Category: Crime

  • MIL-OSI Security: Marathon County Man Sentenced to 7 Years for Conspiring to Traffic Methamphetamine

    Source: Office of United States Attorneys

    MADISON, WIS. – Timothy M. O’Shea, United States Attorney for the Western District of Wisconsin, announced that Dustin P. Brunker, 37, Weston, Wisconsin, was sentenced yesterday by U.S. District Judge William M. Conley to 7 years in federal prison for conspiring to distribute 50 grams or more of methamphetamine. The prison term will be followed by 5 years of supervised release. Brunker pleaded guilty to this charge on January 28, 2025.

    In early 2024, investigators with the Central Wisconsin Narcotics Task Force began investigating a group of individuals who were distributing large quantities of methamphetamine and cocaine in the Marathon County area. Brunker was identified as a distributor for the group.

    Following a series of controlled purchases of methamphetamine involving Brunker in March and April of 2024, task force officers executed a search warrant at a residence that Brunker shared with co-defendant Mercadys A. Perkins in Weston. Officers found over 300 grams of methamphetamine, over $2,000 in cash, drug ledgers, and other drug trafficking paraphernalia during the search.

    Further investigation revealed that between February 18, 2024, and April 12, 2024, a co-conspirator provided Brunker and Perkins approximately 16 pounds of methamphetamine and 6 ounces of cocaine intended for further distribution.

    At the time of these events, Brunker was serving a term of state supervision for two felony cases and out on state bond for a felony drug charge. His state supervision was revoked, and he was sentenced to a total of 3 years in state prison, which he is currently serving. Judge Conley ordered the federal sentence run concurrently with the remainder of Brunker’s state prison sentences.

    At sentencing, Judge Conley called Brunker’s large quantity methamphetamine trafficking egregious. Judge Conley further observed that while Brunker had a lengthy prior record, the conduct in the present case showed an escalation in criminality.

    Three others were charged in connection with this drug trafficking conspiracy. Mercadys Perkins was convicted of conspiracy to distribute 50 grams or more of methamphetamine and sentenced to 6 years in federal prison on April 17, 2025. Joshua Lake and Jessica Colby have pleaded guilty and are scheduled to be sentenced in the coming weeks.

    The charge against Brunker was the result of an investigation conducted by the Federal Bureau of Investigation’s Central Wisconsin Narcotics Task Force comprised of investigators from the FBI, Wisconsin State Patrol, Wisconsin Department of Criminal Investigation, Lincoln County Sheriff’s Office, Marathon County Sheriff’s Office, Portage County Sheriff’s Office, Mountain Bay Police Department, Wausau Police Department and Wisconsin National Guard Counter Drug Program. The ATF Madison Crime Gun Task Force also assisted with the case. The ATF Madison Crime Gun Task Force consists of federal agents from ATF and Task Force Officers from state and local agencies throughout the Western District of Wisconsin. The Marathon County District Attorney’s Office also assisted with the investigation. Assistant U.S. Attorney Steven P. Anderson prosecuted this case. 

    MIL Security OSI

  • MIL-OSI Security: Newtown Man Admits Stealing Nearly $3 Million to Fund His Day Trading Activity

    Source: Federal Bureau of Investigation (FBI) State Crime News

    Marc H. Silverman, Acting United States Attorney for the District of Connecticut, and Anish Shukla, Acting Special Agent in Charge of the New Haven Division of the Federal Bureau of Investigation, announced that on April 18, 2025, TIMOTHY MINGIONE, 33, of Newtown, waived his right to be indicted and pleaded guilty before U.S. District Judge Alvin W. Thompson in Hartford to an offense related to his theft of nearly $3 million to fund his day trading activity.

    According to court documents and statements made in court, Mingione assisted investors in the purchase of real estate and then became the designated asset manager for the acquired properties, including overseeing the properties, addressing tenancy issues associated with the real estate, and reviewing property financials.  In this role, Mingione had access to bank accounts required for property management.  Mingione provided purchase and asset manager services for a New York-based real estate company, worked with a syndicate of investors involved in the purchase and management of five real estate properties in Connecticut and Florida, and worked as an asset manager for various other limited liability companies.

    Beginning in approximately April 2023, to fund his day trading activity, particularly in S&P 500 options, Mingione stole from the various business bank accounts he had access to by writing checks against the accounts or by wiring monies from the accounts to his personal trading account with TD Ameritrade.  Mingione tracked the monies he stole and, at times, returned funds to the accounts he had stolen from.  However, by late spring 2024, he had amassed more than $1 million in trading losses and, by the end of September 2024, had stolen nearly $3 million.

    Mingione pleaded guilty to one count of interstate transmission of stolen money, which carries a maximum term of imprisonment of 10 years.  Judge Thompson scheduled sentencing for July 15.

    Mingione has agreed to pay restitution of $ 2,958,203.

    Mingione is released on a $40,000 bond pending sentencing.

    This investigation is being conducted by the Federal Bureau of Investigation and the case is being prosecuted by Assistant U.S. Attorney Christopher W. Schmeisser.

    MIL Security OSI

  • MIL-OSI Security: Federal Inmate Sentenced to Life in Prison for Savage Murder of Cellmate at Terre Haute Federal Correctional Complex

    Source: Federal Bureau of Investigation (FBI) State Crime News

    TERRE HAUTE— Joshua T. Mebane, 29, of Silver Spring, Maryland, has been sentenced to life in federal prison for first degree murder. Mebane previously pled guilty in open court on October 23, 2024. 

    According to court documents, in January of 2016, Joshua Mebane was an inmate at the Federal Correctional Complex in Terre Haute, Indiana, serving a 45-year sentence for first degree murder in the District of Columbia. Mebane was also later convicted of murder and attempted murder in Maryland, committed in 2012, for which he received multiple life sentences.   

    On January 26, 2016, inmate Michael Tucker moved into Mebane’s cell. Just two days later, correctional officers went to retrieve Mebane for a medical appointment and called for both inmates to be present at the cell door. According to policy, all inmates in the cell must be handcuffed before opening. As the officers again called for Tucker to be handcuffed, Mebane admitted “My cellie (cell mate) is dead… I killed my cellie on Wednesday.”

    Officers entered the cell to investigate and found Michael Tucker lying face-up in the bottom bunk bed, covered by a blanket. His body was cold to the touch and without a pulse. Life saving measures were initiated by medics but were unsuccessful.

    The medical examiner ruled the official cause of death to be asphyxiation and determined the manner of death as homicide.

    “This life sentence reflects our office’s commitment to justice for all victims, including those who are incarcerated in federal correctional facilities. The horrific murder deserves one of the harshest penalties allowed under the law, and I sincerely hope that the completion of this prosecution brings some measure of closure and peace to Mr. Tucker’s family,” said John E. Childress, Acting United States Attorney for the Southern District of Indiana.

    “The FBI is committed to ensuring the rights and dignity of every victim – no matter where the crimes occur. This kind of violence is inexcusable, and the sentence should serve as a powerful reminder there is no place in our society for such hate,” said FBI Indianapolis Acting Special Agent in Charge Dominique Evans. “The FBI will continue to work with our law enforcement partners to hold offenders accountable and send a clear message that the protection of all individuals from hate-driven violence remains a top priority.”

    “Today’s sentencing sends a clear message – those who threaten or harm others will be held accountable. The safety and security of our facilities will always be the FBOP’s top priority in our mission to ensure public safety,” said a BOP Spokesperson.

    The Federal Bureau of Investigation and Bureau of Prisons investigated this case. The sentence was imposed by U.S. District Court Judge James R. Sweeney II. 

    Acting U.S. Attorney Childress thanked Assistant U.S. Attorneys Kyle M. Sawa and Meredith Wood, who prosecuted this case.

    ###

    MIL Security OSI

  • MIL-OSI Security: Darknet Drug Trafficker From Pennsylvania Sentenced in D.C. for Selling Mass Quantities of Fentanyl Online

    Source: Federal Bureau of Investigation (FBI) State Crime Alerts (c)

    WASHINGTON – Jacob Blair, 27, of Aliquippa, Pa., was sentenced today in U.S. District Court to 180 months in federal prison for his role in a drug conspiracy that distributed a wide variety of narcotics, including large amounts of counterfeit oxycodone pills containing fentanyl and counterfeit Adderall pills containing methamphetamine. Blair sold and distributed the narcotics on the darknet marketplace Tor2Door and other darknet markets.

    The sentence was announced by U.S. Attorney Edward R. Martin Jr.; Acting U.S. Attorney Troy Rivetti of the Western District of Pennsylvania; Special Agent in Charge Sean Ryan of the FBI Washington Field Office Criminal and Cyber Division, Special Agent in Charge Kevin P. Rojek of the FBI Pittsburgh Field Office; Special Agent in Charge Ibrar A. Mian of the Drug Enforcement Administration (DEA) Washington Division; Inspector in Charge Damon E. Wood of the U.S. Postal Inspection Service Washington Division; Inspector in Charge Lesley Allison of the US Postal Inspection Service Pittsburgh Division for; and Acting Special Agent in Charge Christopher Heck of the U.S. Immigration and Customs Enforcement’s (ICE) Homeland Security Investigations (HSI) Washington, D.C.

    Blair pleaded guilty on Dec. 17, 2024, before U.S. District Court Judge Amy Berman Jackson, to a charge of conspiracy to distribute more than 400 grams of fentanyl and 50 grams of methamphetamine, and to a charge of possessing a firearm in furtherance of a drug trafficking offense. Blair also pleaded guilty in the District of Columbia to a charge, originally filed in the Western District of Pennsylvania, of distributing 40 grams or more of fentanyl and 50 grams or more of methamphetamine.

    In addition to the 180-month prison term, Judge Berman Jackson ordered Blair to serve five years of supervised release.

    According to court documents, Blair was responsible for distributing more than 1.2 kilograms but less than 4 kilograms of fentanyl, and at least 50 grams but less than 200 grams of methamphetamine. He also admitted to mass-marketing the narcotics by means of an interactive computer service.

    Blair’s co-defendant Dyani Pezzelle pleaded guilty March 5, 2025, to conspiracy to distribute more than 40 grams of fentanyl and 50 grams of methamphetamine. Pezzelle is scheduled to be sentenced on Sept. 18, 2025.

    Between August 1, 2022, and Feb. 24, 2023, Blair and Pezzelle operated vendor accounts on various darknet marketplaces. On the marketplace Tor2Door, Blair and Pezzelle advertised their controlled substances using the monikers “YVS” and “YVendor Supplier” which they touted as “a syndicate of professionals that specialize in making the best products the markets have to offer. We focus on quality, consistency, stealth, and speed.” The conspiracy completed at least 459 sales of illegal narcotics.

    Blair manufactured and obtained counterfeit Oxycodone, Adderall, and Xanax pills for sale. Blair posted advertisements for the controlled substances on Tor2Door and four other marketplaces and accepted payment in cyrptocurrency. During the conspiracy, Blair shipped counterfeit oxycodone pills to the District of Columbia at least six times. These pills contained fentanyl, a Schedule II controlled substance, and metonitazene, a Schedule I controlled substance. In addition, they also shipped counterfeit Xanax and Adderall pills to the District multiple times.

    On February 22, 2023, law enforcement executed search warrants at Blair’s residence in Aliquippa, Pennsylvania, and other locations. During the searches, law enforcement recovered 10 firearms, over 20,000 counterfeit oxycodone pills that contained fentanyl, an industrial pill press, and other manufacturing and distribution supplies.

    This case was investigated by the FBI’s Field Offices in Washington D.C. and Pittsburgh, the DEA, the U.S. Postal Inspection Service, and Homeland Security Investigations. Valuable assistance was provided by the Pittsburgh Bureau of Police and the Moon Township Police Department.

    The matter is being prosecuted by Assistant U.S. Attorneys Thomas Strong and Peter Roman of the District of Columbia’s Violence Reduction and Trafficking Offenses (VRTO) section and Assistant U.S. Attorney DeMarr Moulton of the Western District of Pennsylvania.  The case was initially investigated and indicted by Assistant U.S. Attorney Kevin Rosenberg.

    24cr560

    MIL Security OSI

  • MIL-OSI USA: Maryland Man Indicted for Conspiring to Provide Material Support to Armed Separatist Fighters to Murder, Kidnap, and Maim Individuals in Cameroon and For Making Threats

    Source: US State of North Dakota

    A federal grand jury in Baltimore returned an indictment yesterday charging a Cameroonian national, Eric Tataw, also known as “the Garri Master,” 38, of Gaithersburg, Maryland, with conspiring to provide material support to armed separatist militias in Cameroon and threatening violence against Cameroonian civilians. He surrendered and will make his initial court appearance before U.S. Magistrate Judge J. Mark Coulson today.

    According to court documents, multiple armed and violent secessionist groups in the Northwest and Southwest regions of Cameroon are fighting to form a new country called “Ambazonia.” The armed separatist militias sought to achieve secession by not only attacking the Cameroonian military, but also intentionally attacking the civilian population in Cameroon in an attempt to force the Cameroonian government into allowing these regions to secede. These separatist fighters are frequently referred to as “Amba Boys.”

    “The defendant is alleged to have ordered horrific acts of violence, including severing limbs, against Cameroonian civilians in support of a violent secessionist movement,” said Matthew R. Galeotti, Head of the Justice Department’s Criminal Division. “This indictment represents the Justice Department’s commitment to hold accountable human rights violators who direct brutal political violence and fundraise for armed militias from the comfort of the United States.”

    “The Justice Department will not tolerate those who help murder, maim, and kidnap,” said Sue J. Bai, Head of the Justice Department’s National Security Division. “We will continue to hold accountable those who aim to turn American soil into a staging ground for political violence abroad.”

    “Tataw and his co-conspirators masterminded and financially supported a vicious scheme to overthrow a foreign government. They resorted to an unthinkable level of violence while instilling fear in innocent victims to advance their political agenda,” said U.S. Attorney Kelly O. Hayes for the District of Maryland. “We, along with our law enforcement partners, are committed to relentlessly pursuing anyone who attempts to inflict mayhem on others. Tataw and his co-conspirators demonstrated a total disregard for human life so now they must pay the price.”

    As alleged in the indictment, Tataw was a citizen of Cameroon living in Maryland and was a member of the Cameroonian diaspora with a large social media following. Beginning in April 2018, Tataw and others sought to raise funds for the Amba Boys to finance violent attacks in Cameroon. Tataw also allegedly called for the murder, kidnapping, and maiming of civilians and the destruction of public, educational, and cultural property in Cameroon. Tataw and his co-conspirators allegedly directed the maiming of Cameroonian civilians by severing their limbs, a practice Tataw called “Garriing.” Tataw allegedly used the phrase “small Garri” to refer to removing fingers or other small appendages and the phrase “large Garri” to refer to removing large limbs or killing people. Additionally, Tataw allegedly referred to himself as the “Garri Master,” or master of mutilation.

    Tataw and his co-conspirators allegedly targeted those believed to be working for or collaborating with the government, including municipal officials, traditional chiefs, and employees of the Cameroon Development Corporation (CDC), a public company that grew, processed, and sold bananas, palm oil, and rubber. As alleged, Tataw personally wrote hundreds of social media posts on Facebook, YouTube, and Twitter calling for attacks against Cameroonian civilians, seeking to raise funds to arm Amba Boys, and threatening those he viewed as cooperating with the government of Cameroon. These social media posts were regularly viewed by tens of thousands of people, including Amba Boys and their leaders, and were often further disseminated by third parties allegedly acting at Tataw’s direction or encouragement.

    Tataw is charged with one count of conspiracy to provide material support and four counts of interstate communication of a threat to harm. If convicted, he faces a maximum penalty of 15 years in prison on the material support count and five years in prison on each count of communication of a threat to harm. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

    Matthew R. Galeotti, Head of the Justice Department’s Criminal Division; Sue J. Bai, Head of the Justice Department’s National Security Division; U.S. Attorney Kelly O. Hayes for the District of Maryland; and Special Agent in Charge Michael McCarthy of U.S. Immigration and Customs Enforcement Homeland Security Investigations (ICE HSI) Maryland made the announcement.

    HSI and the U.S. Department of State’s Diplomatic Security Service, with assistance from the FBI, are investigating the case.

    Trial Attorney Chelsea Schinnour of the Criminal Division’s Human Rights and Special Prosecutions Section, Assistant U.S. Attorney Christina Hoffman and Joseph Wenner for the District of Maryland, and Trial Attorneys Michael Dittoe and Andrew Briggs of the National Security Division’s Counterterrorism Section are prosecuting the case, with assistance from the Justice Department’s Office of International Affairs.

    An indictment is merely an allegation. The defendant is presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

    MIL OSI USA News

  • MIL-OSI Security: Maryland Man Indicted for Conspiring to Provide Material Support to Armed Separatist Fighters to Murder, Kidnap, and Maim Individuals in Cameroon and For Making Threats

    Source: United States Attorneys General 13

    A federal grand jury in Baltimore returned an indictment yesterday charging a Cameroonian national, Eric Tataw, also known as “the Garri Master,” 38, of Gaithersburg, Maryland, with conspiring to provide material support to armed separatist militias in Cameroon and threatening violence against Cameroonian civilians. He surrendered and will make his initial court appearance before U.S. Magistrate Judge J. Mark Coulson today.

    According to court documents, multiple armed and violent secessionist groups in the Northwest and Southwest regions of Cameroon are fighting to form a new country called “Ambazonia.” The armed separatist militias sought to achieve secession by not only attacking the Cameroonian military, but also intentionally attacking the civilian population in Cameroon in an attempt to force the Cameroonian government into allowing these regions to secede. These separatist fighters are frequently referred to as “Amba Boys.”

    “The defendant is alleged to have ordered horrific acts of violence, including severing limbs, against Cameroonian civilians in support of a violent secessionist movement,” said Matthew R. Galeotti, Head of the Justice Department’s Criminal Division. “This indictment represents the Justice Department’s commitment to hold accountable human rights violators who direct brutal political violence and fundraise for armed militias from the comfort of the United States.”

    “The Justice Department will not tolerate those who help murder, maim, and kidnap,” said Sue J. Bai, Head of the Justice Department’s National Security Division. “We will continue to hold accountable those who aim to turn American soil into a staging ground for political violence abroad.”

    “Tataw and his co-conspirators masterminded and financially supported a vicious scheme to overthrow a foreign government. They resorted to an unthinkable level of violence while instilling fear in innocent victims to advance their political agenda,” said U.S. Attorney Kelly O. Hayes for the District of Maryland. “We, along with our law enforcement partners, are committed to relentlessly pursuing anyone who attempts to inflict mayhem on others. Tataw and his co-conspirators demonstrated a total disregard for human life so now they must pay the price.”

    As alleged in the indictment, Tataw was a citizen of Cameroon living in Maryland and was a member of the Cameroonian diaspora with a large social media following. Beginning in April 2018, Tataw and others sought to raise funds for the Amba Boys to finance violent attacks in Cameroon. Tataw also allegedly called for the murder, kidnapping, and maiming of civilians and the destruction of public, educational, and cultural property in Cameroon. Tataw and his co-conspirators allegedly directed the maiming of Cameroonian civilians by severing their limbs, a practice Tataw called “Garriing.” Tataw allegedly used the phrase “small Garri” to refer to removing fingers or other small appendages and the phrase “large Garri” to refer to removing large limbs or killing people. Additionally, Tataw allegedly referred to himself as the “Garri Master,” or master of mutilation.

    Tataw and his co-conspirators allegedly targeted those believed to be working for or collaborating with the government, including municipal officials, traditional chiefs, and employees of the Cameroon Development Corporation (CDC), a public company that grew, processed, and sold bananas, palm oil, and rubber. As alleged, Tataw personally wrote hundreds of social media posts on Facebook, YouTube, and Twitter calling for attacks against Cameroonian civilians, seeking to raise funds to arm Amba Boys, and threatening those he viewed as cooperating with the government of Cameroon. These social media posts were regularly viewed by tens of thousands of people, including Amba Boys and their leaders, and were often further disseminated by third parties allegedly acting at Tataw’s direction or encouragement.

    Tataw is charged with one count of conspiracy to provide material support and four counts of interstate communication of a threat to harm. If convicted, he faces a maximum penalty of 15 years in prison on the material support count and five years in prison on each count of communication of a threat to harm. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

    Matthew R. Galeotti, Head of the Justice Department’s Criminal Division; Sue J. Bai, Head of the Justice Department’s National Security Division; U.S. Attorney Kelly O. Hayes for the District of Maryland; and Special Agent in Charge Michael McCarthy of U.S. Immigration and Customs Enforcement Homeland Security Investigations (ICE HSI) Maryland made the announcement.

    HSI and the U.S. Department of State’s Diplomatic Security Service, with assistance from the FBI, are investigating the case.

    Trial Attorney Chelsea Schinnour of the Criminal Division’s Human Rights and Special Prosecutions Section, Assistant U.S. Attorney Christina Hoffman and Joseph Wenner for the District of Maryland, and Trial Attorneys Michael Dittoe and Andrew Briggs of the National Security Division’s Counterterrorism Section are prosecuting the case, with assistance from the Justice Department’s Office of International Affairs.

    An indictment is merely an allegation. The defendant is presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

    MIL Security OSI

  • MIL-OSI Security: Hardin Man Sentenced to Three Years in Prison for Using a Phone to Promote Prostitution with a Minor

    Source: Federal Bureau of Investigation (FBI) State Crime Alerts (c)

    BILLINGS – A Hardin man who promoted prostitution with a minor was sentenced today to 36 months in prison to be followed by 3 years of supervised release, U.S. Attorney Kurt Alme said.

    William Serges Joseph, 75, pleaded guilty in November 2024 to use of facility in interstate commerce in aid of racketeering.

    U.S. District Judge Susan Watters presided.

    The government alleged in court documents that in March 2023, Jane Doe, a juvenile female, disclosed to law enforcement that, commencing in approximately September 2022, she began showing her breasts to the Joseph. The two messaged each other on Facebook and Joseph was aware of she was a juvenile. Jane Doe said she allowed Joseph to touch her in exchange for alcohol and he also asked her for naked pictures.

    Jane Doe was interviewed again in June 2023. She added that Joseph continued to message her and offered her $50 for sexual contact. A review of her cell phone reflected, among other communications, a February 2023 message from Joseph with a picture of male genitalia. Joseph was interviewed in February 2024. He admitted providing alcohol to Jane Doe in exchange for pictures of her breasts. At the time of the offense, prostitution was illegal under the laws of Montana and Sex Trafficking was illegal under the laws of the United States.

    The U.S. Attorney’s Office prosecuted the case, and the investigation was conducted by the FBI.

    This case was brought as part of Project Safe Childhood, a nationwide initiative to combat the growing epidemic of child sexual exploitation and abuse launched in May 2006 by the Department of Justice. Led by U.S. Attorneys’ Offices and CEOS, Project Safe Childhood marshals federal, state, and local resources to better locate, apprehend and prosecute individuals who exploit children via the Internet, as well as to identify and rescue victims. For more information about Project Safe Childhood, please visit Justice.gov/PSC.

    XXX

    MIL Security OSI

  • MIL-OSI Security: Pontiac Man Pleads Guilty in $4 Million Identity Theft and Unemployment Fraud Case

    Source: Federal Bureau of Investigation (FBI) State Crime News

    DETROIT – A Pontiac man has pleaded guilty to committing aggravated identity theft and wire fraud as part of large-scale, multi-state Unemployment Insurance benefit fraud scheme in which he and co-conspirators fraudulently obtained debit cards loaded with more than $4 million in Pandemic Unemployment Assistance funds, Acting United States Attorney Julie A. Beck announced today.

    Joining in the announcement were Megan Howell, Acting Special Agent-in-Charge, Chicago Region, U.S. Department of Labor, Office of Inspector General, Special Agent-in-Charge Cheyvoryea Gibson, Federal Bureau of Investigation, Detroit Division, Charles Miller, Special Agent-in-Charge, Internal Revenue Service – Criminal Investigations, Douglas Zloto, Special Agent-in-Charge, U.S. Secret Service, Sean McStravick, Acting Inspector-in-Charge, U.S. Postal Service, Office of Inspector General, and Director Jason Palmer, State of Michigan Unemployment Insurance Agency.

    Terrance Calhoun, Jr., 36, of Pontiac, Michigan, pleaded guilty to committing aggravated identity theft, wire fraud, conspiracy to commit wire fraud, and to possessing 15 or more unauthorized access devices, all in relation to acts of unemployment insurance fraud.

    According to his plea agreement, Calhoun Jr., and others, used stolen personal identification and filed hundreds of false unemployment claims with state unemployment insurance agencies in Michigan, Arizona, and Maryland over a six-month period in the names of other individuals without their knowledge or consent. Those false claims resulted in hundreds of debit cards loaded with over $4 million in unemployment insurance funds being mailed to addresses controlled by Calhoun Jr. and his co-conspirators. Roughly $1.6 million dollars in purchases and cash withdrawals were then successfully made from the cards.

    As described within a prior complaint, when agents executed search warrants at the principal mailing addresses used for the fraudulent unemployment insurance benefit claims, including the residence of Calhoun Jr., agents seized numerous documents containing the personal identification information of other individuals, multiple debit cards in the names of numerous other individuals, and firearms.

    Calhoun now faces a possible sentence of up to 20-years’ imprisonment for each of the wire fraud counts to which he has pleaded guilty, a possible sentence of up to 10-years’ imprisonment for possessing 15 or more unauthorized access devices, and a mandatorily consecutive 2-year sentence for the aggravated identity theft charge to which he has pleaded guilty.

    Sentencing is set for August 27, 2025 before United States District Court Judge Judith E. Levy.

    “Taxpayer money diverted into the pockets of criminals means less money going to Michiganders who actually need help getting through difficult financial times and who follow the rules when seeking assistance,” said Acting US Attorney Beck.  “These charges reflect our office’s ongoing commitment to the community by investigating such schemes and bringing those who commit these crimes to justice.”

    “Terrance Calhoun Jr and his co-conspirators engaged in a scheme to defraud state workforce agencies in Michigan, Arizona, and Maryland by filing hundreds of fraudulent unemployment insurance (UI) claims.  As a result, Calhoun enriched himself by stealing taxpayer resources intended for unemployed American workers.  We will continue to work with our law enforcement partners to protect the integrity of the UI program from those who seek to exploit it,” said Megan Howell, Acting Special Agent-in-Charge, Great Lakes Region, U.S. Department of Labor, Office of Inspector General.

    “Individuals who commit identity theft and unemployment insurance fraud of this magnitude deserve to be punished to the fullest extent of the law,” said Charles Miller, Special Agent in Charge, Detroit Field Office, IRS Criminal Investigation (IRS-CI).  “Terrance Calhoun, Jr. and Jermaine Arnett demonstrated a blatant disregard of the integrity of the multiple states’ unemployment insurance systems and caused immeasurable hardship to innocent victims. IRS-CI remains committed to the pursuit of identity theft and financial fraud, and together with our partners at the U.S. Attorney’s Office, we will hold those who engage in similar crimes accountable.”

    “The FBI in Michigan, alongside our law enforcement partners, remains steadfast in protecting the community and investigating individuals who violate federal law,” said Cheyvoryea Gibson, Special Agent in Charge of the FBI Detroit Field Office. “Today’s guilty plea by Terrance Calhoun, whose involvement in a multi-state fraud scheme, is a clear reminder that bad actors will be stopped, and we will ensure integrity will prevail.”

    The case was jointly investigated by agents from the Department of Labor Office of the Inspector General, the Internal Revenue Service – Criminal Investigations Division, the Federal Bureau of Investigation, the Bureau of Immigration and Customs Enforcement, the United States Secret Service, the United States Postal Service Office of the Inspector General, and the State of Michigan -Unemployment Insurance Agency. The case is being prosecuted by Assistant United States Attorneys Carl D. Gilmer-Hill and Jessica A. Nathan.

    MIL Security OSI

  • MIL-OSI Security: Guatemalan Man Sentenced to Federal Prison for Conspiring to Distribute Methamphetamine in Dubuque, Iowa

    Source: Federal Bureau of Investigation (FBI) State Crime News

    A Guatemalan man who conspired to distribute methamphetamine was sentenced today to more than 12 years in federal prison.  Jose Eleazar Aceves‑Garcia, age 30, from Guatemala, received the prison term after a November 20, 2024 guilty plea to conspiracy to distribute at least 500 grams of a mixture or substance containing a detectable amount of methamphetamine and 50 grams of actual (pure) methamphetamine.

    In a plea agreement, Aceves-Garcia admitted that between January 2019 and January 2022, he distributed at least 400 pounds of ice methamphetamine to a co‑conspirator in the Dubuque area.  His fingerprints were on two packages, which contained a total of more than seven pounds of ice methamphetamine, that he mailed to the co-conspirator in Dubuque.  Aceves-Garcia also distributed a kilogram of heroin to the co-conspirator.

    Aceves-Garcia was sentenced in Cedar Rapids by United States District Court Chief Judge C.J. Williams.  Aceves-Garcia was sentenced to 151 months’ imprisonment and must serve a 5-year term of supervised release after the prison term.  There is no parole in the federal system.  Aceves-Garcia is being held in the United States Marshal’s custody until he can be transported to a federal prison.

    The case was prosecuted by Assistant United States Attorney Devra T. Hake and was investigated by the Dubuque Drug Task Force, Dubuque County Sheriff’s Office, Dubuque Police Department, Quad City Metropolitan Enforcement Group, Federal Bureau of Investigation, Drug Enforcement Administration, United States Postal Inspection Service, and the Iowa Division of Criminal Investigation Criminalistics Laboratory.

    Court file information at https://ecf.iand.uscourts.gov/cgi-bin/login.pl.  The case file number is 23-CR-1022.  Follow us on X @USAO_NDIA.

    MIL Security OSI

  • MIL-OSI Security: Iowa Man Arrested on Federal Stalking Charge

    Source: Federal Bureau of Investigation (FBI) State Crime News

    DES MOINES, Iowa – A Nevada, Iowa man made his initial appearance before a United States Magistrate Judge in the United States District Court for the Southern District of Iowa today.

    According to allegations in the criminal complaint, between January and April 2025, Tanner Dean Bandy, 28, engaged in a pattern of threatening conduct against a former romantic partner through text messages and voicemails. Two days prior to his arrest, on April 17, 2025, Bandy left a voicemail message discussing his intention to conduct a mass shooting at an Iowa State University commencement ceremony. On April 17, 2025, law enforcement searched Bandy’s residence and vehicle and located two firearms and ammunition. Bandy will remain detained in federal custody pending further proceedings.

    United States Attorney Richard D. Westphal of the Southern District of Iowa made the announcement. The Federal Bureau of Investigations, Iowa State University Police Department, and Story County Sheriff’s Office are investigating this case.

    A criminal complaint is merely an allegation, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

    MIL Security OSI

  • MIL-OSI Security: Associate of Violent Gang Sentenced to More Than Five Years in Prison for Drug Distribution and Firearms Offenses

    Source: United States Bureau of Alcohol Tobacco Firearms and Explosives (ATF)

    BOSTON – A Brockton man associated with Cameron Street, a violent Boston gang, was sentenced today for trafficking drugs and firearms.

    Steve Depina, 38, was sentenced by U.S. Senior District Court Judge William G. Young to 66 months in prison and three years of supervised release. In October 2024, Depina pleaded guilty to distribution of cocaine and cocaine base and being a felon in possession of a firearm and ammunition.

    During the investigation, Depina was identified as an older associate of the Cameron Street, a violent gang based largely in the Dorchester section of Boston that uses violence and threats of violence to preserve, protect and expand its territory, promote a climate of fear and enhance its reputation.

    In February 2022, Depina was recorded by law enforcement as he sold approximately 58 grams of cocaine to a cooperating witness, whom he believed to be a fellow Cameron Street member, near his workplace. In March 2022, Depina sold approximately 60 grams of cocaine base as well as a 9-millimeter pistol and 16 rounds of ammunition to the same cooperating witness. During a search of Depina’s residence in April 2022, an additional quantity of cocaine base as well as another firearm were seized.

    At the time of the offenses, Depina was on state probation for a 2018 conviction for possession with intent to distribute heroin and fentanyl in Plymouth Superior Court, for which he was sentenced to 3-5 years in prison. He is therefore prohibited from possessing a firearm and ammunition.

    United States Attorney Leah B. Foley; James M. Ferguson, Special Agent in Charge of the Bureau of Alcohol, Tobacco, Firearms and Explosives, Boston Field Division; Stephen Belleau, Acting Special Agent in Charge of the Drug Enforcement Administration, New England Field Division; and Boston Police Commissioner Michael Cox made the announcement today. Valuable assistance was provided by the Massachusetts State Police; Suffolk County Sheriff’s Office; Suffolk, Plymouth, Norfolk and Bristol County District Attorney’s Offices; and the Canton, Quincy, Randolph, Somerville, Brockton, Malden, Stoughton, Rehoboth and Pawtucket (R.I.) Police Departments. Assistant U.S. Attorneys Christopher Pohl and Charles Dell’Anno of the Narcotics & Money Laundering Unit prosecuted the case.

    This operation is part of an Organized Crime Drug Enforcement Task Forces (OCDETF) Strike Force Initiative, which provides for the establishment of permanent multi-agency task force teams that work side-by-side in the same location. This co-located model enables agents from different agencies to collaborate on intelligence-driven, multi-jurisdictional operations to disrupt and dismantle the most significant drug traffickers, money launderers, gangs, and transnational criminal organizations. OCDETF identifies, disrupts, and dismantles the highest-level criminal organizations that threaten the United States using a prosecutor-led, intelligence-driven, multi-agency approach. Additional information about the OCDETF Program can be found at https://www.justice.gov/OCDETF.

    The remaining defendants named in the indictment are presumed innocent unless and until proven guilty beyond a reasonable doubt in a court of law.

    MIL Security OSI

  • MIL-OSI United Kingdom: Immigration offenders returned on flight to Nigeria and Ghana

    Source: United Kingdom – Executive Government & Departments

    News story

    Immigration offenders returned on flight to Nigeria and Ghana

    43 people returned to Nigeria and Ghana in an operation, part of a surge in returns activity to secure our border through the Plan for Change

    43 failed asylum seekers and foreign offenders were returned on a charter flight to Nigeria and Ghana, as the government steps up international collaboration to secure our borders.

    The flight underscores the government’s progress restoring order to the immigration system through the Plan for Change, ensuring rules are respected and those who break them are swiftly returned.

    Those removed had no right to be in the UK and included 15 failed asylum seekers and 11 foreign national offenders who had served their sentences. 7 people returned voluntarily.

    Since the election, two charter flights have taken off to the countries, carrying a total of 87 people and demonstrating the strength of cooperation between the UK, Nigeria and Ghana on this critical issue.

    Under this government, over 24,000 people have been returned, an 11% increase on the same period 12 months prior, while four of the largest returns flights ever have taken off returning migrants to countries across Europe, Asia, Africa and South America. 

    Deportations of foreign national offenders are also up 16% since the election, with 3,594 criminals removed.

    Immigration Enforcement ensure that returns are carried out in a dignified and respectful manner.

    Minister for Border Security and Asylum Angela Eagle said:

    This flight demonstrates how international partnerships deliver on working people’s priorities for swift returns and secure borders.

    Through the Plan for Change we’re going further in restoring order to a broken system, accelerating returns of those with no right to be here and closing expensive asylum hotels.

    I thank the governments of Ghana and Nigeria for facilitating this operation, which reflects our joint commitment to disrupt organised immigration crime and protect our borders.

    Baroness Chapman of Darlington, FCDO Minister responsible for Irregular Migration said:

    Working with other countries and partners around the world is critical to tackling irregular migration – by working internationally, we will meet this global challenge together.

    I welcome our strong cooperation with Ghana and Nigeria to return those with no right to be in the UK, secure our borders, and deliver on the Plan for Change.

    This operation follows the Organised Immigration Crime Summit, which saw the UK bring together over 40 countries, including Nigeria and Ghana, to drive forward the global fight against smuggling gangs and deliver on the government’s mission to secure our borders.

    Updates to this page

    Published 25 April 2025

    MIL OSI United Kingdom

  • MIL-OSI United Kingdom: International crackdown on cannabis smuggling

    Source: United Kingdom – Executive Government & Departments 3

    News story

    International crackdown on cannabis smuggling

    UK-Thai cooperation results in 90% reduction in cannabis arriving in the post. 

    Cannabis arrivals by post from Thailand plummeted by 90% in the first three months of this year, thanks to a new partnership between UK Border Force and Thai customs.

    Since Thailand decriminalised cannabis in 2022, there has been a dramatic increase in the amount of cannabis being sent to the UK by post.

    In the last quarter of 2024, Border Force, with the support of Royal Mail, detected over 15 tonnes of the drug, which threatened to overwhelm resources. 

    However, after intense diplomatic engagement, UK Border Force and Thai customs established a new agreement, requiring parcels from Thailand to be checked before they are shipped.

    Border Force have detected 1.5 tonnes of cannabis coming through the post in the first quarter of 2025 – a 90% reduction, which is a result of the extra checks taking place in Thailand.  

    The action is key to this government’s work to boost international cooperation and tighten border security as we deliver safer streets for working people through our Plan for Change.

    Minister for Citizenship and Migration, Seema Malhotra said:  

    Our partnership with Thai customs has slashed cannabis smuggling in the post by 90% in just three months. This collaboration is delivering real results and it’s a prime example of how international cooperation is crucial to our Plan for Change, safer streets mission. 

    By stopping these drugs at source, we’re disrupting organised crime, protecting communities, and freeing Border Force to focus on other priorities. Together with our partners in Thailand, this government will continue to take tough action against those attempting to smuggle illegal drugs across our borders.

    The Home Office and Border Force have also worked closely with Thailand to prevent drugs being smuggled by air passengers. In February, Border Force and the National Crime Agency took part in Operation Chaophraya, a Home Office-led operation at Bangkok Airport.  

    This resulted in over 2 tonnes of cannabis being surrendered from transiting passengers, with an estimated value of £6 million. 

    Since Operation Chaophraya began under this government in July 2024, over 50 British nationals have been arrested in Thailand for attempted cannabis smuggling, underlining the importance of upstream deterrence work.  

    To mark the new partnership, the UK hosted Director General of Thai Customs, Mr Theeraj Athanavanich, and his delegation at Heathrow Airport and a Border Force postal depot earlier this week.  

    Mr Athanavanich met with the Minister for Migration and Citizenship, Seema Malhotra, and Director General for Border Force, Phil Douglas, where they discussed the success of the agreement and future collaboration.  

    Border Force Director General, Phil Douglas said:  

    Border Force works tirelessly to protect and strengthen our borders, by preventing the smuggling of cannabis and other illegal items into the UK. Our work doesn’t stop at the border – we work internationally with our partners to prevent illicit goods from even reaching the UK.  

    We are using advanced intelligence more than ever before and last year we made a record number of drug seizures, including the highest harm substances. Border Force remains fully committed to securing our borders and keeping our streets safe.

    In parallel with its cooperation with the UK on cannabis, Thai customs have introduced stricter screening measures at the border. This has resulted in over 800 cannabis smugglers being intercepted between October 2024 and March 2025, with over 9 tonnes of cannabis seized.

    Both the UK and Thailand are taking a zero-tolerance approach on criminal gangs who are exploiting vulnerable people to smuggle drugs across the UK border on their behalf. Individuals who are caught smuggling drugs will be arrested and face the full force of the law.  

    Alex Murray, NCA Director of threat leadership, said:

    The NCA continues to work with partners at home and abroad to target high-risk routes, seize shipments of drugs and disrupt the OCGs involved, denying them profits.

    We have been working well with the Thai authorities who are keen to intervene. Couriers should think very carefully about agreeing to smuggle cannabis. There are life-changing consequences. Crime groups can be very persuasive but the risk of getting caught is very high and simply not worth it.

    Border Force is committed to delivering the government’s Plan for Change, Safer Streets mission by stopping illegal drugs from entering our country and destroying lives.

    In the year ending March 2024, Border Force and the police seized over 119 tonnes of illegal drugs, with a street value of £3 billion, a 52% increase from the year prior, in the highest number of seizures on record. 

    Charlotte Prescott, Director of Customs and International Policy at Royal Mail said:

    Collaboration between government agencies and postal bodies is essential. We have a very strong partnership with Border Force and are proud to work alongside our Border Force colleagues, assisting their work in identifying restricted and prohibited items, and helping to tackle this issue – this relationship has been recognised as one of the best internationally.

    Updates to this page

    Published 25 April 2025

    MIL OSI United Kingdom

  • MIL-OSI United Kingdom: ARU celebrates global successes of its alumni

    Source: Anglia Ruskin University

    Vice Chancellor’s Outstanding Alumni Awards showcase incredible contributions

    The incredible contributions that Anglia Ruskin University (ARU) graduates have made to communities, culture and enterprise across the world were celebrated at the annual Vice Chancellor’s Outstanding Alumni Awards last night.

    During a glittering ceremony at its Chelmsford campus, ARU welcomed back of its former students to celebrate their successes since crossing the stage and graduating from ARU.

    A total of 34 finalists were shortlisted in seven categories which recognised contributions in areas such as voluntary service, contribution to culture, public service and sustainability.

    • Alumni Contribution to Culture Award: Winner: Thea Lu (MA Children’s Book Illustration 2021). Thea is a picture book author and illustrator whose published works include Dive into the Night Sea, Here & There, and Minuscules Mandibules, winning awards including the Bologna Illustrators Exhibition Winners, 2021 Sebastian Walker Award, and 2024 New York Times/New York Public Library Best Illustrated Children’s Books.
    • Alumni Entrepreneur of the Year Award: Winner: Joe McGrath (Masters of Business Administration 2024). An entrepreneur and marketer, Joe is the founder of Rhotic Media, a financial marketing agency. Joe holds an MBA from ARU and a BA (Hons) in Corporate Communication. He is a Fellow of the Chartered Management Institute and a Member of the Chartered Institute of Marketing. Prior to launching Rhotic, Joe worked as a senior journalist for the Financial Times Group, Dow Jones, and Reach plc.
    • Alumni Lifetime Achievement Award: Winner: Mary Prior KC (LLB 1984) Mary is a barrister with 34 years’ experience of prosecuting and defending the most serious, complex criminal cases across England and Wales. A KC, she is Chair of the Criminal Bar Association, the Midland Criminal Law Association, and Midland Women in Criminal Law. She is also a Bencher and Vice Chair of Education (Outreach) for Gray’s Inn, Head of 36 Crime in London, Patron of the Non-Russell Group of Lawyers and Bringing (Dis)ability to the Bar. In 2020, Mary was named Woman of the Year at the Women in Law Awards.
    • Alumni Public Service Award: Winner: Dr Manshi S. Mankiwala (MSc Public Health 2011). Dr Mankiwala is a dedicated public health professional serving as a state consultant with the National Health Mission, Department of Health and Family Welfare, Gujarat. Her work focuses on strengthening health systems, policy advocacy, and maternal, child, and adolescent health.
    • Alumni Rising Star Award: Winner: Ariana Soares Dias Portela (MSc Applied Bio Science 2021). Ariana Soares Dias Portela is a dedicated scientist who spent two years in New York researching a compound that delays Amyotrophic lateral sclerosis symptoms in mice. She is now pursuing a PhD at the UK’s first Space Innovation Lab, collaborating with NASA to study how microgravity affects aging.
    • Alumni Sustainability Champion Award: Winner: Dr Norbert Edomah (Doctor of Philosophy Global Sustainability Institute 2018). Norbert Edomah is a Professor of Energy Systems and Policy at the School of Science and Technology, Pan Atlantic University, Lagos, Nigeria. With over two decades of experience in the energy sector, he has led several EU and UKRI-funded projects. Norbert focuses on understanding how people respond to changes in energy systems and how these interactions impact energy policy.
    • Alumni Voluntary Service Award: Winner: Oa Hackett (Certificate of Higher Education Charity and Social Enterprise Management (LDS) 2019). Oa founded Little Lifts in 2017 after her breast cancer treatment at the age of 28. The charity has raised over £2million and supported over 28,000 breast cancer patients through 10 NHS hospital partnerships and The Little Kindness Fund. Her contributions have been recognised with a Points of Light Award, a British Citizen Award, and the Chartered Institute Fundraising East of England Professional Fundraiser of the Year Award.

    “The calibre of our nominees has been outstanding. It has been a great pleasure to learn more about their success, and we are proud to recognise their dedication, passion and commitment. They are inspirational role models to our students and our ARU community.”

    Professor Roderick Watkins, Vice Chancellor of Anglia Ruskin University (ARU)

    MIL OSI United Kingdom

  • MIL-OSI Russia: Financial news: 04/25/2025, 12:08 (Moscow time) the values of the upper limit of the price corridor and the range of market risk assessment for the security RU000A10A6B8 (RusGid2P02) were changed.

    Translation. Region: Russian Federal

    Source: Moscow Exchange – Moscow Exchange –

    04/25/2025

    12:08

    In accordance with the Methodology for determining the risk parameters of the stock market and deposit market of Moscow Exchange PJSC by NCO NCC (JSC) on 25.04.2025, 12-08 (Moscow time), the values of the upper limit of the price corridor (up to 133.73) and the range of market risk assessment (up to 1403.31 rubles, equivalent to a rate of 10.0%) of the security RU000A10A6B8 (RusGid2P02) were changed.

    Please note: This information is raw content directly from the source of the information. It is exactly what the source states and does not reflect the position of MIL-OSI or its clients.

    Please Note; This Information is Raw Content Directly from the Information Source. It is access to What the Source Is Stating and Does Not Reflect

    HTTPS: //VVV. MEEX.K.MO/N89798

    MIL OSI Russia News

  • MIL-OSI United Nations: In Dialogue with Turkmenistan, Experts of the Committee against Torture Commend Turkmenistan on Installing Cameras in Places of Detention, Ask about Measures to Prevent Torture in Prisons and the Treatment of Homosexual Persons

    Source: United Nations – Geneva

    The Committee against Torture today concluded its consideration of the eighth periodic report of Turkmenistan, with Committee Experts commending the State for installing cameras in places of detention, while raising questions about measures taken to prevent torture in prisons and the treatment of homosexual persons.

    Liu Huawen, Committee Expert and Country Co-Rapporteur, welcomed that Turkmenistan said it placed high value on human beings, protecting their liberty and fundamental freedoms, and that it had adopted national action plans for protecting human rights, gender equality and children’s rights, and implemented measures to prevent child labour.  It was also commendable that video cameras had been installed in places of detention. Mr. Liu asked questions relating to the operation of these cameras.

    Todd Buchwald, Committee Expert and Country Co-Rapporteur, asked what measures were in place to ensure that legal safeguards against torture were implemented in practice?  Did the State’s laws ensure that medical examinations were independent and conducted within 24 hours of admission into detention centres?  Did all detained persons have the right to challenge their detention? Were all detentions recorded in registers and were there limitations on access to registers?  What measures were in place to ensure that detained persons were informed about the reasons for their arrest promptly in a language they understood both orally and in writing? 

    Mr. Liu said homosexuality remained criminalised in the State party, with up to two years in prison for consensual same sex relations.  Were there any investigations or prosecutions for consensual same sex conduct?  United Nations treaty bodies had repeatedly recommended that the State party repeal this legislation; had any action been taken to implement these recommendations? There had been reports that people who spoke out about issues relating to homosexuality were at risk of being arrested and tortured and that homosexual prisoners were subject to humiliating anal examinations.  Could the delegation comment on these reports?  What measures would be taken to guarantee the rights of lesbian, gay, bisexual and transgender persons? 

    The delegation said Turkmenistan took measures to prevent acts of torture and harsh treatment across its territory.  Over the reporting period, it had invested around 14 million United States dollars in construction and repair work for prisons, medical equipment, and training for staff.  In 2023, the number of convicts fell by 4.5 per cent compared to the previous year, and by a further three per cent in 2024, facilitated by measures taken to provide alternatives to custodial sentences, including parole and commuted sentences.  The occupancy rate in the State’s prisons was 83 per cent.  Food, medical and hygiene supplies were provided to inmates to ensure their health at the cost of the State. 

    The delegation said the State recognised human rights but there were certain specific aspects on which they would follow their own line.  Regarding the allegations of torture and ill-treatment against homosexuals, there had been no such allegations recorded.  If specific details could be provided, more specific information could be provided. 

    Introducing the report, Vepa Hajiyev, Permanent Representative of Turkmenistan to the United Nations Office at Geneva and head of the delegation, said a new edition of the Criminal Code, which entered into force in January 2023, included a definition of torture that was fully aligned with article 1 of the Convention.  The Code established criminal liability for acts of torture and explicitly excluded any justification for such acts, including references to orders, exceptional circumstances, or threats to security. Turkmenistan had established the absolute prohibition of torture, as required by international law.

    In closing remarks, Claude Heller, Committee Chair, said the Committee would highlight several priority recommendations within the concluding observations.  The Committee hoped to continue an open, ongoing dialogue with the State party.   

    In his concluding remarks, Mr. Hajiyev expressed gratitude to the Committee for having the opportunity to present the report. Thanks to the open dialogue over the last two days, members of the delegation had identified priority areas to focus on.  There was a need to review the State’s legislation to ensure it was fully aligned with the main provisions of the Convention. 

    The delegation of Turkmenistan consisted of representatives from the Supreme Court; Prosecutor General’s Office; Ministry of Internal Affairs; Ministry of Justice; Institute of State, Law and Democracy of Turkmenistan; and the Permanent Mission of Turkmenistan to the United Nations Office at Geneva.

    The Committee will issue concluding observations on the report of Turkmenistan at the end of its eighty-second session on 2 May.  Those, and other documents relating to the Committee’s work, including reports submitted by States parties, will be available on the session’s webpage.  Summaries of the public meetings of the Committee can be found here, and webcasts of the public meetings can be found here.

    The Committee will next meet in public on Friday, 25 April at 3 p.m. to continue its consideration of the seventh periodic report of Ukraine (CAT/C/UKR/7).

    Report

    The Committee has before it the third periodic report of Turkmenistan (CAT/C/TKM/3).

    Presentation of Report

    VEPA HAJIYEV, Permanent Representative of Turkmenistan to the United Nations Office at Geneva and head of the delegation, said that following the review of Turkmenistan’s second periodic report by the Committee, the State party had developed an action plan for the implementation of the Committee’s recommendations.  Some 50 subparagraphs of the Committee’s concluding observations had been fully or partially implemented; and 16 were currently being implemented.

    State, law enforcement, and civil society institutions were carrying out practical efforts to prevent conditions that could lead to cruel, inhuman, or degrading treatment or punishment.  The State was implementing national action plans on human rights, gender equality and children’s rights, and against corruption and trafficking, which had specific goals and objectives and indicators for evaluating the results attained.

    A new edition of the Criminal Code, which entered into force in January 2023, included a definition of torture that was fully aligned with article 1 of the Convention.  The Code established criminal liability for acts of torture and explicitly excluded any justification for such acts, including references to orders, exceptional circumstances, or threats to security. Turkmenistan had established the absolute prohibition of torture, as required by international law.

    In recent years, Turkmenistan had been implementing measures to strengthen the institutional capacity of the Ombudsman.  In 2024, new departments were created within the Ombudsman’s Office and the number of staff increased.  Amendments made in 2024 to the law on the Ombudsman enhanced the Ombudsman’s ability to restore violated rights and broadened the scope for applying preventive measures.  The Ombudsman’s Office continued to closely cooperate with international organizations to bring its mandate fully in line with the Paris Principles and was developing a roadmap for upgrading its status to category “A”.

    Turkmenistan had undertaken a comprehensive set of reforms aimed at improving the judicial system and enhancing the quality of justice.  The State Concept for the Development of the Judicial System for 2022-2028 aimed to improve the legislative framework governing the functioning of the courts, the qualifications of judicial system personnel, and the material and technical infrastructure of the courts, as well as expand international legal cooperation.  In April 2025, a new edition of the law on the judiciary was adopted, which incorporated key international standards related to the independence and competence of judges, as well as measures aimed at enhancing the efficiency of the courts.

    To modernise and standardise the process of professional development for judges and judicial staff, a new procedure for organising and conducting relevant training activities was approved in 2023.  Turkmenistan was also implementing a phased digitalisation of its judiciary to enhance transparency, facilitating video and audio recording of court proceedings and digital access to judicial information and services.  Between 2020 and 2025, lawyers provided legal assistance in 530 cases of detention where unlawful actions falling under the scope of the Convention were identified.

    In line with the Committee’s concluding observations, internal regulations governing conditions of detention had been introduced.  These rules covered living conditions, medical care, and the rights to phone calls, visits, walks, and to receive parcels.  Particular attention was paid to medical supervision and the documentation of physical injuries.  Every individual admitted to a penitentiary facility underwent a mandatory medical examination.  Any injuries discovered were documented, and in cases where violence was suspected, an additional investigation was carried out. 

    Between 2020 and 2023, large-scale reconstruction and capital repairs were carried out in 12 penitentiary institutions.  These efforts aimed to bring detention conditions in line with the Mandela Rules. Monitoring visits by the Ombudsman and Public Monitoring Commissions were regularly organised – a total of 20 visits to places of detention were conducted in 2023-2024 alone.

    Criminal procedural legislation explicitly prohibited the use of evidence obtained through torture, threats, deception, or cruel treatment.  All institutions under the jurisdiction of the Ministry of Internal Affairs had implemented the practice of video recording interrogations to ensure transparency and help prevent potential abuses.

    The Criminal Code provided for liability for violent acts within the household.  A national survey was conducted in cooperation with the United Nations Population Fund on domestic violence against women, and based on its findings, a roadmap for the prevention of domestic violence for 2022–2025 was developed.  The State aimed to introduce clear definitions, establish penalties, and create comprehensive protection mechanisms for vulnerable groups, including conducting awareness-raising campaigns.  Human rights education and the prevention of torture were integral components of the training of law enforcement personnel.

    A cooperation plan between the Government and the International Committee of the Red Cross Representation for 2025 had been approved, which included seminars and lectures on international standards of law enforcement for relevant agency personnel, and awareness-raising initiatives on international norms related to the treatment of persons deprived of liberty and to penitentiary standards. Discussions were ongoing on the possible organization of visits to places of detention by the International Committee of the Red Cross.  Direct contact had also been established since 2024 with Human Rights Watch and other human rights organizations.

    Questions by Committee Experts

    TODD BUCHWALD, Committee Expert and Country Co-Rapporteur, said there were reports of numerous enforced disappearances in Turkmenistan, the victims of which remained behind bars without access to family members.  There were 162 reports of such disappearances by the Prove-They-Are-Alive campaign, including 29 persons who had died in custody. There were also reports of cruel treatment of detainees, lack of independence of the judiciary, harassment of journalists and human rights defenders, and a culture of impunity. Did the State have sufficient mechanisms to identify torture and ill-treatment?  What had the State party done to investigate the 162 reported cases of enforced disappearance?

    What measures were in place to ensure that legal safeguards against torture were implemented in practice? Did the State’s laws ensure that medical examinations were independent and conducted within 24 hours of admission into detention centres?  Did all detained persons have the right to challenge their detention?  Were all detentions recorded in registers and were there limitations on access to registers?  What measures were in place to ensure that detained persons were informed about the reasons for their arrest promptly in a language they understood both orally and in writing? 

    In which circumstances did the right to free legal assistance for accused persons apply?  There were cases in which accused persons had reportedly struggled to obtain legal representation.  How did the State ensure that lawyers were not dissuaded from representing clients seen as controversial, and that lawyers were well-trained and independent?  There were reports of closed trials; what legal rules governed such trials?  Was the right to immediately inform family members of detention provided in law and in practice?  Were officers that failed to provide these safeguards punished? How many complaints had been received related to the lack of provision of safeguards and what investigations had been carried out in response?

    Turkmenistan remained largely closed to international scrutiny.  It had issued a standing invitation to special procedures in 2018 but had not accepted all but one of the 15 requests for visits received since, and the one visit that was accepted had not yet been carried out.  How would the State party improve cooperation with special procedures? Did the International Committee of the Red Cross have access to places of deprivation of liberty?  How many meetings between representatives of international organizations and detained persons had been held in the last three years, and how were such persons protected from reprisals?

    What was the Government doing to ratify the Optional Protocol and to accept the Committee’s jurisdiction to receive individual communications?  What awareness raising campaigns was the State party carrying out regarding the Committee’s concluding observations?  Were translated versions of the concluding observations published online?  The State had not provided data in response to several of the questions posed by the Committee in the list of issues.  What measures were in place to develop the State’s capacities in data collection?

    There were concerns that the Ombudsman’s Office lacked independence and had not taken steps to address torture and ill-treatment.  Its reports failed to adequately address human rights violations, and it had not submitted a report to the Committee before the dialogue.  What was the State party doing to strengthen the mandate of the Ombudsman’s Office to investigate human rights violations?  The Office had no mandate to conduct visits to places of detention; would such a mandate be established?  Did the Ombudsman require prior permission to conduct such visits? 

    Complaints from individuals could only be considered by the Ombudsman within one year, eliminating the possibility of investigating historical crimes.  Would this rule be eliminated?  What measures were in place to ensure that complaints submitted to the Ombudsman were kept confidential?  There had been few appeals to the Ombudsman’s Office by persons deprived of liberty; why was this?  Had the Office recommended ratifying international human rights treaties and facilitating visits by special procedures?  How many times had the Ombudsman concluded that there had been a human rights violation and what actions were taken in response?

    Turkmenistan had not granted asylum to any person since 2005.  How was the State party strengthening its asylum procedures?  Did it cooperate with the United Nations High Commissioner for Refugees?  Persons unable to document their lack of nationality were denied statelessness status. Was the State party working to address this issue?

    Mr. Buchwald cited reports of prison staff torturing prisoners, including by beating a man to death with a soldering iron, denying an ill prisoner medical treatment, and torturing a man with an electric current.  How did the State party prevent torture in detention and investigate all reported cases? There were also reports of forcible transfers of critics of the State living abroad to Turkmenistan, where they were subjected to abuse and enforced disappearance, and of travel bans imposed on activists who opposed the Government.  How would the State party guarantee activists’ safety and right to travel?

    LIU HUAWEN, Committee Expert and Country Co-Rapporteur, welcomed that the State said it placed high value on human beings, protecting their liberty and fundamental freedoms, and that it had adopted national action plans for protecting human rights, gender equality and children’s rights, and implemented measures to prevent child labour. 

    The Committee also welcomed the training activities carried out for the police.  However, there was no mechanism for assessing the effectiveness of this training.  Was training mandatory and how many personnel had participated?  It was commendable that annual training was provided for judges of the Supreme Court.  What training was provided for judicial personnel in other courts and medical personnel involved in the treatment of detainees?  Did such training address the revised Istanbul Protocol? 

    The Committee was concerned by the absence of guidelines on the prohibition of torture in the healthcare sector?  Would such guidelines be developed?  Were there ongoing training programmes on the prohibition of torture for police officers and prison staff?  Were international personnel involved in the design and presentation of this training?

    It was commendable that video cameras had been installed in places of detention.  What percentage of places of deprivation of liberty had been equipped? Were all interrogations recorded? Were there consequences for failing to record interrogations?  Were there limitations on access to recordings by detained persons and their lawyers?

    How many persons were detained in Turkmenistan’s prisons and for what period of time?  What efforts were underway to expand alternatives to detention? There were reports that prisons held nearly three times their capacity, and that Turkmenistan had the fourth highest incarceration rate globally.  What steps had been taken to reduce occupancy rates?

    There were reports of failures to provide timely medical examinations and delays in isolating prisoners with tuberculosis, which increased the risk of spread of the disease.  Prisoners reportedly needed to pay for medications that should be provided for free.  Some detainees went months without being provided access to leisure facilities within prisons.  Could the delegation comment on these issues?

    Persons could reportedly be placed in solitary confinement for up to three months, left in total darkness with a lack of access to water or basic hygiene.  How was the use of solitary confinement documented and regulated? Had measures been taken to gradually end the use of prolonged solitary confinement, which was reportedly used as a tool of repression against political prisoners?  What rules governed visitation rights and phone calls for persons in solitary confinement?

    How did the State party ensure that meetings between lawyers and remand prisoners were private?  Were there provisions prohibiting the interrogation of suspects before lawyers were present?  Could refusals to give testimony be used against detainees in court?

    The Committee called for data on inter-prisoner violence and deaths in custody, and investigations into such cases. How did the State party ensure that family members could request independent autopsies of deaths in custody and that victims of violence in prisons could report the incident? Police officers had the right to use physical force to protect the rights and freedoms of citizens and prevent “socially dangerous acts” under State law.  This law seemed exceedingly broad.  Did it apply to the use of firearms?  Were there more specific rules governing the use of force?  What investigations had been carried out into excessive use of force by the police and what were their outcomes?

    There were reports that patients in psychiatric facilities were abused by staff.  What measures were in place to improve complaints mechanisms in such facilities?  How did the State party oversee involuntary hospitalisations?  In how many cases had restraints been used in psychiatric facilities, and what types of restraints were used?

    How did the State party ensure that appropriate support services were provided to victims of torture?  What measures were in place to provide redress, compensation and rehabilitation to victims?

    The Committee welcomed the criminalisation of corporal punishment in all settings and measures taken to protect children from violence, including the appointment of inspectors specialising in violence against children.  How many cases had they investigated?  The Committee also welcomed the establishment of juvenile courts.  How many cases had they assessed?  What measures were in place to prevent the detention of juveniles?

    Gender-based violence had not been established as a separate crime in the Criminal Code, though there were many cases of gender-based violence in the State.  Had the roadmap developed to prevent gender-based violence been published online?  What progress had been made in implementing it?  What were the obstacles to adopting a law on gender-based violence?  How did the State party evaluate its awareness raising activities on gender-based violence?  Were victims support services in place?  How many shelters for victims and hotlines for reporting violence had been established? 

    High school girls were reportedly subjected to forced virginity tests, and information on girls found to have had sexual relations was reportedly passed to police.  How did the State party prevent this practice?

    Other Committee Experts asked questions on the national action plan on countering terrorism and the international organizations the State party partnered with to implement the plan; how legal safeguards were ensured for persons suspected of terrorism; the number of convictions imposed under anti-terrorism legislation; reforms adopted to align the legislative framework on terrorism with the State’s international obligations; the number of juveniles, particularly girls, currently in detention and the conditions in which they were held; measures to prevent overcrowding and ensure access to healthcare in prisons; and complaints and monitoring mechanisms in place for juvenile detention.

    Responses by the Delegation

    The delegation said Turkmenistan took measures to prevent acts of torture and harsh treatment across its territory.  Over the reporting period, it had invested around 14 million United States dollars in construction and repair work for prisons, bought medical equipment, and ensured training for staff.  In 2023, the number of convicts fell by four and a half per cent compared to the previous year, and by a further three per cent in 2024, facilitated by measures taken to provide alternatives to custodial sentences, including parole and commuted sentences. 

    The occupancy rate in the State’s prisons was 83 per cent.  Food, medical and hygiene supplies were provided to inmates to ensure their health at the cost of the State.  Allegations of infected inmates not being separated from other inmates were unfounded; such inmates were transferred to prison hospitals for treatment.  The State had examined eight complaints from prisoners in 2023 and five in 2024, finding no wrongdoing by State officials in each case.  Regular training sessions were organised for prison staff, which addressed basic standards for treating inmates.  Over 2,000 training sessions were carried out between 2022 and 2024.

    Turkmenistan had continued to develop its legislation on torture and other cruel, inhuman or degrading treatment.  Between 2022 and 2024, orders were issued on strengthening supervisory work on places of deprivation of liberty and on creating a special body for regulating medical examinations in prisons.

    The Ombudsman’s Office had access to all places of deprivation of liberty and did not need prior permission to conduct visits.  It verified the sanitary norms of establishments, the right to food and healthcare, and the right to visits and to receive parcels from family members. The Office had issued recommendations on improving detention facilities and healthcare services in prisons that the Government was working to implement.  No complaints had been received by the Ombudsman on the lack of provision of parole, or from inmates in detention centres for women or juveniles.

    Work had been undertaken to ensure that police stations and remand prisons were equipped with audio-visual recording devices.  Access to recordings was given to the Ombudsman and legal counsel.

    The national action plan on gender equality for 2021-2025 included measures to combat gender-based violence against women and girls, including domestic violence.  A survey conducted by the State showed that some 12 per cent of women in Turkmenistan had been subjected to domestic violence.  A roadmap to implement the survey’s recommendations had been developed, which included plans to develop a rapid response mechanism for domestic violence. 

    The State had established a pilot system of family support centres where social workers provided support for victims of violence; this would soon be expanded.  There were also hotlines that victims could use to report violence.  The Government was studying legislation on domestic violence in other countries with a view to developing such legislation domestically.

    The delegation said Turkmenistan regularly provided information on individual cases to various United Nations structures.  Turkmenistan had given information concerning individuals to certain countries, and special procedures had closed these cases.  The State would continue to provide information to the special procedures and other interested parties.  There was no special complaints mechanism for cases of cruel or inhumane treatment, but a complaint could be submitted to authorities of law enforcement via writing or in person.  The Special Prosecutor visited places of detention to monitor the work of the penitentiary institutions. 

    According to the Criminal Code, the diagnosis of an illness could be a ground for early release, and a decision would be taken by a court.  The delegation cited several cases, including one prisoner who in 2017 was convicted of smuggling psychoactive substances, and was pardoned in 2020.  Three years later, another criminal case was initiated against him, after which he was placed on a wanted list.  He hid in a mountainous area for some time without food and medication, surviving on psychoactive substances.  When he was detained, he already had multiple forms of bodily harm, developed during his time in the mountains, and he died three days after he was detained due to an overdose from psychoactive substances. Evidence that his cause of death was bodily harm due to torture was not true and this had been confirmed by the forensic investigation.  Turkmenistan’s actions throughout all cases had been aimed at protecting its citizens.

    The memorandum on humanitarian visits had not yet been signed, as negotiations had been interrupted six years ago.  In 2024, the Turkmen side took the initiative to discuss the text again and was waiting to hear from the International Criminal Court.  The State was ready to consider requests from the International Criminal Court to visit places of detention. 

    Immediately after the appeal of the High Commissioner for Refugees to grant asylum to citizens of Afghanistan, Turkmenistan as a neighbouring country expressed willingness to make all resources available to facilitate transport to third countries.  About 150 Afghan citizens received temporary visas while they awaited permission to move to other countries.  A person had the right to continue to stay in the country until their status was determined officially, whether this was a stateless person, or an individual of another country.  During the COVID-19 pandemic, amendments were made to the law on migration which provided for the option to extend the validity of passports in emergency situations.  A passport could only be renewed twice and only in extraordinary legal circumstances.

    Not all countries of the world had the practice of issuing passports abroad, as this required significant resources and would become an additional burden on the State.  Primary requests to obtain a passport abroad could be submitted electronically.  The Government was looking to simplify the procedure for issuing passports. 

    Solitary confinement was only meted out to prisoners for intentional violations and measures.  Training courses regarding torture and solitary confinement were provided to the Ministry of Interior staff.  A learning course had been started for the doctors working in the penitentiary system to update their knowledge of tuberculosis and treatment.  Medical units were present within each penitentiary establishment.  The treatment plan for the multi-drug-resistant tuberculosis was fully functioning.  Work was ongoing to deal with cases of tuberculosis, and penitentiary administrations were responsible for ensuring the good health of convicts.

    Last month, a monitoring visit had been conducted to see seven Turkish prisoners serving sentences in Turkmenistan. There was only one establishment for juvenile offenders, and the occupancy rate was 22 per cent of its total capacity.  Juvenile female offenders were held separately from male offenders. 

    Turkmenistan had successfully implemented a national strategy to prevent violent extremism and combat terrorism and was preparing the new strategy for 2025-2030.   

    Around 94 court rooms had audio and video cameras, representing more than 90 per cent of courtrooms in the country. This work on the digitalisation of courts was continuing.  The accused had the right to view all documents related to the case, including documents and video recordings.  Relevant work was carried out to implement the provisions of the Convention.  The new version of the Criminal Code entered into force in January 2023 and punishment for certain crimes had been reduced. 

    All courts in Turkmenistan had special rooms for minors, increasing their protection.  A new provision had been introduced, in which a minor committing an offence for the first time, providing it was a medium offence or below, would not be imprisoned.  There had been a drop in the numbers of minors imprisoned by 35 per cent in 2024, compared to 2020, as a result. 

    According to the Criminal Code, data should not be considered admissible in court if acquired through violations of the law, including torture, violence or threat.  Courts now had specialised judges on family matters to ensure the best interests of children.  A lawyer was available from the moment of detention or indictment.  In the event of remand of a minor, or a person with a disability, there were specific provisions.  Use of an interpreter could be requested. 

    In each case of detention, a notification was sent in writing to the Office of the Public Prosecutor, within 24 hours from the moment of detention.  The Office of the Public Prosecutor had the right to cancel an unlawful detention.  Without the authorisation of the Public Prosecutor, a detainee needed to be released after 24 hours, with the arrest communicated to close relatives. 

    Disciplinary measures were taken against staff and other officials who breached guaranteed safeguards.  The Code of Criminal Procedure was in keeping with international treaties, which meant there were guarantees to safeguard the rights of the accused. 

    To date, Turkmenistan had two national action plans on combatting human trafficking.  The penalty for this crime had been strengthened to between 15 to 20 years in prison.  A Commission on Combatting Human Trafficking had been established in Turkmenistan, which included 13 State bodies working on this issue.  In July 2024, the first meeting of the Commission was held.  The Commission was tasked with ensuring the implementation of the national action plan, including through prevention, protection, and prosecution, providing assistance to victims, and carrying out awareness raising events.  The national action plan 2020-2025 was adopted by a decree. 

    The Ministry of Justice provided support to the Bar Association of the country.  There were six associations of lawyers in Turkmenistan.  Over the last four years, lawyers in Turkmenistan had participated in 48 training sessions on human rights and had carried out more than 3,000 visits to places to detention.  A conference had taken place where participants from many countries exchanged views on how to better protect lawyers.  The State stood ready to continue work in the legal area, promote a legal culture, and strengthen international cooperation.

    There had been no complaints recorded about forced virginity tests, but the delegation would look into any case if information was provided.  In certain cases, law enforcement bodies could ask for medical tests to be carried out in the framework of existing legislation.  A roadmap had been developed for the ratification of the Optional Protocol and work was ongoing in this respect. 

    Questions by Committee Experts

    TODD BUCHWALD, Committee Expert and Country Co-Rapporteur, said many bodies and individuals had made allegations, which the State party had denied.  The bodies making these allegations were highly credible.  The Committee recommended the ratification of the Optional Protocol to the Convention as a critical step for the State party, as well as having a regular relationship with the International Criminal Court.  Were the recommendations from Committees made available in all major newspapers? 

    The Ombudsman had not received any complaints which was concerning.  Did this suggest a need to deal more assertively with the problem?  It was positive that the Ombudsman had access to all places of deprivation of liberty; however, it was inferred that she had not visited some facilities.  Was this correct?  Was it possible to share the data responsive to the Committee’s list of issues?  There was data available on overcrowding, so it would be helpful to provide disaggregated data split by facility. 

    How was it determined whether information published by journalists was true, accurate or impartial?  What were the penalties for publishing information which was determined not to fall under this category?  What were the prospects for revising the law so there would be no statute of limitations for the crime of torture? 

    LIU HUAWEN, Committee Expert and Country Co-Rapporteur, said there had been progress in the field of family law.  Today, domestic violence was not a matter of private law, but a focus of public law.  Marriage and family membership should not deprive any person of her or his basic human rights. 

    Turkmenistan’s strict abortion restrictions could create a cruel, inhumane or degrading environment for women, with abortion banned after five weeks, which was before many women realised they were pregnant.  Reproductive health care was limited, forcing women towards unsafe methods which endangered their health and lives.  These laws contributed to preventable maternal deaths and increased health risks. It was regretful that Turkmenistan did not provide access to emergency contraceptives. 

    The Committee suggested that the State party align its legal framework with international standards.  Would the State party take concrete steps to ensure access to safe abortion nation-wide and to reduce teenage pregnancies, including by providing access to contraceptives and reproductive services? Would the State ensure that doctors and medical professionals provided safe abortions for women whose lives were at risk due to pregnancy? 

    Homosexuality remained criminalised in the State party, with up to two years in prison for consensual same sex relations.  Were there any investigations or prosecutions for consensual same sex conduct?  United Nations treaty bodies had repeatedly recommended that the State party repeal this legislation; had any action been taken to implement these recommendations?  There had been reports that people who spoke out about issues relating to homosexuality were at risk of being arrested and tortured and that homosexual prisoners were subject to humiliating anal examinations.  Could the delegation comment on these reports? 

    What measures would be taken to guarantee the rights of lesbian, gay, bisexual and transgender persons?  Would the State party provide systematic training for law enforcement officers, police officers and members of the judiciary on human rights standards for gender and sexual identity orientation?

    As a neutral country, Turkmenistan could play a more constructive and unique role in international cooperation. It was hoped Turkmenistan would make a greater contribution to global governance, including through the effective implementation of the Convention. 

    A Committee Expert asked if there was monitoring of places of deprivation of liberty where minors were held? Who carried out this monitoring activity? 

    Another Expert asked about the legislation to combat terrorism; could more specific information be provided? 

    Responses by the Delegation 

    The delegation said cooperation was something which Turkmenistan needed to improve.  The State party worked with various international organizations and human rights committees in Geneva.  All decisions and conclusions voiced within the Committee needed to be based on established and recognised standards.  Often the opinions of law enforcement bodies were interpreted objectively, and the State was trying to bridge the gap by involving representatives of civil society to enable human rights organizations to better understand the individual cases. There was a clear imbalance of information, and the State was doing its best to address this.  The State did not plan the official publication of results of the Committee’s recommendations, but if others wished to publish them, they could do so.

    The Ombudsperson visited prisons, but it was important to enhance the capacities of the institution to ensure it had greater access to places of detention.  The State recognised human rights but there were certain specific aspects on which they would follow their own line.  Regarding the allegations of torture and ill-treatment against homosexuals, there had been no such allegations recorded.  If specific details could be provided, more specific information could be provided. 

    As a neutral state, Turkmenistan was working to advocate for the values of peace and trust to ensure the Sustainable Development Goals were met.   

    Currently, Turkmenistan was a party to the 19 legal instruments combatting terrorism.  The law on combatting terrorism included legal protection of citizens for their participation in combatting terrorism. The State had extensive levels of cooperation in this area.  There were no issues of overcrowding in prisons.  The State rejected allegations that there had been an increase in the number of minors detained.  There had been single cases, which did not represent a serious problem in the country. Institutions for minors serving sentences functioning under the auspices of the Ministry of Interior were monitored by the Ombudsman and other institutions. 

    Turkmenistan worked closely with the counterterrorism mechanism of the United Nations.  A seminar had been held in Doha about the spread of terrorist ideas through the internet. 

    Women had the permission to interrupt pregnancies after the established timeframe, but this was based on an individual approach, relating to specific circumstances.  Having abortions outside of medical institutions involved serious risks to the health of women.  To prevent illegal abortions, there were special provisions in the law of responsibility.  Written agreement was required from parents only if the girl was under the age of 18. 

    In 2023, the General Prosecutor’s Office of Turkmenistan, in conjunction with the United Nations Development Programme, organised special seminars attended by over 100 participants from law enforcement agencies.  Such events, relating to refresher training, took place all over the world, including in the United States, Europe and Asia.  In March this year, Turkmenistan held a briefing relating to the presentation of a national plan on combatting trafficking. 

    Turkmenistan had ratified a significant number of legal instruments and it received bilateral requests on extradition related to criminal prosecutions, including for crimes of torture.  When a person was extradited, Turkmenistan took into account all guarantees provided in relevant United Nations Conventions. In each case, the situation of the person was reviewed to ensure the person would not be subject to torture in the country to which the person was extradited.  It was necessary to receive a written confirmation from the State that torture would not be used against those individuals. 

    Closing Remarks 

    CLAUDE HELLER, Committee Chairperson, said the delegation had 48 hours to provide the Committee with additional information.  The Committee would highlight several priority recommendations within the concluding observations.  The Committee hoped to continue an open, ongoing dialogue with the State party.   

    VEPA HAJIYEV, Permanent Representative of Turkmenistan to the United Nations Office at Geneva and head of the delegation, expressed gratitude to the Committee for having the opportunity to present the report.  Thanks to the open dialogue over the last two days, members of the delegation had identified priority areas to focus on.  The Committee’s recommendations would be thoroughly reviewed.  There was a need to review the State’s legislation to ensure it was fully aligned with the main provisions of the Convention.  Any progress required work and readiness to move forward. 

    ___________

    Produced by the United Nations Information Service in Geneva for use of the media; 
    not an official record. English and French versions of our releases are different as they are the product of two separate coverage teams that work independently.

     

    CAT25.007E

    MIL OSI United Nations News

  • MIL-OSI Economics: Triada strikes back

    Source: Securelist – Kaspersky

    Headline: Triada strikes back

    Introduction

    Older versions of Android contained various vulnerabilities that allowed gaining root access to the device. Many malicious programs exploited these to elevate their system privileges and gain persistence. The notorious Triada Trojan also used this attack vector. With time, the vulnerabilities were patched, and restrictions were added to the firmware. Specifically, system partitions in recent Android versions cannot be edited, even with superuser privileges. Ironically, this has inadvertently benefited malicious actors. While external malware now faces greater permission restrictions, pre-installed malware within system partitions has become impossible to remove. Attackers are leveraging this by embedding malicious software into Android device firmware. This is how one of our earlier findings, the Dwphon loader, functioned. It was built into system apps for over-the-air (OTA) updates. In March 2025, our research highlighted the Triada Trojan’s evolved tactics to overcome Android’s enhanced privilege restrictions. Attackers are now embedding a sophisticated multi-stage loader directly into device firmware. This allows the Trojan to infect the Zygote process, thereby compromising every application running on the system.

    Key takeaways:

    • We discovered new versions of the Triada Trojan on devices whose firmware was infected even before they were available for sale. These were imitations of popular smartphone brands, and they remained available from various online marketplaces at the time of our research.
    • A copy of the Trojan infiltrates every application launched on an infected device. The modular architecture of the malware gives attackers virtually unlimited control over the system, enabling them to tailor functionality to specific applications.
    • In the current version of Triada, the payloads we have analyzed exhibit several malicious behaviors depending on the host application. Specifically, they can modify cryptocurrency wallet addresses during transfer attempts, replace links in browsers, send arbitrary text messages and intercept replies, and steal login credentials for messaging and social media apps.

    The complete infection chain looks like this:

    Triada Trojan infection chain

    Kaspersky products detect the new version of Triada as Backdoor.AndroidOS.Triada.z..

    System framework with a malicious dependency

    Our initial investigation focused on native libraries included in the firmware of several devices, located in:

    • /system/framework/arm/binder.so
    • /system/framework/arm64/binder.so

    The file is not present in a reference Android version. We discovered that the suspicious library was loaded into Zygote, the parent process for every Android application, by an infected AOT-compiled Android system framework ( bootframework.oat) located in the same directory.

    Malicious dependency in boot-framework.oat

    The binder.so library registers a native method, println_native, for the android.util.Log class, used by applications installed on the device to write messages to Logcat. The implementation of this method calls a suspicious function, _config_log_println.

    Call to the suspicious function

    The _config_log_println function then calls two other functions that deploy three modules, contained in the rodata section of the malicious library, into every process launched on the device. One of the functions runs every time, while the other one only runs if the Android OS on the device is Version 9 or earlier.

    Execution of the two malicious functions

    Let us take a closer look at the modules that these launch.

    1. Auxiliary module

    This module from the rodata section of the malicious library is written to the application’s internal data directory under the name systemlibarm64_%N%.jar, where N is a random number.

    Loading the auxiliary module

    The auxiliary module registers a receiver that can load arbitrary code files, although we did not see this happen in the cases described below. We would later call this module auxiliary because other payloads relied on it to perform their malicious functions. For example, for the com.android.core.info.config.JvmCore class from this module, binder.so registers native methods that can intercept calls to arbitrary methods within the process where the malware is running.

    2. The mms-core.jar backdoor

    This module undergoes a double XOR decryption process with different keys pulled from the rodata section of the malicious library. After decryption, it is saved to disk as /data/data/%PACKAGE%/mms-core.jar and then loaded using DexClassLoader. Once the loading is complete, the payload file is deleted.

    Loading the backdoor

    This mmscore.jar is a new iteration of a backdoor we mentioned in our earlier reports. In contrast to past versions, which exploited and modified system files to load itself into Zygote, the malware now achieves reliable Zygote access by leveraging a compromised system framework. Similar to previous versions, the backdoor downloads and executes other payloads.

    3. Crypto stealer or dropper?

    Immediately upon starting, the binder.so library reads the file /proc/%PID%/cmdline, with %PID% representing the system process ID. This is how the Trojan determines the package name of a running app.

    Package name check

    Based on the package name, binder.so loads either a crypto stealer loader (if the application is cryptocurrency-related) or a dropper from the rodata section. Neither payload is encrypted.

    Triada crypto stealer

    In previous Triada versions we analyzed, cryptocurrency applications were immediately infected with a crypto stealer. However, in these latest samples, the malicious module is a loader specifically targeting apps with the following package names:

    The entry point for this malicious loader is the onCreate method within the com.hwsen.abc.SDK class. In latest versions this module requests a configuration from a GitHub repository. Using a pseudo-random number generator, the sample selects a number (0, 1, or 2), each corresponding to a specific repository address.

    Loading the configuration

    All field values within the configuration are encrypted using AES-128 in ECB mode and then encoded with Base64. An example of a decrypted configuration is shown below:

    If online equals true, the loader downloads a payload from the URL specified in the durl field. If errors occur, it uses durl2 and durl3 as backup links. The downloaded payload is decrypted using XOR with a hardcoded key and saved to the application’s internal data directory under the name specified in the vname parameter. The pkg and method fields represent the class name and method, respectively, that will be called after the crypto stealer is loaded via DexClassLoader.

    The downloaded payload attempts to steal the victim’s cryptocurrency using various methods. For example, it monitors running activities at preset intervals. This allows the Trojan to intercept attempts at withdrawing cryptocurrency and replace the victim’s crypto wallet addresses in the relevant text fields with addresses belonging to the attackers. To achieve this, the malware runs a depth-first search for all graphical sub-elements within the current frame, identifying the blockchain to which the funds are being sent. The Trojan then swaps the crypto wallet address with a hardcoded one and replaces the click handlers of all buttons in the application with a proxy handler that swaps the crypto wallet address again, ensuring the attackers can steal the funds. Interestingly, the crypto stealer also replaces image elements with generated QR codes containing attacker-controlled wallet addresses.

    Text and image replacement

    The Trojan also monitors the clipboard contents and, if it finds a crypto wallet address, it gets replaced with an address belonging to the attackers.

    Clipboard hijacking

    Dropper

    If the binder.so library happens to run in an app unrelated to cryptocurrency, it downloads a different payload. This is a dropper that calls the onCreate method within the com.system.framework.api.vp2130.services class. Depending on the version, it can extract up to three Base64-encoded additional modules from its own contents.

    • The dropper loads a com.android.packageinstaller.apiv21.ApiV21 class from the first module inside the system APK installer app. This class registers a receiver that allows other modules to install arbitrary APKs on the device and also uninstall any apps.

    Malicious receiver

    Beginning with Android 13, apps from untrusted sources are restricted from accessing sensitive permissions, such as those for accessibility services. To bypass these restrictions for sideloaded apps, the receiver installs them through an installation session in newer Android versions.

    • The com.system.framework.audio.Audio class is loaded from the second module to block network connections. Depending on the system architecture, it decodes and loads a native helper library. This library uses the xhook library to intercept calls to the getaddrinfo and android_getaddrinfofornet functions. These functions handle communication with the dnsproxyd service in Android, which performs DNS requests using a client-server model. If the attackers have sent a command to block a specific domain, its name is replaced by a hook redirecting to 127.0.0.1, making access to the original domain impossible.

    Intercepting the dnsproxyd communications functions

    Thus, the malware can block requests to anti-fraud services unless they use a custom DNS implementation.

    • The com.system.framework.api.init.services class is also loaded from the third module to download arbitrary payloads. For this purpose, the malware periodically transmits a wealth of device information (MAC address, model, CPU, manufacturer, IMEI, IMSI, etc.), along with the host application name and version, to its command-and-control server. Before being sent, the data is encrypted using AES-128 in CBC mode and then encoded with Base64. The C2 responds with a JSON file containing information about the payload, also encrypted with AES-128 in CBC mode. The infected device receives the key and initialization vector (IV) RSA-encrypted from the C2 within the same JSON.

    Decoding, loading, and running the payload

    For convenience, we will refer to this module as the Triada backdoor going forward. It is this module that holds the greatest interest for our research, as it provides the malware with a wide range of capabilities. A closer look at the Triada threat actor’s objectives yielded a somewhat surprising result. Whereas previous malicious samples mainly displayed ads and signed users up for paid subscriptions, the attackers’ priorities have now drastically changed.

    What Triada downloads

    To understand exactly how the attackers’ priorities have shifted, we decided to try downloading the payloads for various popular apps. We observed that the binder.so malicious library passes a flag to the dropper upon starting if the application’s name is on a list within its code. This list included both system apps and popular apps from official stores.

    Some apps from binder.so

    This list served as the starting point for our investigation. For all the listed applications, we sent requests to the malware C2, and some of them returned links to download payloads. As an example, this is the response we received from the Trojan after requesting a payload for Telegram:

    The payload information from the C2 server was received as an array of objects, with each containing two download URLs (primary and backup), the MD5 hash of the file to download, the module’s entry point details, and its ID. After downloading, the modules were decrypted twice using XOR with different keys.

    Triada decrypting the payload

    In addition to this, the response from the C2 contained other package names. By using these, we were able to obtain various further payloads.

    It should be noted that according to the Android security model, unprivileged users do not normally have access to certain application data. However, as mentioned earlier, the malware is loaded by the Zygote process, which allows it to bypass OS restrictions because each payload runs within the process of the app it targets. This means the modules can obtain any application data, and the attackers actively exploit this in subsequent stages of infection. Furthermore, each additional malware payload can use all the permissions available to the app.

    During module analysis, we also noted the significant skill of the Triada creators: each payload is tailored to the target app’s characteristics. Let us see which modules the Trojan loaded into some popular Android apps.

    Telegram modules

    For the Telegram messaging app, the Triada backdoor downloaded two modules at the time of this research. The first module (b8a745bdc0e083ffc88a524c7f465140) launches a malicious task within the messaging app’s context once every 24 hours. We believe that the attackers thoroughly examined Telegram’s internal workings before coding this task.

    Malicious task code

    Initially, the malicious task tries to obtain the victim’s account details. To do this, the module reads a string associated with the user key from the key-value pairs saved using SharedPreferences in the app settings XML file named userconfig. The string contains Base64-encoded serialized data about the Telegram user, which the messaging client code deserializes to communicate with the API. The malware takes advantage of this: Triada tries several reflection-based methods to read the user data.

    Deserializing victim account details

    The malware sends the following user information to the C2 server if it has not done so previously:

    • A serialized string containing the victim’s account details.
    • The victim’s phone number.
    • The contents of the tgnet.dat file from the application’s data directory.
      This file stores Telegram authentication data including the user’s token, which allows the attackers to gain complete control over the victim’s account.
    • The string with id=1 from the params table in the cache4.db database.

    This payload also contains unused code for displaying ads.

    The second module (fce117a9d7c8c73e5f56bda7437bdb28) uses Base64 to decode and then execute another payload (8f0e5f86046faed1d06bca7d3e48c0b8). This payload registers its own observer for new Telegram messages, which checks their content. If the message text matches regular expressions received by the Trojan from the C2 server, the message is deleted from the client. This module also attempts to delete Telegram notifications about new sessions.

    Filtering messages based on content

    Additionally, the malware tries to initiate a conversation with a bot that was no longer there at the time of our research.

    Initiating communication with an unknown bot

    Instagram module

    This module (3f887477091e67c6aaca15bce622f485) starts by requesting the device’s advertising ID from Google Play services, which it then uses as the victim ID. After that, a malicious task runs once every 24 hours, sequentially scanning all XML files used by SharedPreferences until it finds the first file whose name begins with UserCookiePrefsFile_. This file contains the cookies for active Instagram sessions, and intercepting these sessions allows the attackers to take over the victim’s account. The task also collects all files ending in batch from the analytics directory inside data.

    The malware reading the internal files

    These files, along with information about the infected device, are encoded in Base64 and sent to the C2 server.

    Browser module

    This module (98ece45e75f93c5089411972f9655b97) is loaded into the browsers with the following package names:

    • com.android.chrome
    • org.mozilla.firefox
    • com.microsoft.emmx
    • com.microsoft.emmx.canary
    • com.heytap.browser
    • com.opera.browser
    • com.sec.android.app.sbrowser
    • com.chrome.beta

    First, it establishes a connection with the C2 server over TCP sockets. Then, using the RSA algorithm, it encrypts an IV and key concatenation for AES-128 in CBC mode. The Trojan uses AES to encrypt the information about the infected device and then combines it with the key and IV into a single large buffer, which it sends to the TCP socket.

    Code snippet for C2 communication

    The C2 server responds with a buffer encrypted with the same parameters as the request it received from the infected device. The response contains a task to periodically substitute links opened in the browser. An example of this task is shown below.

    The link replacement works as follows. The module first checks the version and name of the browser that it is running in to register hooks for the methods that the browser uses for opening links.

    Launching browser-specific functionality

    We noted earlier that in the initial stages, the Trojan downloaded an auxiliary module that implements its functionality to intercept arbitrary methods. The browser module utilizes this to interfere with the process of opening pages in various browsers.

    Using the auxiliary module

    In addition, the malware uses reflection to replace the Instrumentation class instance for the app. The execStartActivity method, which launches app activities, is replaced in the proxy class.

    Malicious call in the Instrumentation proxy class

    In Android, application activities are launched by broadcasting an intent with a specific action. If the application has an activity with an intent filter that declares the ability to handle the action, Android will launch it. When an application opens a link in a browser, it creates and sends an Intent instance with the action android.intent.action.VIEW, including the URI to be opened. Triada substitutes the URI in the received Intent instance.

    Replacing the link in the Intent instance

    In the samples we analyzed, the C2 server sent links to advertising resources. However, we believe that the malware creators could also use this functionality for, say, phishing.

    WhatsApp modules

    For WhatsApp, the Trojan’s C2 server would provide two modules. One of these (d5bc1298e436424086cb52508fb104b1) runs a malicious task within the WhatsApp client’s context every five minutes. This task reads various keys essential for the client’s operation, as well as data about the active session.

    The Trojan reading WhatsApp login credentials

    This data, along with information about the victim’s device, is forwarded to the C2 server, giving the attackers complete access to the victim’s WhatsApp account.

    The other module (dc731e55a552caed84d04627e96906d5) starts by intercepting WhatsApp client functions that send and receive messages. The threat actor employed an interesting technique to work around class name obfuscation in WhatsApp code. The module’s code contains the names of the class and method being intercepted, specific to different WhatsApp versions. This likely required the attackers to manually analyze how each version worked. It is worth noting too that if the module’s code lacks the class names for the specific client version, the malware can request an interception configuration from the attackers’ C2 server.

    If the interception is successful, the module continues its operation by sending data about the infected device to the C2 server and receiving a TCP socket IP address in response. Commands are then transmitted through this socket, allowing the malware to perform the following actions:

    • Send arbitrary WhatsApp messages.
    • Delete sent messages on the device to cover its tracks.
    • Close the connection.

    Snippet of the command handler

    LINE module

    This module (1d582e2517905b853ec9ebfe77759d15) runs inside the LINE messaging app. First, the malware gathers information about the infected device and sends it to the C2 server. Subsequently, every 30 seconds, it collects internal app data, specifically the PROFILE_AUTH_KEY and PROFILE_MID values from the settings table in the naver_line database. The malicious module also obtains the UserAgent string and additional information to mimic HTTP requests as if they were coming from the messaging client itself. Additionally, the malware decrypts the user’s phone number and region from the naver_line database and uses reflection to obtain the application’s access token, which allows it to take over the victim’s account.

    Obtaining an access token

    The module sends the data it collects to the C2 server.

    Collecting and sending data

    Skype module

    This module (b87706f7fcb21f3a4dfdd2865b2fa733) runs a malicious task every two minutes that attempts to send information about the infected device to the C2. Once the C2 accepts the request, the task stops, and the Trojan begins reading internal Skype files every hour. Initially, the module tries to extract a token that allows access to the Skype account from the React Native framework keychain.

    Triada extracting a token from the keychain

    Failing to obtain the token through this method, the malware then tries to locate it within WebView cookies.

    Extracting a token from the cookies

    This token is then sent to the Trojan’s C2 server, thus compromising the victim’s account.

    The versions of Triada we have seen contain no payloads for Microsoft Teams or Skype for Business. However, we believe that after Microsoft sunsets Skype, the attackers might add new malicious modules for these apps.

    TikTok module

    This module (993eb2f8bf8b5c01b30e3044c3bc10a3) sends information about the infected device to the attackers’ server once a day. Additionally, the malware collects a variety of data about the victim’s account. For example, it reads cached TikTok cookies from an internal directory, which might have been used by WebView within the app. The attackers are interested in the msToken in these cookies, as it is necessary for interacting with the TikTok API. The module also extracts other information from the TikTok client, such as the user ID ( secUID), the UserAgent for API requests, and more. We believe that the attackers need this data to bypass TikTok API restrictions and simulate a real device when making API requests. Every five minutes, the malicious module attempts to send all data it collects to the attackers’ server.

    Stealing TikTok account data

    Facebook modules

    One of such modules (b187551675a234c3584db4aab2cc83a9) runs a malicious task every minute that compares the parent app package name against the following list:

    • com.facebook.lite
    • com.facebook.mlite
    • com.facebook.orca

    If the name matches one of the above, the malware steals the Facebook authentication cookies.

    Stealing Facebook credentials

    Another module (554f0de0bddf30589482315fe336ea72) sends data about the infected device to the C2. The server responds with a link to be opened in WebView, as well as JavaScript code to execute on the page. The malware can upload certain elements from this page to the C2 server, which potentially could be used by attackers to steal the victim’s account data.

    SMS modules

    These malicious components are injected into SMS apps. One of them (195e0f334beb34c471352179d422c42f) starts by registering its own proxy receiver for incoming SMS and MMS messages, as well as its own message observer. Following this, the malware retrieves rules from the C2 server, storing these in a separate database. The content of each received message is filtered on the basis of these rules.

    Checking message content

    The flexibility of these rules enables the malware to respond to specific SMS messages by extracting codes using regular expressions. We believe the Trojan creators primarily use this capability to sign victims up for paid subscriptions. Additionally, the module can send arbitrary SMS messages when instructed by the C2 server.

    Interestingly, the module contains unused code snippets that are valuable for analysis — they also function as message filtering rules. Each rule includes a string value that defines its type: an MD5 hash of certain data. The module code contains methods named matchWhatsapp and matchRegister that use the same rule type. Analysis of matchWhatsapp revealed that this malicious component previously could cover other modules’ tracks and delete SMS messages containing verification codes for logging in to the victim’s WhatsApp account. The use of the same rule type suggests that matchRegister is also employed by the malicious module to conceal its activity, possibly to secretly register accounts. This method is likely obsolete because the malware now supports receiving rules from the C2 server.

    Rule for intercepting WhatsApp verification SMS messages

    The second module (2ac5414f627f8df2e902fc34a73faf44) is likely an auxiliary component for the first one. The thing is, Android performs a check on the addressee when an SMS is being sent. If the message is being sent to a short code (premium SMS), the user will be prompted to confirm their intention to send. This measure aims to prevent financial losses for device owners encountering SMS Trojans. The SMSDispatcher class in the Android framework checks if the app has permission to send premium SMS messages. To do this, it calls the getPremiumSmsPermission method within the SmsUsageMonitor class, which stores premium SMS sending policies for each application using the SharedPreferences mechanism with the key premiumsmspolicy. The policies are integers that can take the following values:

    • 1: User confirmation is required before sending a premium SMS.
    • 2: The app is prohibited from sending premium SMS messages.
    • 3: Sending premium SMS messages is allowed, and user confirmation is not required.

    The malicious module sets the policy value for SMS messaging apps to 3, thereby clearing obstacles for the previous module. Notably, this is an undocumented Android feature, which further highlights the malware authors’ advanced skill level.

    Method for overriding premium SMS sending policies

    Reverse proxy

    As far as we know, this module (3dc21967e6fab9518275960933c90d04), integrates into the Google Play Services app. Immediately upon starting, it transmits information about the infected device to the C2 server. The server responds with an IP address and port, which the malware uses to listen for commands via a modified version of the EasySocket library. The commands are integers that can take three values:

    • 1: Establish a connection with an arbitrary TCP endpoint, assigning to it the ID transmitted in the command.
    • 2: Terminate the TCP connection with the specified ID.
    • 4: Send data over the TCP connection with the specified ID.

    Processing received data

    Thus, the main purpose of this module is to turn the infected device into a reverse proxy, essentially giving the attackers network access through the victim’s device.

    Call interception

    This module (a4f16015204db28f5654bb64775d75ad) is injected into the device’s phone app. It registers a malicious receiver that, upon receiving intents, can execute arbitrary JavaScript code using WebView.

    Executing arbitrary code via the malicious receiver

    The malware provides the JavaScript code with an interface to call certain Java functions. One of these functions takes the victim’s phone number and sends an intent that includes it.

    An intent with a phone number

    The command number is transmitted in the type field of the intent. However, the module lacks a handler for this number. We assume that it is implemented in a different payload that we were unable to obtain during our investigation.

    We also believe that this module is still under development. For example, similar to the browser module, it replaces the Instrumentation class to substitute the number opened using the android.intent.action.VIEW intent. However, the module lacks number substitution code.

    Instrumentation proxy class

    We strongly believe the number substitution functionality exists in another version of this module or will be added in the near future.

    Clipper

    Our data indicates that this module (04e485833e53aceb259198d1fcba7eaf) integrates into the Google Play app. Upon starting, it requests a comma-separated list of attackers’ cryptocurrency wallet addresses from the C2 server. If it cannot get the addresses, the Trojan uses hardcoded ones. After that, the module checks the clipboard every two seconds. If it finds a cryptocurrency wallet address, it replaces it with one controlled by the attackers. Additionally, the malware registers an event handler for clipboard changes, where it also checks and swaps the content.

    Clipboard hijacking

    Additional module

    In our previous report, we described the malicious modules downloaded by the initial Triada backdoor. We decided to check if the list of payloads had changed. Unfortunately, at the time of our research, the backdoor C2 server was not sending links to download additional modules. However, we noticed that the module entry points used a consistent special naming format – we will discuss this in more detail later. This allowed us to find another Triada malware sample in our telemetry. The module is named BrsCookie_1004 (952cc6accc50b75a08bb429fb838bff7), and is designed for stealing Instagram cookies from web browsers.

    Stealing cookies

    Campaign features

    Our analysis of this Trojan revealed several interesting details. For example, it shows similarities to earlier versions of Triada (308e35fb48d98d9e466e4dfd1ba6ee73): these implement the same logic for loading additional modules as the mmscore.jar backdoor deployed by the infected framework.

    Loading modules in older Triada versions

    Loading modules in mms-core.jar

    Furthermore, lines starting with PPP appear regularly in the module code.

    Creating log entries in an older Triada version

    Loading a module in binder.so in a newer Triada version

    Functions from the binder.so malicious library set system properties similar to those in previous Triada versions. These and other similarities lead us to believe that the sample we analyzed is a new version of Triada.

    While analyzing the modules, we encountered comments in Chinese, suggesting that the developers are Chinese native speakers. Additionally, one of the C2 servers used by the Triada modules, g.sxim[.]me, caught our attention. This domain was also used as a C2 server for a module of the Vo1d backdoor, suggesting a potential link to Triada.

    Distribution vector

    In all known infection cases, the device firmware had a build fingerprint whose last letter differed from officially published firmware fingerprints. Searching for similar fingerprints led us to discussion boards where users complained about counterfeit devices purchased from online stores. It is likely that a stage in the supply chain was compromised, with the vendors in online stores possibly being unaware that they were distributing fake devices infected with Triada.

    User complaining about a counterfeit device

    Translation:

    “The journey of a counterfeit device bought in [redacted]. Please keep this discussion in case it helps some poor fellow like me to restore the phone on their own. Previous version: 8Gb / 256Gb / 14.0.6.0 (TGPMIXN). Current version: 4Gb / 128Gb / 14.0.6.0 (TGPMIXM)”

    Victims

    According to KSN telemetry, our security solutions have detected over 4500 infected devices worldwide. The highest numbers of affected users were detected in Russia, the United Kingdom, the Netherlands, Germany, and Brazil. However, the actual number of infected devices could be much higher, given the unusual distribution method described in this article. The diagram below shows the TOP 10 countries with the highest numbers of users attacked between March 13 and April 15, 2025.

    TOP 10 countries with the highest numbers of users attacked by Triada, March 13 – April 15, 2025 (download)

    Separately, we decided to calculate the amount of cryptocurrency the Triada creators have stolen. To do this, we queried the Trojan’s C2 servers, receiving replacement wallet addresses in response. Findings from open-source research indicated that since June 13, 2024, the attackers had amassed more than $264,000 in various cryptocurrencies in wallets under their control. Below is a diagram showing the balance of several attacker-controlled wallets.

    A profitability chart for the threat actor’s TRON wallets (download)

    Conclusion

    The new version of the Triada Trojan is a multi-stage backdoor giving attackers unlimited control over a victim’s device. The modular architecture provides its authors with a range of malicious capabilities, including targeted delivery of new modules and mass infection of specific applications. If your phone has been infected with Triada, we recommend following these rules to minimize the consequences of malicious activity:

    • Install a clean firmware on your device.
    • Avoid using messaging apps, crypto wallets, or social media clients currently on your device before installing new firmware.
    • Use a reliable security solution to be promptly notified of similar threats on your device.

    Indicators of compromise

    Infected system frameworks

    f468a29f836d2bba7a2b1a638c5bebf0
    72cbbc58776ddc44abaa557325440bfb
    fb937b1b15fd56c9d8e5bb6b90e0e24a
    2ac4d8e1077dce6f4d2ba9875b987ca7
    7b8905af721158731d24d0d06e6cb27e
    9dd92503bd21d12ff0f2b9740fb6e529

    Infected native libraries

    89c3475be8dba92f4ee7de0d981603c1
    01dff60fbf8cdf98980150eb15617e41
    18fef4b6e229fc01c8b9921bb0353bb0
    21be50a028a505b1d23955abfd2bdb3e
    43adb868af3812b8f0c47e38fb93746a
    511443977de2d07c3ee0cee3edae8dc8
    716f0896b22c2fdcb0e3ee56b7c5212f
    83dbc4b95f9ae8a83811163b301fe8c7
    8892c6decebba3e26c57b20af7ad4cca
    a7127978fac175c9a14cd8d894192f78
    a9a106b9df360ec9d28f5dfaf4b1f0b5
    c30c309e175905ffcbd17adb55009240
    c4efe3733710d251cb041a916a46bc44
    e9029811df1dd8acacfe69450b033804
    e961cb0c7d317ace2ff6159efe30276a

    Modules

    Module C2 servers

    lnwxfq[.]qz94[.]com
    8.218.194[.]192
    g.sxim[.]me
    68u91[.]66foh90o[.]com
    jmll4[.]66foh90o[.]com
    w0g25[.]66foh90o[.]com
    tqq6g[.]66foh90o[.]com
    zqsvl[.]uhabq9[.]com
    hm1es[.]uhabq9[.]com
    0r23b[.]uhabq9[.]com
    vg1ne[.]uhabq9[.]com
    is5jg[.]3zweuj[.]com
    qrchq[.]vrhoeas[.]com
    xjl5a[.]unkdj[.]xyz
    lvqtcqd[.]pngkcal[.]com
    xc06a[.]0pk05[.]com
    120.79.89[.]98
    xcbm4[.]0pk05[.]com
    lptkw[.]s4xx6[.]com
    ad1x7[.]mea5ms[.]com
    v58pq[.]mpvflv[.]com
    bincdi[.]birxpk[.]com
    773i8h[.]k6zix6[.]com
    ya27fw[.]k6zix6[.]com

    CDN servers for delivery of malicious modules

    mp2y3[.]sm20j[.]xyz
    ompe2[.]7u6h8[.]xyz
    app-file.b-cdn[.]net

    GitHub configurations

    hxxps://raw.githubusercontent[.]com/adrdotocet/ott/main/api.json
    hxxps://raw.githubusercontent[.]com/adrdotocet2/ott/main/api.json
    hxxps://raw.githubusercontent[.]com/adrdotocet3/ott/main/api.json

    Triada system properties

    os.config.ppgl.ext.hws.cd
    os.config.ppgl.btcore.devicekey
    os.config.ppgl.version
    os.config.opp.build.model
    os.config.opp.build.status
    os.config.ppgl.status
    os.config.ppgl.status.rom
    os.config.ppgl.build.vresion
    os.config.hk.status
    os.config.ppgl.cd
    os.config.ppgl.dir
    os.config.ppgl.dexok
    os.config.ppgl.btcore.sericode
    os.config.verify.status
    os.config.alice.build.channel
    os.config.alice.build.time
    os.config.alice.service.status
    os.android.version.alice.sure

    MIL OSI Economics

  • MIL-OSI United Kingdom: New Chair of the Parole Board announced – Alexandra Marks CBE

    Source: United Kingdom – Government Statements

    News story

    New Chair of the Parole Board announced – Alexandra Marks CBE

    Alexandra Marks CBE has been announced as the new Chair of the Parole Board by the Secretary of State for Justice.

    The Secretary of State has announced today that Alexandra Marks CBE has been confirmed as the Chair of the Parole Board. 

    We are delighted that Alexandra will be commencing her role as Chair of the Parole Board from 18 July 2025. 

    We would like to take the opportunity to thank Caroline for her exemplary leadership over the last seven years.  

    Cecilia French, CEO of the Parole Board, said: “I am very much looking forward to working with Alexandra and would also like to extend my thanks to Caroline for her commitment, hard work and energy in her role as Chair of the Parole Board over the last 7 years. During this period, she has been instrumental in steering the Parole Board through a period of significant change and growth, resulting in a more transparent and improved parole system. We wish her the very best for the future.” 

    Notes to editors 

    Alexandra Marks CBE has been the Chair of RICS’ Regulatory Tribunal since 2023. A Recorder since 2002 and Deputy High Court Judge since 2010, she has also served as a First Tier Tribunal Judge of the General Regulatory Chamber since 2018. 

    Alexandra was previously a Commissioner at the Criminal Cases Review Commission (2013-2018) and a Judicial Appointments Commissioner (2012-2018). She was also previously Chair of Prisoners’ Education Trust (2012-2018).

    Updates to this page

    Published 25 April 2025

    MIL OSI United Kingdom

  • MIL-OSI United Kingdom: The appointment of Alexandra Marks CBE as Chair of the Parole Board

    Source: United Kingdom – Executive Government & Departments

    News story

    The appointment of Alexandra Marks CBE as Chair of the Parole Board

    The Lord Chancellor has approved the appointment of Alexandra Marks CBE as the Chair of the Parole Board.

    The Lord Chancellor has approved the appointment of Alexandra Marks CBE as the Chair of the Parole Board for a 5 year term from 18 July 2025.

    The Parole Board is an Executive Non-Departmental Public Body sponsored by the Ministry of Justice (MOJ). It works with its criminal justice partners to protect the public by risk assessing prisoners to decide whether they can be safely released into the community. It was established by the Criminal Justice Act 1967.

    Appointments and re-appointments to the Parole Board (with the exception of Judicial members) are regulated by the Commissioner for Public Appointments.

    Biography

    Alexandra Marks CBE has been the Chair of RICS’ Regulatory Tribunal since 2023. A Recorder since 2002 and Deputy High Court Judge since 2010, she has also served as a First Tier Tribunal Judge of the General Regulatory Chamber since 2018.

    Alexandra was previously a Commissioner at the Criminal Cases Review Commission (2013 to 2018) and a Judicial Appointments Commissioner (2012 to 2018). She was also previously Chair of Prisoners’ Education Trust (2012 to 2018).

    Updates to this page

    Published 25 April 2025

    MIL OSI United Kingdom

  • MIL-OSI Europe: OSCE enhances private sector and labour inspectors’ skills to detect hidden forms of trafficking

    Source: Organization for Security and Co-operation in Europe – OSCE

    Headline: OSCE enhances private sector and labour inspectors’ skills to detect hidden forms of trafficking

    Representatives from Tajikistan’s private sector and labor inspection authorities participate in a three-day training course aimed at identifying hidden forms of human trafficking within the private sector, Dushanbe, 23 April 2025. ( OSCE/Jamshed Haydarov) Photo details

    From 23 to 25 April 2025, the OSCE Programme Office in Dushanbe, in co-operation with the Inter-ministerial Commission on Combatting Trafficking in Human Beings, organized a three-day training course for 12 representatives (8 men and 4 women) from Tajikistan’s private sector and labour inspection authorities. Participants included representatives from hotels, private employment agencies, and labour inspectors from the Ministry of Labour, Migration and Employment of the Population.
    Held in Dushanbe, the training focused on enhancing participants’ ability to identify latent forms of human trafficking within the private sector, particularly in high-risk industries such as hospitality, tourism, and recruitment. The course also covered best practices for immediate victim referral and assistance.
    Participants gained a deeper understanding of how trafficking can manifest in less visible ways and how to detect internal trafficking cases that may otherwise go unnoticed. By strengthening early identification and response mechanisms, the training contributes to more effective protection and support for potential victims.

    MIL OSI Europe News

  • MIL-OSI Security: Man who had bomb-making guide on his phone jailed

    Source: United Kingdom London Metropolitan Police

    A man who admitted possessing extreme right-wing terrorism documents, including a bomb-making guide, has been jailed, after an investigation by the Met’s Counter Terrorism Command.

    As part of an investigation into indecent images of children being posted online, police raided the home address of Vitor Dias, 21 (04.03.2003) of Willesden, on 17 May 2022.

    Dias was not arrested but two mobile phones were seized and the contents were downloaded and analysed.

    A large amount of extreme right-wing terrorist material was recovered, including guides on how to make explosives, firearms and ammunition.

    Commander Dominic Murphy, head of the Met’s Counter Terrorism Command, said: “This case demonstrates that we will arrest and prosecute anyone accessing terrorist material.

    “I am grateful to the work of colleagues in the Wembley Online Child Sexual Abuse and Exploitation unit who uncovered Dias’s offending after his phones were seized.

    “This case was also a successful example of the use of risk management software installed on the devices of those convicted of sexual offences.

    “This case demonstrates that units from across the Met are committed to safeguarding vulnerable victims and specialist resources from counter terrorism will support the excellent work of officers and staff. Their excellent work allowed my officers to uncover the threat Dias posed.”

    Dias was arrested on 8 September 2022 and subsequently charged on 3 October 2023 with four counts of possessing a document containing information useful for a terrorist purposes, contrary to section 58(1)(b) of the Terrorism Act 2000.

    He pleaded guilty to these charges at the Old Bailey on 5 August 2024.

    PC Merima Salkovic of North West BCU JIGSAW team ran a parallel investigation in to Dias leading to him being charged with two counts of possessing an extreme pornographic image, one count of making an indecent photograph of a child, category B and one count of making an indecent photograph of a child category C.

    Dias appeared at Willesden Magistrates’ Court on 17 December 2024 and pleaded guilty to the first three charges. The making indecent images of a child, category C, will remain on file.

    He was sentenced at the Old Bailey on 24 April to a total of three years in jail. He was also made subject of a 10-year Sexual Harm Prevention Order.

    Dias was convicted on 31 March 2023 for the making of indecent images of children, and possession of prohibited images of children. He was placed on the Sex Offenders Register for five years and was managed by Wembley Jigsaw Unit.

    As part of his conviction he was also given a Sexual Harm Prevention Order lasting for five years, which meant he had various prohibitions placed upon him, including risk management software to be installed on his electronic devices.

    MIL Security OSI

  • MIL-OSI Russia: Digital Transformation of Management: All-Russian Conference Held at GUU

    Translation. Region: Russian Federal

    Source: State University of Management – Official website of the State –

    On April 24, the Institute of Information Systems of the State University of Management hosted the VII All-Russian scientific and practical conference “Digital Transformation of Management: Problems and Solutions”.

    Traditionally, the purpose of the conference is to exchange experience, information, and research results between scientists from leading universities, practicing specialists from IT companies, and start-up entrepreneurship, shaping the formation of “education-business-science” clusters.

    The organizers selected the best reports for participation, reflecting the modern scientific and practical interests of scientists from leading Russian universities in the field of developing digital solutions and control automation: State University of Management, Lomonosov Moscow State University, Moscow Aviation Institute, Financial University under the Government of the Russian Federation, Saratov State Technical University named after Yu.A. Gagarin, Crimean Federal University named after Vernadsky, Kazan Innovative University, etc.

    The event discussed issues of forming an individualized educational trajectory using a composition of educational technologies, integrating artificial intelligence into management processes, ensuring corporate information security, priorities and drivers of digitalization in agribusiness, using unmanned aerial vehicles and building platform solutions and hybrid DSS for managing processes in agriculture, developing a computer vision model for detecting documentary areas of interest, using mathematical modeling tools for analyzing mortgage lending, labor migration, etc.

    At the conference, Sergei Golovashov, Head of the Competence Center at Bell Integrator, also shared his experience in ensuring corporate information security.

    It is noteworthy that young scientists took an active part in this year’s conference: senior bachelors, master’s students and postgraduates of the IIS SUM.

    Participants of the conference “Digital Transformation of Management: Problems and Solutions” noted that holding such scientific events has great theoretical and practical significance for improving the processes of digitalization of management and solving new problems that arise as challenges to the development of modern society.

    Subscribe to the TG channel “Our GUU” Date of publication: 04/25/2025

    Please note: This information is raw content directly from the source of the information. It is exactly what the source states and does not reflect the position of MIL-OSI or its clients.

    MIL OSI Russia News

  • MIL-OSI United Kingdom: Toughest measures yet to protect children from knife content

    Source: United Kingdom – Executive Government & Departments

    News story

    Toughest measures yet to protect children from knife content

    Even tougher action to hold tech platforms to account for failing to protect children from harmful knife crime content online, the government has announced.

    Image: Getty Images

    As part of the Plan for Change, tougher sanctions will be brought in to combat the unacceptable content circulating online that advertises deadly and illegal knives and other offensive weapons to young people – or which glorifies or incites violence.  

    The government has already announced a significant fine of up to £10,000 for individual tech bosses whose platforms fail to remove this content within 48 hours following a police warning. Following significant consultation with the Coalition to Tackle Knife Crime, the government is going even further with an additional fine of up to £60,000 to be paid by the company. This means tech platforms and their executives could collectively face up to £70,000 in fines for every post relating to knife crime they fail to remove. 

    A greater range of online platforms will be liable under these new laws to also include online search engines as well as social media platforms and marketplaces, to capture all online providers which might currently be failing to remove content. 

    The move bolsters further measures set out yesterday by the Department for Science, Innovation and Technology, and Ofcom, to protect children from a broad spectrum of harmful online content including pornography, suicide and self-harm under the Online Safety Act.  The laws will be some of the most comprehensive online safety protections in the world and mean platforms must protect children from content including suicide, self-harm, and pornography by taking steps such as introducing age checks like photo ID matching or facial age estimation and filtering out harmful content from algorithms.   

    Crime and Policing Minister, Dame Diana Johnson said:  

    The kind of content that young people scroll through every day online is sickening and I will not accept any notion that restricting access to this harmful material is too difficult.

    Our children need more from us. That is why we are now going further than ever to hold to account the tech companies who are not doing enough to safeguard young people from content which incites violence, particularly in young boys.

    Curbing the impact of this kind of content will be key for our mission to halve knife crime, but more widely our Plan for Change across government to do more protect young people from damaging and dangerous content.

    As previously announced, the Home Office will introduce a new system to be carried out by a new policing unit backed by £1.75 million of funding to tackle the sale of knives online. This will operate out of the Met, but on a national scale. They will be responsible for issuing Content Removal Notices which inform the tech platform of illegal content, giving them a 48 hour window in which they must remove it.  

    Failure to comply will now result in a Civil Penalty Notice rather than taking the company to civil court, which include the respective fines for both executives and the wider company. This will mean sanctions can be inflicted much more quickly and is the same penalty that an employer may receive for employing an illegal worker to reflect the vital importance of removing harmful knife related content.     

    Patrick Green CEO of The Ben Kinsella Trust said:

    The portrayal of knife crime on social media has significantly hindered efforts to reduce it. Beyond merely normalising, glamorising, and desensitising young people to violence, it has often provided an illegal avenue for purchasing knives without adequate safeguards, such as proper age verification.

    Social media companies and their executives have repeatedly failed to address these issues. Therefore, I welcome today’s announcement from the government to take decisive action and hold these executives accountable.

    I also thank the government for listening to the Coalition to Tackle Knife Crime and for extending these sanctions to include social media companies, who have a responsibility to keep young people safe on their platforms.

    These sanctions are part of a range of measures being introduced by this government in its mission to halve knife crime in a decade. These include: 

    • banning zombie-style knives and ninja swords, with a nationwide surrender scheme launching in July 

    • introducing stronger 2-step verification for online retailers selling knives online and banning delivery of weapons to alternative addresses that don’t match the buyer 

    • requirement for online retailers to report any bulk or suspicious-looking purchases of knives to the police 

    • launching a consultation in spring on the introduction of a licensing scheme for retailers who wish to sell knives

    • increasing prison sentences for selling weapons to under 18s from 6 months to 2 years

    • introducing a new offence for possessing a weapon with intent for violence with a prison sentence of up to 4 years

    The sanctions for tech platforms will be introduced via an amendment to the Crime and Policing Bill which was tabled on 24 April for committee stage.

    Updates to this page

    Published 25 April 2025

    MIL OSI United Kingdom

  • MIL-OSI Security: Drug Supplier Sentenced to Federal Prison for Trafficking Methamphetamine

    Source: Office of United States Attorneys

    Hagåtña, Guam – SHAWN N. ANDERSON, United States Attorney for the Districts of Guam and the Northern Mariana Islands, announced that defendant Alejandro Manuel B. Gagarin, aka Alex, age 31, from Inarajan, Guam was sentenced on April 24, 2025, to serve 12 months and 1 day imprisonment.  He was charged in the U.S. District Court of Guam with Conspiracy to Distribute Fifty or More Grams of Methamphetamine, in violation of 21 U.S.C. §§ 841(a)(1) and 846. The Court also ordered five years of supervised release and a mandatory $100 special assessment fee.  In addition, defendants convicted of a federal drug offense may no longer qualify for certain federal benefits.

    Between March 2021 through April 2022, Alejandro Manuel B. Gagarin conspired with Timothy Jerome Concepcion, a person identified as I.M.C., Jacob Vance Manibusan, and other persons to distribute more than 50 grams of Methamphetamine Hydrochloride.   The drug distribution occurred at hotel rooms rented from a local resort hotel.  Gagarin and his co-defendant Manibusan rented out two hotel rooms.  Gagarin then greeted customers in the lobby of the hotel and escorted them to the hotel room for the drug transactions. After receiving the methamphetamine from Gagarin, the customers would stay in the hotel room and smoke methamphetamine with Concepcion. The customers would pay Gagarin for the drug, he would in turn return the proceeds from the sale of the methamphetamine to Concepcion.

    Co-conspirators:

    • Timothy Jerome Concepcion, age 26, was sentenced on February 7, 2024, to 120 months imprisonment and 5 years supervised release. He pled guilty for Conspiracy to Distribute Fifty or More Grams of Methamphetamine and Using and Carrying a Firearm During a Drug Trafficking Crime.

    • Jacob Vance Manibusan aka Kadi, age 36, was sentenced on April 3, 2024, to 70 months imprisonment and 4 years supervised release. He pled guilty for Conspiracy to Distribute Five or More Grams of Methamphetamine.

    “Minor participants in federal drug crimes will not walk away without penalties,” stated United States Attorney Anderson.  “Considering the effects of methamphetamine on our communities, those with any role in drug trafficking are potential targets for prosecution.  The public rightly demands accountability for this unlawful conduct.”

    “The sentencing of Mr. Gagarin is a testament to HSI’s zero tolerance for those who engage in drug trafficking in Guam,” said Homeland Security Investigations Hawaii Special Agent in Charge Lucy Cabral-DeArmas. “HSI will aggressively pursue those, like Gagarin, who facilitate the infiltration of harmful substances into our communities.”

    This investigation was conducted by Homeland Security Investigations and prosecuted by Rosetta L. San Nicolas, Assistant United States Attorney in the District of Guam.

    MIL Security OSI

  • MIL-OSI Security: Guam Drug Trafficker Sentenced to 120 Months in Federal Prison

    Source: Office of United States Attorneys

    Hagåtña, Guam – SHAWN N. ANDERSON, United States Attorney for the Districts of Guam and the Northern Mariana Islands, announced that defendant Lorina Ann Fejeran, aka Lori Leon Guerrero, age 55, from Dededo, Guam was sentenced to 120 months imprisonment.  She was convicted in the U.S. District Court of Guam for Conspiracy to Distribute Fifty or more Grams of Methamphetamine, in violation of 21 U.S.C. §§ 846 and 841(a)(1), and Engaging in Monetary Transactions with Proceeds of Specified Unlawful Activity, in violation of 18 U.S.C. § 1956(1)(1)(B)(i). The Court ordered that Fejeran forfeit $1,636.00 and pay a money judgment in the amount of $45,500.00.  The money judgment represented money she wired to her supplier to pay for drugs.  The Court also ordered three years of supervised release and a mandatory $200 special assessment fee.  In addition, defendants convicted of a federal drug offense may no longer qualify for certain federal benefits.

    On November 29, 2022, the United States Postal Inspection Service intercepted a suspicious package addressed to “Srgt. Vincent Fejeran.” The package contained 437 gross grams of methamphetamine hydrochloride with a purity of 98 percent.  On December 1, 2022, Fejeran and co-defendant Jesse Fergurgur Belen attempted to receive the drugs.  As law enforcement stopped Fejeran’s car, Jesse Fegurgur Belen grabbed the package and fled on foot.  He abandoned the package in a residential yard before being arrested.

    The investigation revealed that Fejeran communicated with her drug supplier using WhatsApp and received three prior drug packages containing methamphetamine.  Fejeran wired or had others wire over $45,000.00 to her supplier or his nominee using MoneyGram. At the time of her arrest, she possessed $1,636 in illegal proceeds from drug sales. Fejeran admitted that she recruited Jesse Fegurgur Belen to receive “dope” as well to “make some cash” in exchange for assisting her in picking up the package.

    Jesse Fergurgur Belen, was previously sentenced in this matter to 105 months in federal prison for Attempted Possession with Intent to Distribute Fifty or more Grams of Methamphetamine, in violation of 21 U.S.C. § 841(a)(1).  The Court also ordered five years of supervised release, forfeiture of $1,636, 50 hours of community service, and a mandatory $100.00 special assessment fee. 

    “This case demonstrates the substantial penalties a drug trafficker may face in federal court,” stated United States Attorney Anderson.  “Even when evidence is insufficient to charge an individual, we will still remove illicit drugs from the mail to stop the supply to Guam. No community should suffer from this criminal activity.”

    “The sentencing of Ms. Fejeran underscores HSI’s commitment to collaborating with our law enforcement partners to keep drugs out of Guam,” said HSI Special Agent in Charge Lucy Cabral-DeArmas. “We recognize the severe harm illegal narcotics inflicts on communities and spare no effort in ensuring that those who contribute to drug trafficking are held accountable for their actions.”

    “Dangerous controlled substances like methamphetamine put postal workers and our communities at risk. Postal inspectors will aggressively pursue anyone who uses the US Mail to transport and distribute deadly drugs,” said United States Postal Inspection Service (USPIS) San Francisco Division – Inspector in Charge Stephen Sherwood.  “We thank our federal and local law enforcement partners, including Guam Customs and Quarantine Agency, Guam Police Department, and the Guam National Guard Counterdrug Program for working with us to combat these crimes in the effort to make our communities a safer place to live and work.”

    This investigation was conducted by the Homeland Security Investigations and United States Postal Inspection Service.  

    Assistant United States Attorney Rosetta L. San Nicolas prosecuted the case in the District of Guam.

    MIL Security OSI

  • MIL-OSI Security: Honduran National Guilty of Illegal Re-Entry of Removed Alien, Faces Enhanced Penalty for Prior Felony Conviction

    Source: Office of United States Attorneys

    NEW ORLEANS, LOUISIANA – CESAR A. LOBO-RAMOS (“LOBO-RAMOS”), age 38, a native of Honduras, pled guilty on April 22, 2025, to illegal re-entry of a removed alien, in violation of Title 8 United States Code, Section 1326(a), announced Acting U.S. Attorney Michael M. Simpson.

    According to court documents, LOBO-RAMOS reentered the United States after being previously deported on April 10, 2018. LOBO-RAMOS came to the attention of Immigration and Customs Enforcement after he was arrested by the Kenner Police Department on November 2, 2023 for resisting arrest and obstruction of police. 

    LOBO-RAMOS faces a maximum term of imprisonment of 2 years, up to 1 year of supervised release, up to a $250,000 fine and a mandatory $100 special assessment fee.  He also faces a sentencing enhancement of 20 years because of a prior felony conviction for sexual battery in Jefferson Parish in 2010.

    Acting U.S. Attorney Simpson praised the work of the United States Immigration and Customs Enforcement agency and the Kenner Police Department in investigating this matter. Assistant United States Attorney Carter K.D. Guice, Jr. of the General Crimes Unit is in charge of the prosecution.

    MIL Security OSI

  • MIL-OSI Security: FBI Surges Resources to Nigeria to Combat Financially Motivated Sextortion

    Source: Federal Bureau of Investigation FBI Crime News

    The FBI conducted a first-of-its-kind global operation to address the dangerous rise in American suicides attributed to this crime.

    Today, the FBI is announcing a global operation to combat financially motivated sextortion schemes operating out of Nigeria. In coordination with multiple law enforcement partners, the FBI conducted Operation Artemis—a surge of resources and personnel to Nigeria to address the high rate of sextortion related suicides attributed to Nigerian perpetrators. As a result of Operation Artemis, FBI investigations led to the arrests of 22 Nigerian subjects connected to financially motivated sextortion schemes. Of those 22 subjects, approximately half were directly linked to victims who took their own lives. This operation marks a significant step in the fight against child exploitation and brings justice and accountability to international perpetrators hiding anonymously behind screens.

    “Operation Artemis exemplifies the FBI’s never-ending mission to protect our most vulnerable, and to pursue the heinous criminals harming our children — no matter where they hide,” said FBI Director Kash Patel. “This operation highlights the critical need for international cooperation to address this growing threat, and it’s a fight we can’t take on without our valued partners across the globe. We hope this message encourages parents and guardians to continue to educate their children about online safety and serves as a reminder of the FBI’s relentless pursuit of keeping our children safe.”

    This announcement comes as the FBI has observed a 30% increase in sextortion-related tips received to our National Threat Operations Center from October 2024 to March 2025 as compared to the previous year. According to the FBI’s Internet Crime Complaint Center or IC3, there were over 54,000 victims in 2024, up from 34,000 in 2023. Over the last two years there have been nearly $65 million dollars in financial losses due to this crime. This comes as the FBI began observing a significant increase over the last three years in financially motivated sextortion schemes targeting young males ages 14-17, resulting in more than 20 minor victims dying by suicide.

    Given the alarming rise and similarities of these cases, the FBI opened investigations across the country with the goal of bringing answers and closure to grieving American families. Information gathered by the FBI’s Child Exploitation Operational Unit (CEOU) allowed the FBI to work collaboratively with all 55 of our field offices to identify nearly 3,000 victims of financially motivated sextortion. It was during these investigative steps that the commonality of perpetrators residing in Nigeria began to grow and paint a larger, more international scope of this crime.

    As a result of Operation Artemis, a Nigerian man was extradited to the U.S. in January and charged with causing the death of a South Carolina teenager who took his own life after being extorted by the suspect posing as a woman. Additionally, two men were extradited from Nigeria to the United States last year to face charges related to the sextortion and death of a young man in Pennsylvania. These subjects will now be held accountable in the American justice system, with more subjects still awaiting extraditions in Nigeria.

    The subjects arrested in this operation engaged in sophisticated, financially motivated sextortion schemes by contacting victims via social media platforms and posing as peers or potential romantic interests. Once trust or rapport was established, often through conversation in chatrooms or direct messages, the suspects coerced their victims into taking and sharing compromising images of themselves. Offenders then threatened to release the compromising photos unless they received immediate payment — typically requested via gift cards, mobile payment services, wire transfers, or cryptocurrency. Regardless of a payment being received or not, the perpetrators would often continue to manipulate their victims, leaving them feeling ashamed, isolated, and responsible.

    Operation Artemis was spearheaded by multiple units at the FBI’s Criminal Investigative Division, including CEOU and the Crimes and Crimes Against Children Human Trafficking Intelligence Unit, and across the globe at the FBI Legal Attaché offices in Abuja and Lagos. The FBI’s Victim Outreach Support and Strategy Program of the Victim Services Division also played a key role assisting victims’ families throughout these various investigations. The following FBI field offices also provided resources directly on the ground in Nigeria as well as invaluable investigative support and assistance: FBI Atlanta, Charlotte, Columbia, Houston, Jackson, Milwaukee, Nashville, Newark, New Orleans, Philadelphia, Richmond, San Diego, and St. Louis. Additionally, our partners at the Department of Justice Child Exploitation Obscenities Section served a critical role in ensuring the perpetrators in these cases face charges. Working together, we were able to obtain arrests, gather comprehensive forensic analyses, and conduct subject interviews on the ground in Nigeria.

    This operation would not have been possible without our partnerships with Homeland Security Investigations (HSI) and the National Center for Missing and Exploited Children (NCMEC), and their assistance in developing an ongoing, collaborative strategy to combat financially motivated sextortion. Multiple agencies also provided the FBI with assistance both with personnel and intelligence for this operation, leading to an even larger global perspective on the threat. FBI’s CEOU secured personnel assistance from our Five Eyes partners, including Canada’s Royal Canadian Mounted Police (RCMP) and the Australian Federal Police (AFP). The FBI also recognizes the valued partnership and assistance of Nigeria’s Economic and Financial Crimes Commission (EFCC).

    The FBI encourages parents to have ongoing conversations with their children and teenagers about online safety and to remind them they are not alone, and it is not their fault should they become a victim to these sophisticated and egregious schemes. If your child believes they are a victim of sextortion or financially motivated sextortion, please immediately report the activity to law enforcement and the FBI by calling 1-800-CALL-FBI (1-800-225-5324) or tips.fbi.gov. For immediate help or if you or a child is in danger, call 911. For 24/7 free, confidential mental health assistance, the 988 suicide and crisis hotline connects individuals in need of support with counselors across the United States.

    Take It Down is NCMEC’s free service that can help you remove or stop the online sharing of nude, partially nude, or sexually explicit images or videos taken of you when you were under 18 years old. You can remain anonymous while using the service and you won’t have to send your images or videos to anyone. Take It Down will work on public or unencrypted online platforms that have agreed to participate. Please visit takeitdown.ncmec.org.

    For more information on sextortion and financial sextortion, please visit the FBI’s resources on the threats at fbi.gov/sextortion and fbi.gov/financialsextortion.

    An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

    MIL Security OSI

  • MIL-OSI New Zealand: Further appeal – St Johns homicide

    Source: New Zealand Police (National News)

    Police are appealing for information about another vehicle in relation to the murder of Kyle Whorrall in St Johns over Easter Weekend.

    The vehicle, a silver 2004 Mitsubishi Grandis, registration GNG652, is believed to be connected to people Police would like to speak to.

    We believe they have crucial information to share with us about the events surrounding Kyle’s tragic death.

    The vehicle may have travelled to Northland in recent days.

    Detective Inspector Glenn Baldwin is asking those occupants to make contact with Police as soon as possible.

    “These people of interest could have the information we are looking for that will help us understand why Kyle was killed.

    “We know they are likely feeling apprehensive about speaking with us, but we are asking them come forward as soon as possible. It is time to do the right thing.

    “If you have any information about this vehicle or the people involved, we also want to hear from you.

    “We will be continuing to carry out our enquiries to locate this vehicle and the people with it as a matter of urgency.”

    If you have any information, please contact Police online or call 105 using the reference number 250419/9858, Operation Aberfeldy.

    Information can also be provided anonymously via Crime Stoppers on 0800 555 111.

    ENDS

    Issued by Police Media Centre

    MIL OSI New Zealand News

  • MIL-OSI Security: Slidell Man Indicted for Receiving Child Sexual Abuse Material

    Source: Office of United States Attorneys

    NEW ORLEANS – Acting U.S. Attorney Michael M. Simpson announced that JONATHAN SUAREZ (“SUAREZ”), age 29, a resident of Slidell, Louisiana, with was indicted today for receiving child sexual abuse material (CSAM), in violation of Title 18, United States Code, Section 2252(a)(2).

    According to the indictment, between on or about February 15, 2023, and April 9, 2025, SUAREZ received visual depictions of minors as young as approximately two (2) years old engaging in sexually explicit conduct, including a video he received on or about February 15, 2023.

    SUAREZ faces a mandatory minimum of five (5) years in prison and a maximum term of imprisonment of twenty (20) years. SUAREZ also faces at least five years, and up to a lifetime, of supervised release and up to a $250,000 fine. He may also be required to register as a sex offender.

    Acting U. S. Attorney Simpson reiterated that an indictment is merely a charge and that the guilt of the defendant must be proven beyond a reasonable doubt.

    This case was brought as part of Project Safe Childhood, a nationwide initiative to combat the growing epidemic of child sexual exploitation and abuse launched in May 2006 by the Department of Justice. Led by United States Attorneys’ Offices and the Criminal Division’s Child Exploitation and Obscenity Section (CEOS), Project Safe Childhood marshals federal, state and local resources to better locate, apprehend and prosecute individuals who exploit children via the Internet, as well as to identify and rescue victims. For more information about Project Safe Childhood, please visit www.projectsafechildhood.gov.

    Acting U.S. Attorney Simpson praised the work of the Federal Bureau of Investigation in investigating this matter.  Assistant United States Attorney Jordan Ginsberg, Chief of the Public Integrity Unit, is in charge of the prosecution.

    MIL Security OSI

  • MIL-OSI New Zealand: Update: Gang Conflict Warrant in Eastern District

    Source: New Zealand Police (National News)

    Please attribute to Detective Inspector Marty James, District Manager Criminal Investigations:

    Three people have been arrested in relation to the Gang Conflict Warrant currently in place in Eastern District, with powers being invoked eight times overnight.

    A 21-year-old man was arrested in Wairoa shortly before 11pm and is due to appear in Wairoa District Court on 2 May on drug and driving-related charges.

    A 21-year-old woman was also arrested for disorderly behaviour, while a 50-year-old man has been arrested for breaching bail.

    Police are pleased to have undertaken a range of activities overnight, with the aim of suppressing the illegal and dangerous activities of gang members.

    We will be deploying additional resources within the coming days to ensure we are utilising the warrant’s special powers to their full extent.

    Police will be highly visible in our communities, and we hope this provides reassurance to members of the public who have a right to go about their lives without fear and intimidation.

    We thank the public for their ongoing cooperation as we work hard to hold people committing this offending to account.

    ENDS

    Issued by the Police Media Centre

    MIL OSI New Zealand News