, Foreign Affairs Minister Gideon Sa’ar posted on X: “We warned Iran time and again: stop targeting civilians! They continued, including this morning. Our response: [Long live freedom…].” Alongside this post was a video purporting to show CCTV footage of the prison gate being blown up. Analysis of the video by Amnesty indicates the footage was digitally manipulated likely using an old photograph of the prison gate. The video was first posted on Persian-language Telegram channels, but Amnesty could not trace its original source. 

    Later the same day, the Israeli military confirmed in a statement that they had carried out “a targeted strike” on “the notorious Evin prison”. The statement appeared to justify the attack by saying that “enemies of the regime” were held and tortured there and alleging that “intelligence operations against the State of Israel, including counter espionage” were carried out in the prison. However, the interrogation of detainees accused of spying for Israel or the presence of intelligence officials within the prison compound would not render the penal facility itself a legitimate military objective under international humanitarian law. 

    Entrance gate and prosecution office in the south

    In the south of the prison, the main entrance gate, along with the adjoining wall and the visitor information building to the east of the gate were destroyed. The building to the west of the gate and the adjoining Shahid Moghaddas prosecution office were extensively damaged. Further inside the southern part of the prison, the car park and a building next to the quarantine section were damaged.

    Before and after: false-colour, near infrared satellite imagery from 10 April and 30 June reveal the destruction in four distinct locations in the south and central parts of Evin prison where munitions likely landed (shown with yellow circles) and signs of burning (visible in near-infrared in dark black hues) in many areas, likely from vehicles that caught fire and spread to buildings in the area.  

    An informed source told Amnesty that a woman named Leila Jafarzadeh, 35, was killed while visiting the prosecution office to post bail in order to secure the release of her imprisoned husband.

    The destruction of the entrance gate and its surroundings was captured in a verified video showing rescue workers carrying at least one injured person on a stretcher amid scenes of destruction and extensive rubble on the ground. 

    Footage published by state media and verified by Amnesty also shows structural damage to the prosecution office’s walls and building framework, indicating that the force of the blast penetrated deep into the building. 

    Satellite imagery from 30 June reveals a location (shown with a yellow circle) where munitions likely landed. Ground images (right) geolocated to the north and south areas of the southern entrance gate show major destruction. 

    Administrative building and quarantine section housing prisoners  

    Deeper inside the southern area of the prison, the administrative building and a smaller adjoining building which, according to a former prisoner, contained an office of the prison’s security force called the Protection Cohort, were significantly impacted, while several nearby structures were destroyed. 

    Satellite imagery from 30 June shows significant damage to part of the roof on the west side of the Protection Cohort building. Satellite imagery further shows that to the east of the building, an internal gate, perimeter wall and two small structures – likely guard posts – were all destroyed in the strike. 

    The two identified locations are consistent with the analysis of video footage and information received from two former prisoners of conscience Atena Daemi and Hossein Razagh.  

    Verified videos also depict destroyed windows, collapsed walls and extensive rubble on both the western and eastern sides of the administrative building. The first floor appears to be largely obliterated, with missing structural walls visible in multiple sections. 

    An image published by state media and verified by Amnesty shows what appears to be a crater inside the west side of the administrative building showing the first floor collapsed downward. 

    According to a state media report on 6 July, at least nine women, one man and a child were killed in the administrative building. Shargh Daily and Hammihan, two prominent newspapers in Iran, named three of the victims in reports published on 25 June and 1 July, respectively. They included social worker Zahra Ebadi, 52, who was killed along with her five-year-old son, Mehrad Kheiri; and an administrative staff member, Hamid Ranjbari, 40. 

    Satellite imagery (left) from 30 June reveals two locations (shown with yellow circles) where munitions likely landed. Ground images (right) show extensive damage to the administrative building. 

    Analysis of a verified video footage also shows that the quarantine section housing newly admitted prisoners, located near the administrative building, also sustained damage. 

    Medical clinic, kitchen and sections housing prisoners in the central part 

    In the central part of the prison, the medical clinic, central kitchen, section 4 housing male prisoners, section 209 which consists of solitary confinement cells where female and male prisoners are detained by the Minister of Intelligence, and the women’s section were extensively damaged. 

    Satellite imagery shows significant damage to structures adjacent to the medical clinic, while verified videos reveal damage to the clinic from the blast and burning cars.  

    A verified video shows the outside of the medical clinic covered in black soot and black smoke billowing from the windows. Another video shows significant destruction inside, with shattered windows, beds and medical equipment overturned and extensive rubble. 

    Satellite imagery (left) from 30 June reveals two locations (shown with yellow circles) where munitions likely landed. Geolocated photos and videos (right) show that the vehicle entrance gate collapsed. The clinic’s interior was significantly damaged, with walls and windows blown out, while the exterior shows severe fire damage and smoke.  

    The verified video evidence supports accounts from human rights defenders Narges Mohammadi and Sepideh Gholian, both based in Iran, who told Amnesty that multiple eyewitnesses in Evin prison described to them extensive damage to the medical clinic.

    Narges Mohammadi said that male prisoners in section 4, which is opposite the medical clinic, informed her the prison’s ambulance was destroyed, an account supported by video showing nearby vehicles reduced to wreckage. She also said the prisoners told her they witnessed an individual with extensive burns on their body walking out of the medical clinic and collapsing on the ground. 

    Two prisoners – Abolfazl Ghodiani and Mehdi Mahmoudian – who survived the Evin prison attack and were transferred to Greater Tehran Penitentiary wrote in a letter from inside prison, which was published online on 1 July: 

    “Evin prison shook with several consecutive explosions. Two or three blasts occurred near Section 4 and when prisoners exited the section’s door, they saw the medical clinic burning… Prisoners recovered the bodies of around 15-20 people, including medical clinic personnel, prisoners, warehouse staff, guards and agents from beneath the rubble.” 

    Saeedeh Makarem, a doctor volunteering in Evin prison who was injured, including with burns, described in a series of posts on Instagram in July how prisoners helped her: 

    “They dragged me to the corner of the wall. I was half-conscious. They brought me water and a blanket, put a splint in my leg, wiped the blood from my face… They could have left, but they didn’t… They saved me.” 

    Political dissident Hossein Razagh also told Amnesty that section 4 prisoners described to him how prisoners were thrown against the walls due to the force of the blast and sustained head and face injuries. 

    These testimonies are corroborated by a verified video showing extensive damage to the front parts of sections 4 and 209. External doors and windows of sections 4 and 209 appear to have been shattered, with parts of the roof structure collapsed and large piles of rubble visible in the road. Multiple vehicles are destroyed and burned out, with black smoke damage on the surrounding building walls, indicating some of the fire may have originated from the cars. Satellite imagery from 30 June shows the burned buildings and black scorch marks from the cars. The blast also appears to have affected the roof of the prison kitchen and damaged its windows. 

    According to Amnesty’s research, the blast also affected section 209 staff offices, trapping some agents and guards under the rubble. Authorities have provided no information about the fate and whereabouts of prisoners held in solitary confinement in section 209, raising concerns about possible deaths or injuries. 

    Image showing the road with Section 209 on one side (left) and the vehicle entrance gate on the opposite side (right). 

    Amnesty confirmed through an informed source the name of a prisoner in section 4, Masoud Behbahani, aged 71, who was killed. He suffered a heart attack when the blast threw him onto a chair and several prisoners fell on him. According to the source, instead of transferring him to a hospital, authorities transferred him to Greater Tehran Penitentiary where he died two days later after a second heart attack.

    Amnesty also analysed an image taken from inside the women’s section showing visible damage to the ceiling and electrical infrastructure.

    Entrance gate, judicial complex, visitors’ building and sections housing prisoners in the north

    In the northern part of the prison, as visible in satellite imagery and verified videos, the entrance gate and adjacent wall were destroyed; the front part of the building containing the Shahid Kachouyee judicial complex and visitors’ building were extensively damaged; and two internal walls near sections 240 and 241 housing prisoners were destroyed.

    Verified video and photographs also show blast-related damage to nearby high-rise residential buildings and vehicles outside the northern area of Evin prison. One video shows dozens of distressed people in Ahmadpour Street, at least one of whom appears to be injured. 

    Before and after false-colour, near infrared imagery from 10 April and 27 June reveals the destruction in two distinct locations where munitions likely landed in the northern part of Evin prison (shown with yellow circles): the internal security walls and road in front of sections 240 and 241 and the north entrance gate in front of the visitation building and Shaheed Kachouyee judicial complex. 

    An informed source described to Amnesty how a nearby resident, Mehrangiz Imanpour, a 61-year-old painter who lived in Ahmadpour Street, was killed on her way home. 

    Shargh Daily reported that another passerby, Ali Asghar Pazouki, 69, was killed in front of the judicial complex and visitors’ building. State media published videos and photographs which show blast damage in this area.  

    Satellite imagery (left) from 30 June reveals a location (shown with a yellow circle) where munitions likely landed. Geolocated images and videos (right) show extensive damage to the exterior and interior of the visitors’ building with windows shattered and parts of the roof and facade collapsed.  

    Satellite imagery analysed by Amnesty indicates that a road and two security walls deeper within the northern part of the prison, near a building containing sections 240 and 241, were also destroyed. These sections are known to contain hundreds of solitary confinement cells, but no images showing the condition of the building have emerged and the authorities have not released any information about the fate of prisoners held there.

    Amnesty received accounts from prisoners’ families indicating that section 8, near sections 240 and 241, was damaged. Human rights lawyer Nasrin Sotoudeh told Amnesty that her arbitrarily imprisoned husband, human rights defender, Reza Khandan, and other prisoners, were injured when rubble was propelled into the courtyard. 

    Political dissident Mohammad Nourizad, who was in section 8, called his family while the air strikes were ongoing. A recording of his call was published online on 24 June: 

    “They are dropping bombs on us. Some people are injured, the windows have broken, and everyone has scattered… They just hit again. I don’t know, it seems intentional… but bombing a prison is incompatible with any logic or code of conduct…They [prison authorities] closed the doors on us and we have no news.” 

    International law and standards 

    Under international humanitarian law, direct attacks on civilians and civilian objects are prohibited. Attacks may only be directed at combatants and military objectives. Military objectives are limited to those objects which by their nature, location, purpose or use make an effective contribution to military action and whose partial or total destruction, capture or neutralisation, in the circumstances ruling at the time, offers a definite military advantage.  

    Attacking forces have an obligation to do everything feasible to protect civilians including by distinguishing between military targets and civilian objects; verifying whether their intended target is a military objective and cancelling an attack if there is doubt; choosing means and methods of attack that will avoid, or in any event, minimise civilian harm; and providing effective advance warning to civilians unless circumstances do not permit.

    Even when targeting a legitimate military objective, an attack must not be carried out which may cause civilian harm that would be disproportionate in relation to the concrete and direct military advantage anticipated. If distinguishing between civilian objects and military targets is not feasible, the attack must not proceed. 

    Governments responsible for violations of international humanitarian law are required to make full reparations for the loss or injury caused. The UN Basic Principles and Guidelines on the Right to a Remedy and Reparation for Victims of Gross Violations of International Human Rights Law and Serious Violations of International Humanitarian Law enshrine the duty of states to provide effective remedies, including reparation to victims, including restitution, compensation, rehabilitation, satisfaction and guarantees of non-repetition.

    Evidence gathered

    Amnesty’s Evidence Lab analysed satellite images from before and after the strikes and verified 22 videos and 59 photographs, which show extensive damage and destruction to six areas in the south, central, and northern parts of Evin prison complex. 

    Additionally, Amnesty reviewed statements by Israeli and Iranian authorities and interviewed 23 people inside and outside Iran, including seven prisoners’ relatives; a nearby resident who witnessed the attack; two sources with information about two victims killed; two journalists; and 11 former prisoners including dissidents and human rights defenders who received information from prisoners, prisoners’ families, prison staff and emergency services attending the site. Amnesty also obtained from a source the recordings of four telephone calls between four prisoners and their families hours after the attack.

    Amnesty sent questions regarding the attack to the Israeli Minister of Defence on 3 July. At the time of publication, no response had been received.

    As part of Amnesty’s ongoing investigations into violations of international humanitarian law and other human rights violations in the context of the escalation of hostilities between Israel and Iran, Amnesty will also publish findings relating to attacks by the Iranian authorities against Israel.

    Urgent action

    Take action to support hundreds of displaced prisoners from Tehran’s Evin Prison, who are currently being held in cruel and inhuman conditions. See Amnesty’s Urgent Action for how to help.

    MIL OSI NGO –

  • MIL-OSI Asia-Pac: Hong Kong Customs detects money laundering case involving about $1.15 billion

    Source: Hong Kong Government special administrative region

    Hong Kong Customs detects money laundering case involving about $1.15 billion 
    Acting upon intelligence, Customs officers earlier targeted a 37-year-old local man and a 50-year-old non-local man and initiated a financial investigation. It was revealed that the duo smuggled cash out of Hong Kong, and conducted stablecoin and fiat currency transactions with a doubtful fund source at a frequent and fast pace, which was highly incommensurate with their background and financial status. They were suspected of participating in money laundering activities.
     
    Following in-depth investigations, Customs officers this morning raided four residential premises and two companies and seized a batch of items suspected to be connected with the case, including mobile phones, tablets and bank cards. The two men, who claimed to be self-employed and unemployed respectively, were arrested for “dealing with property known or reasonably believed to represent proceeds of an indictable offence” (commonly known as money laundering) under the Organized and Serious Crimes Ordinance (OSCO).
     
    An investigation is ongoing. The two arrested persons have been released on bail pending further investigation. The likelihood of further arrests is not ruled out.
     
    Under OSCO, a person commits an offence if he or she deals with any property knowing or having reasonable grounds to believe that such property in whole or in part directly or indirectly represents any person’s proceeds of an indictable offence. The maximum penalty upon conviction is a fine of $5 million and imprisonment for 14 years while the crime proceeds are also subject to confiscation.
     
    Members of the public may report any suspected money laundering activities to Customs’ 24-hour hotline 182 8080 or its dedicated crime-reporting email account (crimereport@customs.gov.hkIssued at HKT 18:40

    NNNN

    MIL OSI Asia Pacific News –

  • MIL-OSI Africa: Bogus lawyer sentenced to prison

    Source: Government of South Africa

    Tuesday, July 22, 2025

    A bogus lawyer has been sentenced to six years of direct imprisonment after his conviction on multiple charges, including three counts of fraud, one count of theft, two counts of forgery, and two counts of uttering.

    According to the National Prosecuting Authority (NPA), Johannes Tebogo Motse posed as a legal practitioner – “unlawfully representing unsuspecting clients in various courts during 2022”.

    “He forged critical legal documents, including a right of appearance certificate, a fidelity fund certificate and an admission certificate to deceive his victims.

    “One of the complainants paid Motse R15 000 to prosecute an appeal. After receiving no legal service, the client reported the matter to the police. Investigations revealed that Motse was not registered with the Legal Practice Council of South Africa,” the NPA said.

    He pleaded guilty to all charges and was sentenced in the Specialised Commercial Crime Court sitting in Rustenburg.
    “In aggravation of sentence, State Advocate Matshidiso Ramakgaphola highlighted the prevalence of such crimes in the court’s jurisdiction and emphasised that the offences were premeditated and meticulously executed.

    “The charges of fraud, forgery, and uttering were taken together for sentencing, and he received six years of direct imprisonment. On the charge of theft, he was sentenced to two years’ imprisonment, wholly suspended for five years on condition that he repays the complainant R15 000 by 31 August 2025. 

    “He was also declared unfit to possess a firearm under Section 103 of the Firearms Control Act 60 of 2000,” the NPA said.

    Director of Public Prosecutions in the North West, Dr Rachel Makhari, said: “These sentences underscore the NPA’s commitment to combating bogus legal practitioners and protecting the integrity of the legal profession and the public”. – SAnews.gov.za

    MIL OSI Africa –

  • MIL-OSI Africa: Breakthrough arrests in DJ Sumbody murder case

    Source: Government of South Africa

    Tuesday, July 22, 2025

    Four men have been arrested in connection with the murder of Oupa John Sefoka, popularly known as DJ Sumbody.

    Sefoka was killed in a shooting in November 2022.

    The National Commissioner of the South Africa Police Service (SAPS), General Fannie Masemola, has welcomed the latest breakthrough by the SAPS Political Killings Task Team working closely with Gauteng Organised Crime Detectives.

    Gauteng organised crime detectives worked on the case and later roped in the SAPS Political Killings Task Team.

    “The arrests were all effected in Gauteng on Monday afternoon and three of the suspects are believed to be hitmen and one is believed to have ordered the hit on the DJ.

    “The weapon allegedly used in the commission of the crime was seized and has since been linked to other murders,” said the police in a statement.

    All four suspects, aged between 45 and 60, are in police custody and are expected to appear in court soon. They are facing charges including murder and conspiracy to commit murder. 

    Masemola said this was a significant breakthrough that would hopefully provide closure to families involved.

    “Well done to the teams that have been piecing together evidence since November 2022. This is a culmination of hard work and dedication to justice. This is one of those complex cases that our teams needed to take their time in ensuring a thorough investigation so that we could ultimately bring a strong case before court,” he said. – SAnews.gov.za

    MIL OSI Africa –

  • MIL-OSI United Kingdom: UK to lead crackdown on cyber criminals with ransomware measures

    Source: United Kingdom – Executive Government & Departments

    News story

    UK to lead crackdown on cyber criminals with ransomware measures

    Measures to tackle the threat of ransomware and protect businesses and critical services will be taken forward with industry following public consultation.

    Image: Getty Images

    Hospitals, businesses, and critical services are set to be protected under measures designed to crack down on cyber criminals and safeguard the public, following public consultation on ransomware proposals.

    Ransomware is software used maliciously by cyber criminals to access victims’ computer systems. Systems and data can be encrypted, or data stolen, until a ransom is paid. Ransomware is estimated to cost the UK economy millions of pounds each year, with recent high-profile ransomware attacks highlighting the severe operational, financial, and even life-threatening risks. 

    Public sector bodies and operators of critical national infrastructure, including the NHS, local councils and schools, would be banned from paying ransom demands to criminals under the measure, with nearly three quarters of consultation respondents showing support for the proposal.

    The ban would target the business model that fuels cyber criminals’ activities and makes the vital services the public rely on a less attractive target for ransomware groups.    

    Under the proposals, businesses not covered by the ban would be required to notify the government of any intent to pay a ransom. The government could then provide those businesses with advice and support, including notifying them if any such payment would risk breaking the law by sending money to sanctioned cyber criminal groups, many of whom are based in Russia.  

    Mandatory reporting is also being developed, which would equip law enforcement with essential intelligence to hunt down perpetrators and disrupt their activities, allowing for better support for victims. Consultation responses showed strong support for a new mandatory reporting regime to better protect British organisations and industry.

    The new package of measures will lead the way in tackling ransomware and are designed to strike against cyber criminals’ business model, bolstering our national security and protecting key services and businesses from disruption – delivering on our Plan for Change. They follow an extensive consultation with stakeholders across the UK which showed strong public backing for tougher action to tackle ransomware and protect vital services. 

    Security Minister Dan Jarvis said:  

    Ransomware is a predatory crime that puts the public at risk, wrecks livelihoods and threatens the services we depend on. 

    That’s why we’re determined to smash the cyber criminal business model and protect the services we all rely on as we deliver our Plan for Change. 

    By working in partnership with industry to advance these measures, we are sending a clear signal that the UK is united in the fight against ransomware.

    In addition to the proposed new measures, the government continues to urge organisations across the country to strengthen their ability to maintain operations in the event of a successful ransomware attack. This includes having offline backups, tested plans to operate without IT for an extended period, and a well-rehearsed strategy for restoring systems from backups. 

    Cyber criminals have not only cost the nation billions of pounds but in some cases have brought essential services to a standstill.   

    The devastating consequences are not just financial but can put lives in danger, with an NHS organisation recently identifying a ransomware attack as one of the factors that contributed to a patient’s death.

    These attacks have brutally exposed the alarming vulnerability at the core of our public and private institutions, from flagship British retailers and essential supermarkets including the Co-op to NHS hospitals.  

    British Library Chief Executive Rebecca Lawrence said:

    The British Library, which holds one of the world’s most significant collections of human knowledge, was the victim of a devastating ransomware attack in October 2023.

    The attack destroyed our technology infrastructure and continues to impact our users, however, as a public body, we did not engage with the attackers or pay the ransom. Instead, we are committed to sharing our experiences to help protect other institutions affected by cyber-crime and build collective resilience for the future.

    NCSC Director of National Resilience Jonathon Ellison said:

    These new measures help undermine the criminal ecosystem that is causing harm across our economy.

    Ransomware remains a serious and evolving threat, and organisations must not become complacent. All businesses should strengthen their defences using proven frameworks such as Cyber Essentials and our free Early Warning service, and be prepared to respond to incidents, recover quickly, and maintain continuity if the worst happens.

    Co-op CEO Shirine Khoury-Haq said:

    We know first-hand the damage and disruption cyber-attacks cause to businesses and communities. That’s why we welcome the government’s focus on Cyber Crime.

    What matters most is learning, building resilience, and supporting each other to prevent future harm. This is a step in the right direction for building a safer digital future.  

    These robust proposals are part of the government’s Plan for Change to defend businesses, services, and infrastructure against cyber threats to better protect the public.

    Updates to this page

    Published 22 July 2025

    MIL OSI United Kingdom –

  • MIL-OSI United Kingdom: UK brings forward world’s first sanctions regime to smash the gangs responsible for irregular migration 

    Source: United Kingdom – Executive Government & Departments

    Press release

    UK brings forward world’s first sanctions regime to smash the gangs responsible for irregular migration 

    Anyone complicit in facilitating people smuggling to the UK will be at risk of having their assets frozen and being banned from travelling to Britain, under new powers announced by the Foreign Secretary today.

    • Anyone complicit in facilitating people smuggling to the UK could be sanctioned from tomorrow.   
    • Targets will have assets frozen, be shut off from the UK financial system and banned from travelling to the UK, under new regime targeting supply of money and material enabling irregular migration. 
    • New sanctions are the latest tool in UK’s arsenal to secure Britain’s borders, reduce irregular migration and deliver on the Plan for Change.

    Anyone complicit in facilitating people smuggling to the UK will be at risk of having their assets frozen and being banned from travelling to Britain, under new powers announced by the Foreign Secretary today. 

    Tomorrow, the FCDO will impose the first wave of sanctions on gangs involved in people smuggling and driving irregular migration to the UK, as well as their enablers, such as financiers and companies involved in the sale of small boat equipment.   

    The plans are a key example of the FCDO using innovative foreign policy approaches to deliver on the Plan for Change for the British people. The regime will be the world’s first dedicated to targeting people smuggling and organised immigration crime, with the exploitation of vulnerable people by criminals and their associated networks being one of the key drivers of irregular migration to the UK. Migrants who pay people-smugglers are also at a high risk of working in modern slavery conditions in the informal economy, being returned to their home country, or losing their lives at sea.   

    Sanctions can disrupt the flow of money and materials – including freezing property, bank accounts and other assets – which allow organised criminal gangs to facilitate irregular migration to the UK. Sanctions are designed to reach individuals located anywhere in the world, who will be publicly named so that it is illegal for the UK financial system to engage with them.     

    As part of the government’s Plan for Change and mission-led approach, the FCDO has been breaking down siloes by working closely with investigators at the National Crime Agency, Border Security Command, and other key partners to identify the most impactful targets, with the first sanctions planned for tomorrow.  

    The first targets will cover a range of wrongdoing, from the supply of small boats being used on cross-Channel journeys, to the trade in fake passports, as well as middlemen facilitating payments through Hawala networks, to the gang leaders themselves.  

    The regime will complement new powers for law enforcement being introduced in the Border, Security, Asylum and Immigration Bill, ensuring we have the widest toolkit available to smash the gangs.  Sanctions can be used to target organised immigration crime gangs and their enablers, wherever they are, including where traditional law enforcement and criminal justice approaches cannot reach. People smuggling and human trafficking are a challenge to global security, and the Government is working to strengthen our relationships with key partners, including the EU, to better secure the UK’s borders.  

     Foreign Secretary, David Lammy, said:   

    For too long, criminal gangs have been lining their corrupt pockets and preying on the hopes of vulnerable people with impunity as they drive irregular migration to the UK. We will not accept this status quo. 

    It is our moral duty and a key part of our Plan for Change to do all we can to smash these gangs and secure Britain’s borders. 

    That’s why the UK has created the world’s first sanctions regime targeted at gangs involved in people smuggling and driving irregular migration, as well as their enablers. From tomorrow, those involved will face having their assets frozen, being shut off from the UK financial system and banned from travelling to the UK.

    Today’s announcement reflects how the whole of government is working together on the single mission of securing Britain’s borders. The new regime complements work by the National Crime Agency and Border Security Command (BSC) to tackle organised immigration crime and tackle the causes of irregular migration to the UK in source and transit countries. The BSC has seen a budget boost of £280m per year by 2028 to fund new specialist investigators, new technology and cutting-edge surveillance equipment to disrupt and destroy criminal gangs.   

    Home Secretary, Yvette Cooper, said:  

    The new sanctions regime marks a decisive step in our fight against the criminal gangs who profit from human misery. It will allow us to target the assets and operations of people-smugglers wherever they operate, cutting off their funding and dismantling their networks piece by piece. 

    Through the Border Security Command and key partners like the National Crime Agency, we are strengthening our ties with other nations to tackle this global problem. 

    Together, we are sending a clear message that there is no hiding place for those who exploit vulnerable people and put lives at risk for profit.

    Today’s announcement is part of the FCDO’s three-pronged ‘disrupt, deter, return’ strategy to tackle irregular migration globally. In addition to disrupting organised immigration crime networks through sanctions, the FCDO works with source and transit countries to deter would-be migrants from making a dangerous journey in the first place, and works with the Home Office to negotiate the return of people who have no right to be here to their countries of origin, including criminals and failed asylum seekers. Since the election, over 35,000 people have been returned, up 13% on the same period in the year before.   

    Media enquiries

    Email newsdesk@fcdo.gov.uk

    Telephone 020 7008 3100

    Email the FCDO Newsdesk (monitored 24 hours a day) in the first instance, and we will respond as soon as possible.

    Notes to editors             

    Using the powers conferred by the Sanctions and Anti-Money Laundering Act (the Sanctions Act) the Government has laid secondary legislation before Parliament that introduces a new Global Irregular Migration and Trafficking in Persons sanctions regime. The Regulations will be debated by both Houses of Parliament when they return from the summer recess in line with the made affirmative procedure.     

    Asset freeze   

    An asset freeze prevents any UK citizen, or any business in the UK, from dealing with any funds or economic resources which are owned, held or controlled by the designated person. UK financial sanctions apply to all persons within the territory and territorial sea of the UK and to all UK persons, wherever they are in the world. It also prevents funds or economic resources being provided to or for the benefit of the designated person.   

    Travel ban   

    A travel ban means that the designated person must be refused leave to enter or to remain in the United Kingdom, providing the individual is an excluded person under section 8B of the Immigration Act 1971.   

    Director disqualifications   

    Where director disqualification sanctions apply, it will be an offence for a person designated for the purpose of those sanctions to act as a director of a company or to take part in the management, formation or promotion of a UK company.

    Updates to this page

    Published 22 July 2025

    MIL OSI United Kingdom –

  • MIL-OSI Asia-Pac: Monetary Authority takes disciplinary action against 33 Financial Services Limited for contravention of Payment Systems and Stored Value Facilities Ordinance

    Source: Hong Kong Government special administrative region

    Monetary Authority takes disciplinary action against 33 Financial Services Limited for contravention of Payment Systems and Stored Value Facilities Ordinance 
    The disciplinary action (Note 1) follows an investigation by the HKMA which found that, during the period from December 1, 2019 to August 31, 2023, 33FS failed to have in place adequate and appropriate systems of control to comply with the relevant paragraphs of the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Stored Value Facility (SVF) Licensees) (Guideline) (Note 2).
     
    Specifically, the contravention relates to deficiencies in 33FS’ systems of control in three areas, namely:
          In deciding the disciplinary action, the MA has taken into account the relevant circumstances and factors, including:
          The Executive Director (Enforcement and AML) of the HKMA, Mr Raymond Chan, said, “CDD measures are crucial for combatting ML and TF risks. Verifying the identity of customers and understanding the purpose and intended nature of the business relationships are essential elements of CDD measures. SVF licensees should ensure that they have effective CDD measures in place.”
     
    Relevant link: Statement of Disciplinary Action  
    Note 1: The disciplinary action is taken under section 33Q of the PSSVFO.

    Note 2: Paragraphs 4.6.1, 4.1.3(a), 4.1.3(d), 4.4.4, and 4.3.16 of the Guideline (October 2018 version and September 2020 version).
    Issued at HKT 17:07

    NNNN

    MIL OSI Asia Pacific News –

  • MIL-Evening Report: Israeli settlers beat to death 2 Palestinians in latest lynchings

    BEARING WITNESS: By Cole Martin in occupied West Bank

    Two young Palestinians were beaten to death on their land by Israeli settlers in the occupied West Bank on Friday.

    A funeral was held on Sunday for Sayfollah “Saif” Mussalet, 20, and Muhammad Shalabi, 23, who were brutally killed by a large group of settlers in an attack that left more than 30 other Palestinians injured.

    Mussalet died from his wounds as settlers attacked medical responders, and Shalabi’s body was recovered later that evening, having reportedly bled to death from a gunshot wound while ambulances and rescuers were blocked by Israeli military.

    Settlers continued to roam the Palestinian farmland freely for hours.

    Both young men were from the neighbouring Mazra’a Sharqiya village, and Saif was an American citizen visiting loved ones and friends over summer. His family released a statement calling his death an “unimaginable nightmare and an injustice that no family should ever have to face”.

    They said he was a “beloved member of his community . . . a brother and a son [and] a kind, hard-working, and deeply-respected young man.”

    Saif built a widely-loved business in Tampa, Florida, and was known for his generosity, ambition, and connection to his Palestinian heritage.

    Following news of his death an overwhelming number of locals gathered at his store to share their grief and anger.

    Frequent atrocities
    Such lynchings have become a frequent atrocity across the West Bank, as settler gangs are repeatedly emboldened by the Israeli government, police, and military who protect and often facilitate violence against Palestinian communities.

    Two settlers were reportedly detained following the attacks, but released again within hours.

    Between 2005-2020, 91 percent of Palestinian cases filed with police were closed without indictment, according to the Israeli human rights organisation B’tselem, and settlers undergo trial with full legal rights and higher lenience in Israeli civil courts.

    By contrast, Palestinians are tried in Israeli military courts, established in violation of the fourth Geneva Convention and largely considered corrupt for maintaining a 95 percent conviction rate (Military Court Watch).

    Additionally, more than 3600 Palestinians are currently held in Israeli captivity without charge or trial, with all detainees facing an increase in documented physical, psychological, and sexual abuse — including children.

    A funeral was held for the young men on Sunday in Mazra’a Sharqiya village, with thousands in attendance. The killings continue a systemic pattern which alongside military incursions, has seen 153 Palestinians killed by Israeli forces in the West Bank since the beginning of 2025 (OCHA).

    UN resolution
    A UN resolution last September reaffirmed the illegality of Israel’s presence in the occupied Palestinian territories, demanding a total and unconditional withdrawal within a year.

    Ten months on, settler attacks have escalated in frequency and severity, settlement expansion has rapidly increased, and numerous Palestinian villages have been forcibly displaced after months of sustained violence.

    Communities across the West Bank are facing erasure, and as the death toll climbs pressure continues to grow for the New Zealand government to enforce stronger political sanctions, including the entire opposition uniting behind the Green Party’s Unlawful Occupation of Palestine Sanctions Bill.

    Cole Martin is an independent New Zealand photojournalist based in the Middle East and a contributor to Asia Pacific Report.

    Mourners pay their respects to the two young Palestinians killed by illegal settlers. Image: Cole Martin

    MIL OSI Analysis – EveningReport.nz –

  • MIL-OSI Africa: Discharge application dismissed in State Capture linked case

    Source: Government of South Africa

    Tuesday, July 22, 2025

    The Johannesburg High Court has dismissed an application for a discharge brought by the accused in a high-profile State Capture corruption case linked to the rehabilitation of mines.

    The accused include former Department of Mineral Resources (DMR) Deputy Director-General Joel Raphela, as well as Ronica Ragavan, Pushpaveni Govender, and entities linked to the Gupta family’s Optimum Coal Mine, Koornfontein Mines, and Tegeta Exploration and Resources.

    In the main case, they are facing a raft of charges including fraud, forgery, uttering, perjury and money laundering related to R107.5 million rehabilitation funds meant for the Optimum Coal Mine and Koornfontein Mine trust accounts in 2016.
    Their application for a discharge was brought in terms of Section 174 of the Criminal Procedure Act.

    “The court also ruled in favour of the National Prosecuting Authority’s Investigating Directorate Against Corruption [IDAC], granting leave to amend the indictment on certain charges against the accused. 

    “This development follows the closure of the State’s case. The defence’s application was brought thereafter,” IDAC spokesperson, Henry Mamothame said in a statement on Monday.

    The case will resume in court on 25 May 2026 and is set down until 12 June 2026, “during which period the defence is expected to call its witnesses”.

    The accused have pleaded not guilty. – SAnews.gov.za

    MIL OSI Africa –

  • MIL-OSI Australia: Police seek public assistance for investigation into online prescriptions

    Source: New South Wales Community and Justice

    Police seek public assistance for investigation into online prescriptions

    Tuesday, 22 July 2025 – 3:00 pm.

    Investigators from Tasmania Police are appealing for public assistance as part of an ongoing investigation into alleged fraudulent online prescriptions.
    Detective Inspector Michelle Elmer said police are seeking to speak with anyone who has sought or obtained prescriptions through the website athleteswarehouse.com.au.
    “We believe members of the community may have interacted with this website in good faith,” she said.
    “Now is the time to come forward and assist police with critical information that may support the investigation.”
    “Those people who have used the website, or who may have knowledge of its operations, are urged to contact us.”
    Anyone with information should call Tasmania Police’s Western Criminal Investigation Branch on 131 444 and quote OR774910.
    Information can also be provided anonymously to Crime Stoppers on 1800 333 000 or online at crimestopperstas.com.au

    MIL OSI News –

  • MIL-Evening Report: Gaza: Empty rhetoric from New Zealand and other Western countries

    In a joint statement, more than two dozen Western countries, including New Zealand, have called for an immediate end to the war on Gaza. But the statement is merely empty rhetoric that declines to take any concrete action against Israel, and which Israel will duly ignore. 

    AGAINST THE CURRENT: By Steven Cowan

    The New Zealand government has joined 27 other countries calling for an “immediate end” to the war in Gaza. The joint statement says  “the suffering of civilians in Gaza has reached new depths”.

    It goes on to say that the drip feeding of aid and the inhumane killing of civilians, including children, seeking to meet their most basic needs of water and food.

    But many of the countries that have signed this statement stand condemned for actively enabling Israel to pursue its genocidal assault on Gaza. Countries like Britain, Canada and Australia, continue to supply Israel with arms, have continued to trade with Israel, and have turned a blind eye to the atrocities and war crimes Israel continues to commit in Gaza.

    It’s more than ironic that while Western countries like Britain and New Zealand are calling for an end to the war in Gaza, they continue to be hostile toward the anti-war protest movements in their own countries.

    The British government recently classified the protest group Palestine Action as a “terrorist” group.

    In New Zealand, the Minister of Foreign Affairs, Winston Peters, has denounced pro-Palestine protesters as “left wing fascists” and “communist, fascist and anti-democratic losers”. He has pushed back against the growing demands that the New Zealand government take direct action against Israel, including the cutting of all diplomatic ties.

    The New Zealand government, which contains a number of Zionists within its cabinet, including Act leader David Seymour and co-leader Brooke van Velden, will be more than comfortable with a statement that proposes to do nothing.

    ‘Statement lacks leadership’
    Its call for an end to the war is empty rhetoric, and which Israel will duly ignore — as it has ignored other calls for its genocidal war to end.  As Amnesty International has said, ‘the statement lacks any resolve, leadership, or action to help end the genocide in Gaza.’

    “This is cruelty – this is not a war,” says this young girl’s placard quoting the late Pope Francis in an Auckland march last Saturday . . . this featured in an earlier report. Image: Asia Pacific Report

    New Zealand has declined to join The Hague Group alliance of countries that recently met in Colombia.

    It announced six immediate steps it would be taking against Israel. But since The Hague Group has already been attacked by the United States, it’s never been likely that New Zealand would join it.

    The National-led coalition government has surrendered New Zealand’s independent foreign policy in favour of supporting the interests of a declining American Empire.

    Republished from Steven Cowan’s blog Against The Current with permission.

    MIL OSI Analysis – EveningReport.nz –

  • MIL-OSI Australia: Search for remains near Port Lincoln

    Source: New South Wales – News

    Detectives from Major Crime Investigation Branch and local Eyre Western police, with the assistance of local support services will conduct further searches at several locations over the coming days to locate the missing remains of murder victim Julian Story.

    Police will allege Julian was murdered by his partner, 34-year-old Port Lincoln woman Tamika Chesser on Tuesday 17 June 2025.

    Major Crime Investigation Branch, Detective Superintendent Darren Fielke said information received by the investigation team coupled with the use of specialist equipment has identified several additional search sites in and around Port Lincoln.

    “In the days following the murder, Major Crime Detectives, local police, Water Operations Unit and the SA State Emergency Service conducted extensive searches around Port Lincoln without success,” Detective Superintendent Fielke said.

    “New search areas have been identified and by undertaking these renewed searches, we hope to find Julian’s missing remains, which will give comfort to his family and allow them to peacefully lay him to rest.

    “Police have reviewed a significant amount of CCTV footage since the incident which has provided a number of investigational leads. We also appreciate the ongoing assistance the community of Port Lincoln has provided throughout the investigation.”

    Anyone with information that may assist the investigation is urged to contact Crime Stoppers on 1800 333 000 or online at www.crimestopperssa.com.au – you can remain anonymous.

    CO2500025517.

    MIL OSI News –