Category: Crime

  • MIL-OSI Security: Lake Station Man Sentenced to 360 Months in Prison

    Source: Office of United States Attorneys

    HAMMOND – Matthew A. Bugielski, 26 years old, of Lake Station, Indiana, was sentenced by United States District Court Judge Gretchen S. Lund after pleading guilty to Sexual Exploitation of Children, announced Acting United States Attorney Tina L. Nommay.

    Bugielski was sentenced to 360 months in prison, followed by 15 years of supervised release, and ordered to pay restitution to the victim of the offense.

    According to documents in the case, on or about June 19, 2023, Bugielski produced a sexually explicit image of a minor by employing, using, and inducing the minor to engage in sexually explicit conduct for the purpose of producing a visual depiction of such conduct. Further, Bugielski distributed that sexually explicit image to others over the internet. On occasions separate from June 19, 2023, Bugielski distributed other images and videos of child sexual abuse materials over the internet to others.

    This case was investigated by Homeland Security Investigations, with assistance from the Indiana Internet Crimes Against Children Task Force, the Indiana State Police, the Indiana State Police Digital Forensics Unit, the Roanoke Police Department, the Huntington County Sheriff’s Office, the Indianapolis Metropolitan Police Department, the Lake Station Police Department, and the New Chicago Police Department. The case was prosecuted by Assistant United States Attorney Emily Morgan.

    The case was brought as part of Project Safe Childhood. In 2006, the Department of Justice created Project Safe Childhood, a nationwide initiative designed to protect children from exploitation and abuse. Led by the U.S. Attorneys’ Offices and the DOJ’s Child Exploitation and Obscenity Section, Project Safe Childhood marshals federal, state, and local resources to locate, apprehend, and prosecute individuals who exploit children, as well as identify and rescue victims. For more information about Project Safe Childhood, please visit www.projectsafechildhood.gov.

    MIL Security OSI

  • MIL-OSI Security: 14 members of Bandidos motorcycle gang indicted for offenses including racketeering, assault and murder

    Source: Office of United States Attorneys

    HOUSTON – A 22-count indictment has been unsealed in the Southern District of Texas (SDTX) following an operation targeting multiple members of an allegedly violent, transnational motorcycle gang in the Houston metropolitan area.

    Current and former members of the Bandidos Outlaw Motorcycle Gang and Mascareros Motorcycle Club are charged for their alleged roles in a criminal enterprise engaged in violent criminal activity in and around Houston. The Mascareros is a support club of the Bandidos.

    Several of those are expected to make their initial appearance before U.S. Magistrate Judge Dena Hanovice Palermo at 2 p.m. Feb. 20.

    A federal grand jury returned an indictment Feb. 11 against 14 members and associates of the Bandidos outlaw motorcycle gang accusing them of various crimes, to include engaging in a conspiracy to commit racketeering activity and committing violent crimes in furtherance of the gang such as murder, attempted murder and assault. The indictment alleges the Bandidos are a self-identified “outlaw” motorcycle organization with a membership of approximately 1,500 to 2,000 in the United States and an additional 1,000 to 1,500 members internationally, including in Mexico.

    “Ensuring the safety of the public is SDTX’s paramount concern,” said U.S. Attorney Nicholas J. Ganjei. “The indictment here not only alleges shocking crimes of violence, but also alleges that these offenses were committed openly and wantonly, where any innocent member of the public could have been hurt or killed.” 

    “Today’s indictment is an important step in eliminating the Bandidos Outlaw Motorcycle Gang,” said Supervisory Official Antoinette T. Bacon of the Justice Department’s Criminal Division. “The Bandidos declare war on rivals—and they wage that war on our streets. Criminal behavior like this has no place in America, and the Department of Justice is fully committed to bringing peace back to our communities.”

    The indictment alleges that beginning in 2019, a violent turf war erupted between the Bandidos and B*EAST, a rival outlaw motorcycle gang in the Houston area. As part of this turf war, Bandidos national leadership allegedly put out a “smash on site” order to commit physical assaults, including murder, against B*EAST members. The turf war has resulted in gunfire exchanged on public roadways and in public establishments with innocent civilians present, according to the charges.

    John M. Pfeffer aka Big John, 32, Darvi Hinojosa aka 10 Round, 35, Bradley Rickenbacker aka Dolla Bill, 37, all of Katy; Michael H. Dunphy aka Money Mike, 57, Cleveland; Christopher Sanchez aka Monster, 40, Tomball; and Brandon K. Hantz aka Loco and Gun Drop, 33, Crosby; are charged with conspiracy to commit racketeering activity. Pfeffer, Dunphy, Hinojosa, Rickenbacker and Sanchez are further charged with multiple counts of assault in aid of racketeering. Pfeffer, Hinojosa, Rickenbacker and Sanchez are also charged with using a firearm during and in relation to a crime of violence, while Sanchez faces charges of being a felon in possession of a firearm. Hantz is also charged with arson.

    Pfeffer, Hinojosa, Rickenbacker and Sanchez each face up to life in prison if convicted, while Dunphy and Hantz each face up to 20 years on each of their counts upon conviction.

    The indictment also charges David Vargas aka Brake Check and First Time, 33, Houston, with murder in aid of racketeering; using a firearm during and in relation to a crime of violence resulting in death; attempted murder in aid of racketeering; and using, carrying, brandishing, discharging and possessing a firearm during and in relation to the attempted murders. All those charges relate to the killing of a rival and the shooting of two others. Murder in aid of racketeering carries a mandatory life sentence or the death penalty, if convicted.

    Further, Pfeffer and Rickenbacker are also charged with assault in aid of racketeering and using a firearm during and in relation to a crime of violence  along with Marky Baker aka Pinche Guero and Guero, 40, Ronnie McCabe aka Meathead, 56, and Jeremy Cox aka JD, 37, all of Houston; Roy Gomez aka Repo, 50, Richmond; and Marcel Lett, 56, Pearland. These charges are in relation to an alleged assault and robbery that resulted in the death of a rival. If convicted, they face up to life in prison.

    Hinojosa is also charged along with John Sblendorio aka Tech9, 54, Houston, with conspiracy to commit murder in aid of racketeering, attempted murder in aid of racketeering, assault in aid of racketeering and using a firearm during and in relation to a crime of violence in connection with the shooting of a rival gang member. Hinojosa is also charged with conspiracy to distribute cocaine and three counts of possession with intent to distribute cocaine. Sblendorio and Hinojosa each face up to life in prison, if convicted.

    In addition, Sean G. Christison, aka Skinman, 30, Katy, is charged with possession with intent to distribute cocaine and possession of a firearm in furtherance of a drug trafficking crime. He faces a maximum penalty of life imprisonment. 

    The FBI, Texas Board of Criminal Justice – Office of Inspector General, Texas Department of Public Safety and Montgomery County Sheriff’s Office conducted the Organized Crime Drug Enforcement Task Forces (OCDETF) investigation with the assistance of Harris County Sheriff’s Office; Houston and Pasadena Police Departments; Texas Alcoholic Beverage Commission; LaMarque and Katy Police Departments; U.S. Marshals Service; Bureau of Alcohol, Tobacco, Firearms and Explosives; and the Cypress-Fairbanks Independent School District Police Department. 

    OCDETF identifies, disrupts and dismantles the highest-level drug traffickers, money launderers, gangs and transnational criminal organizations that threaten the United States by using a prosecutor-led, intelligence-driven, multi-agency approach that leverages the strengths of federal, state and local law enforcement agencies against criminal networks. Additional information about the OCDETF Program can be found on the Department of Justice’s OCDETF webpage.

    This case is being prosecuted as part of the joint federal, state and local Project Safe Neighborhoods (PSN) Program, the centerpiece of the Department of Justice’s violent crime reduction efforts. PSN is an evidence-based program proven to be effective at reducing violent crime. Through PSN, a broad spectrum of stakeholders work together to identify the most pressing violent crime problems in the community and develop comprehensive solutions to address them. As part of this strategy, PSN focuses enforcement efforts on the most violent offenders and partners with locally based prevention and reentry programs for lasting reductions in crime.

    Assistant U.S. Attorneys Byron H. Black and Kelly Zenón-Matos of the Southern District of Texas are prosecuting the case in partnership with Trial Attorneys Grace H. Bowen and Christopher Taylor of the Department of Justice’s Criminal Division – Violent Crime and Racketeering Section.

    An indictment is a formal accusation of criminal conduct, not evidence. A defendant is presumed innocent unless convicted through due process of law.

    MIL Security OSI

  • MIL-OSI Security: Detroit Man Sentenced To Over Four Years in Federal Prison For Participating In Multi-State Pandemic Unemployment Insurance Fraud Scheme

    Source: Office of United States Attorneys

    DETROIT – A man from Detroit, Michigan was sentenced today for his role in a multi-state, million-dollar unemployment insurance fraud scheme aimed at defrauding the U.S. government and the states of Michigan, Pennsylvania, and Maryland, of funds earmarked for unemployment assistance during the COVID-19 pandemic, announced Acting United States Attorney Julie A. Beck.

    Joining in the announcement were Special Agent in Charge Cheyvoryea Gibson, Federal Bureau of Investigation, Special Agent in Charge Charles Miller, Internal Revenue Service-Criminal Investigation, and Megan Howell, Acting Special Agent in Charge, Chicago Region, U.S. Department of Labor Office of Inspector General.

    Tracey Dotson, 49, was sentenced to 51 months in prison and ordered to pay more than $900,000 in restitution in the sentence handed down by United States District Judge Matthew F. Leitman.

    According to court records, Dotson and a co-defendant conspired to, and did, defraud the federal government and the states of Michigan, Pennsylvania, and Maryland of roughly $1 million in funds intended to support individuals who had lost their jobs during the COVID-19 pandemic. The pair committed their crimes through the use of interstate wires and the unauthorized possession and use of social security numbers and other means of identification belonging to other individuals.

    Dotson pleaded guilty to wire fraud and conspiracy to commit wire fraud in April 2024. Dotson and his co-defendant, using stolen personal identification, filed hundreds of false unemployment claims with state unemployment insurance agencies in Michigan, Pennsylvania, and Maryland in the names of other individuals without their knowledge or consent.   The defendants then received hundreds of Bank of America prepaid debit cards in the names of those individuals loaded with roughly $1 million in Pandemic Unemployment Assistance funds at addresses in Michigan and Pennsylvania. Dotson, his co-defendant, and their accomplices then successfully unloaded more than $930,000 from the cards via cash withdrawals and purchases that included high-end jewelry, designer fashion accessories by Gucci and Louis Vuitton, drugs, at least one vehicle, and at least one firearm.

    “Taxpayer unemployment assistance funds diverted to the pockets of criminals during the pandemic resulted in fewer resources that were available for those genuinely in need at that challenging time,” said Acting U.S. Attorney Julie Beck. “Our office is steadfast in its commitment to bringing those to justice who used a global health crisis as a means to illegally line their own pockets at the expense of taxpayers. “

    “This sentence underscores the FBI’s commitment to investigating complex financial crimes,” said Cheyvoryea Gibson, Special Agent in Charge of the FBI in Michigan. “We will not tolerate the greed and selfish conduct demonstrated by those who chose to defraud the unemployment insurance system, especially when we faced an unprecedented global pandemic. The FBI and our federal partners remain steadfast in holding criminals accountable and protecting government assistance programs. The pandemic may be in our rearview mirrors, but our investigations continue to move forward in the name of justice.”

    “Individuals who commit such blatant unemployment insurance fraud and identity theft of this magnitude deserve to be punished to the fullest extent of the law,” said Charles Miller, Special Agent in Charge, Detroit Field Office, IRS Criminal Investigation.  “Tracey Dotson and his co-conspirator took advantage of a program intended to help those in need get through a devastating global pandemic, exposed personal identity information of many, and caused immeasurable hardship to innocent victims. IRS Criminal Investigation remains committed to the pursuit of pandemic fraud and identity theft, together with our partners at the U.S. Attorney’s Office, we will hold those who engage in similar conduct accountable.”

    “Tracey Dotson and his co-conspirator defrauded multiple state workforce agencies by using stolen identities to obtain unemployment insurance (UI) benefits. As a result, he stole vital taxpayer resources intended for unemployed American workers in dire need of UI benefits. Today’s sentencing affirms the Office of Inspector General’s commitment to work with our law enforcement partners to investigate and bring to justice those who exploit this critical benefit program,” said Megan Howell, Acting Special Agent-in-Charge, Great Lakes Region, U.S. Department of Labor, Office of Inspector General.

    This case was prosecuted by Assistant United States Attorneys Carl D. Gilmer-Hill and Jessica A. Nathan. The investigation was conducted jointly by the Federal Bureau of Investigation, Internal Revenue Service – Criminal Investigation, and Department of Labor, Office of Inspector General.

    MIL Security OSI

  • MIL-OSI Security: Financial TV News Analyst-Turned-Fugitive Agrees to Plead Guilty to Federal Charge for Conning Investors Out of Millions of Dollars

    Source: Office of United States Attorneys

    LOS ANGELES – A former San Gabriel Valley resident – who was a frequent guest on financial television news programs then became a fugitive from justice after being accused of scamming investors – has agreed to plead guilty to defrauding his victims out of at least $2.7 million, the Justice Department announced today.

    James Arthur McDonald Jr., 53, formerly of Arcadia, has agreed to plead guilty to one count of securities fraud, a felony that carries a statutory maximum sentence of 20 years in federal prison.

    McDonald has been in federal custody since June 2024, when he was arrested in a residence in Port Orchard, Washington, after being a fugitive since November 2021, when he failed to appear before the United States Securities and Exchange Commission (SEC) to testify after allegations arose that he had defrauded investors. 

    According to his plea agreement, at McDonald’s Washington state hideout, law enforcement found, among other things, a fake Washington, D.C., driver’s license bearing McDonald’s photograph and the name “Brian Thomas.”

    McDonald was the CEO and chief investment officer of two companies headquartered in Los Angeles: Hercules Investments LLC and Index Strategy Advisors Inc. (ISA). He frequently appeared as an analyst on the CNBC financial television news network.

    In late 2020, McDonald lost tens of millions of dollars of Hercules client money after adopting a risky short position that effectively bet against the health of the United States economy in the aftermath of the U.S. presidential election. McDonald projected that the COVID-19 pandemic and the election would result in major selloffs that would cause the stock market to drop. When the market decline didn’t occur, Hercules clients lost between $30 million and $40 million. By December 2020, Hercules clients were complaining to company employees about the losses in their accounts, according to court documents.

    In early 2021, McDonald solicited millions of dollars’ worth of funds from investors in the form of a purported capital raise for Hercules but misrepresented how the funds would be used and failed to disclose the massive losses Hercules previously sustained. As part of the capital raise, McDonald obtained $675,000 in investment funds from one victim group on March 9, 2021. He misappropriated most of those funds in various ways, including spending $174,610 at a Porsche dealership and transferring $109,512 to the landlord of a home McDonald was renting in Arcadia.

    McDonald also defrauded clients of ISA, his other firm, using less than half of the approximately $3.6 million he raised for trading purposes. Instead, McDonald frequently commingled ISA client funds with funds from his personal bank account, which he used to purchase luxury cars and to pay rent on his home, personal credit card charges, and Hercules operating expenses and to make Ponzi-like payments to ISA clients — that is, paying some ISA clients using funds from other clients. 

    In total, McDonald caused losses of between approximately $2,745,892 and approximately $3,025,892, according to his plea agreement.

    The FBI and IRS Criminal Investigation are investigating this matter.

    In September 2022, the SEC filed a civil complaint charging McDonald and Hercules with violations of federal securities law. In April 2024, United States District Judge Percy Anderson found McDonald and Hercules liable and ordered that they pay several million dollars in disgorgement and civil penalties.

    Assistant United States Attorneys Alexander B. Schwab and Nisha Chandran of the Corporate and Securities Fraud Strike Force are prosecuting this case.

    MIL Security OSI

  • MIL-OSI New Zealand: NZCTU welcomes passage of wage theft bill

    Source: Council of Trade Unions – CTU

    The Crimes (Theft by Employer) Amendment Bill passing committee stage in the House is a win for workers, said NZCTU Te Kauae Kaimahi President Richard Wagstaff. The Bill, which amends the Crimes Act 1961 to clarify that not paying an employee their wages is theft, will now head to Third Reading.

    “We are thrilled that this Bill is making its way through the House and looks set to become law,” said Wagstaff.
     
    “Theft is theft. It’s past time that the legal system recognises that ‘theft by employer’ is every bit as serious and criminal as any other type of theft.
     
    “Currently, workers who suffer theft of their wages or minimum entitlements only have civil remedies available to them. Workers must spend their own money to argue their case in the court or the Authority, a cost that is too high for many. Too often cases of ‘theft by employer’ go unpunished and unresolved.
     
    “We acknowledge Camilla Belich and Ibrahim Omer for their leadership on this issue and thank all political parties who have supported it.
     
    “At a time when the workers’ rights in Aotearoa are under attack, we welcome this win for working people,” said Wagstaff.

    MIL OSI New Zealand News

  • MIL-OSI USA: Fourteen Members and Associates of Violent Transnational Motorcycle Gang Indicted on RICO and Murder Charges

    Source: US State of North Dakota

    An indictment was unsealed today in the Southern District of Texas charging 14 members and associates of the Bandidos Outlaw Motorcycle Gang for their alleged roles in a criminal enterprise engaged in murder, robbery, arson, narcotics distribution, and witness intimidation in and around Houston.

    The indictment accuses the defendants of various crimes, including engaging in a conspiracy to commit racketeering (RICO) activity and committing violent crimes in furtherance of the gang such as murder, attempted murder, and assault. The indictment alleges that the Bandidos are a self-identified “outlaw” motorcycle organization with a membership of approximately 1,500 to 2,000 in the United States and an additional 1,000 to 1,500 members internationally, including in Mexico.

    “Today’s indictment is an important step in eliminating the Bandidos Outlaw Motorcycle Gang,” said Supervisory Official Antoinette T. Bacon of the Justice Department’s Criminal Division. “The Bandidos declare war on rivals — and they wage that war on our streets. Criminal behavior like this has no place in America, and the Department of Justice is fully committed to bringing peace back to our communities.”

    “Ensuring the safety of the public is Southern District of Texas’ paramount concern,” said U.S. Attorney Nicholas J. Ganjei for the Southern District of Texas. “The indictment here not only alleges shocking crimes of violence, but also alleges that these offenses were committed openly and wantonly, where any innocent member of the public could have been hurt or killed.”

    According to court documents and statements in court, beginning in 2019, a violent turf war erupted between the Bandidos and B*EAST, a rival outlaw motorcycle gang in the Houston area. As part of this turf war, Bandidos national leadership allegedly put out a “smash on site” order to commit physical assaults, including murder, against B*EAST members. The turf war has resulted in gunfire exchanged on public roadways and in public establishments with innocent civilians present, according to the charges.

    John M. Pfeffer, also known as Big John, 32, Darvi Hinojosa, also known as 10 Round, 35, and Bradley Rickenbacker, also known as Dolla Bill, 37, all of Katy, Texas; Michael H. Dunphy, also known as Money Mike, 57, of Cleveland, Texas; Christopher Sanchez, also known as Monster, 40, of Tomball, Texas; and Brandon K. Hantz, also known as Loco and Gun Drop, 33, of Crosby, Texas, are charged with conspiracy to commit racketeering activity. Pfeffer, Dunphy, Hinojosa, Rickenbacker, and Sanchez are further charged with multiple counts of assault in aid of racketeering. Pfeffer, Hinojosa, Rickenbacker, and Sanchez are also charged with using a firearm during and in relation to a crime of violence, while Sanchez faces charges of being a felon in possession of a firearm. Hantz is also charged with arson.

    If convicted, Pfeffer, Hinojosa, Rickenbacker, and Sanchez each face a maximum penalty of life in prison, while Dunphy and Hantz each face a maximum penalty of 20 years in prison on each of their counts.

    The indictment also charges David Vargas, also known as Brake Check and First Time, 33, of Houston, with murder in aid of racketeering; using a firearm during and in relation to a crime of violence resulting in death; attempted murder in aid of racketeering; and using a firearm during and in relation to the attempted murders. All those charges relate to the killing of a rival and the shooting of two others. If convicted, Vargas faces a mandatory penalty of life in prison or the death penalty.

    Further, Marky Baker, also known as Pinche Guero and Guero, 40; Ronnie McCabe, also known as Meathead, 56; and Jeremy Cox, also known as JD, 37, all of Houston; Roy Gomez, also known as Repo, 50, of Richmond, Texas; and Marcel Lett, 56, of Pearland, Texas, are charged along with Pfeffer and Rickenbacker with assault in aid of racketeering and using a firearm during and in relation to a crime of violence. These charges are in relation to an alleged assault and robbery that resulted in the death of a rival. If convicted, they each face a maximum penalty of life in prison.

    Hinojosa is also charged along with John Sblendorio, also known as Tech9, 54, of Houston, with conspiracy to commit murder in aid of racketeering, attempted murder in aid of racketeering, assault in aid of racketeering, and using a firearm during and in relation to a crime of violence in connection with the shooting of a rival gang member. Hinojosa is also charged with conspiracy to distribute cocaine and three counts of possession with intent to distribute cocaine. If convicted, Sblendorio and Hinojosa each face a maximum penalty of life in prison.

    In addition, Sean G. Christison, also known as Skinman, 30, of Katy, is charged with possession with intent to distribute cocaine and possession of a firearm in furtherance of a drug trafficking crime. He faces a maximum penalty of life in prison.

    For all defendants, a federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

    The FBI, Texas Board of Criminal Justice — Office of Inspector General, Texas Department of Public Safety, and Montgomery County Sheriff’s Office conducted the investigation, with assistance from the Harris County Sheriff’s Office; Houston and Pasadena Police Departments; Texas Alcoholic Beverage Commission; LaMarque and Katy Police Departments; U.S. Marshals Service; Bureau of Alcohol, Tobacco, Firearms and Explosives; and Cypress-Fairbanks Independent School District Police Department.

    Trial Attorneys Grace H. Bowen and Christopher Taylor of the Criminal Division’s Violent Crime and Racketeering Section and Assistant U.S. Attorneys Byron H. Black and Kelly Zenón-Matos for the Southern District of Texas are prosecuting the case.

    This investigation was part of an Organized Crime Drug Enforcement Task Forces (OCDETF) operation. OCDETF identifies, disrupts and dismantles the highest-level drug traffickers, money launderers, gangs and transnational criminal organizations that threaten the United States by using a prosecutor-led, intelligence-driven, multi-agency approach that leverages the strengths of federal, state and local law enforcement agencies against criminal networks. Additional information about the OCDETF Program can be found on the Justice Department’s OCDETF webpage.

    This case is being prosecuted as part of the joint federal, state and local Project Safe Neighborhoods (PSN) Program, the centerpiece of the Justice Department’s violent crime reduction efforts. PSN is an evidence-based program proven to be effective at reducing violent crime. Through PSN, a broad spectrum of stakeholders work together to identify the most pressing violent crime problems in the community and develop comprehensive solutions to address them. As part of this strategy, PSN focuses enforcement efforts on the most violent offenders and partners with locally based prevention and reentry programs for lasting reductions in crime. For more information about PSN, please visit www.justice.gov/psn.

    An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

    MIL OSI USA News

  • MIL-OSI USA: #StopRansomware: Ghost (Cring) Ransomware

    News In Brief – Source: US Computer Emergency Readiness Team

    Summary

    Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.

    The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) are releasing this joint advisory to disseminate known Ghost (Cring)—(“Ghost”)—ransomware IOCs and TTPs identified through FBI investigation as recently as January 2025.

    Beginning early 2021, Ghost actors began attacking victims whose internet facing services ran outdated versions of software and firmware. This indiscriminate targeting of networks containing vulnerabilities has led to the compromise of organizations across more than 70 countries, including organizations in China. Ghost actors, located in China, conduct these widespread attacks for financial gain. Affected victims include critical infrastructure, schools and universities, healthcare, government networks, religious institutions, technology and manufacturing companies, and numerous small- and medium-sized businesses.

    Ghost actors rotate their ransomware executable payloads, switch file extensions for encrypted files, modify ransom note text, and use numerous ransom email addresses, which has led to variable attribution of this group over time. Names associated with this group include Ghost, Cring, Crypt3r, Phantom, Strike, Hello, Wickrme, HsHarada, and Rapture. Samples of ransomware files Ghost used during attacks are: Cring.exe, Ghost.exe, ElysiumO.exe, and Locker.exe.

    Ghost actors use publicly available code to exploit Common Vulnerabilities and Exposures (CVEs) and gain access to internet facing servers. Ghost actors exploit well known vulnerabilities and target networks where available patches have not been applied.

    The FBI, CISA, and MS-ISAC encourage organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of Ghost ransomware incidents.

    Download the PDF version of this report:

    For a downloadable copy of IOCs, see:

    Technical Details

    Note: This advisory uses the MITRE ATT&CK® Matrix for Enterprise framework, version 16.1. See the MITRE ATT&CK Tactics and Techniques section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.

    Initial Access

    The FBI has observed Ghost actors obtaining initial access to networks by exploiting public facing applications that are associated with multiple CVEs [T1190]. Their methodology includes leveraging vulnerabilities in Fortinet FortiOS appliances (CVE-2018-13379), servers running Adobe ColdFusion (CVE-2010-2861 and CVE-2009-3960), Microsoft SharePoint (CVE-2019-0604), and Microsoft Exchange (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207— commonly referred to as the ProxyShell attack chain).

    Execution

    Ghost actors have been observed uploading a web shell [T1505.003] to a compromised server and leveraging Windows Command Prompt [T1059.003] and/or PowerShell [T1059.001] to download and execute Cobalt Strike Beacon malware [T1105] that is then implanted on victim systems. Despite Ghost actors’ malicious implementation, Cobalt Strike is a commercially available adversary simulation tool often used for the purposes of testing an organization’s security controls.

    Persistence

    Persistence is not a major focus for Ghost actors, as they typically only spend a few days on victim networks. In multiple instances, they have been observed proceeding from initial compromise to the deployment of ransomware within the same day. However, Ghost actors sporadically create new local [T1136.001] and domain accounts [T1136.002] and change passwords for existing accounts [T1098]. In 2024, Ghost actors were observed deploying web shells [T1505.003] on victim web servers.

    Privilege Escalation

    Ghost actors often rely on built in Cobalt Strike functions to steal process tokens running under the SYSTEM user context to impersonate the SYSTEM user, often for the purpose of running Beacon a second time with elevated privileges [T1134.001].

    Ghost actors have been observed using multiple open-source tools in an attempt at privilege escalation through exploitation [T1068] such as “SharpZeroLogon,” “SharpGPPPass,” “BadPotato,” and “GodPotato.” These privilege escalation tools would not generally be used by individuals with legitimate access and credentials. 

    See Table 1 for a descriptive listing of tools.

    Credential Access

    Ghost actors use the built in Cobalt Strike function “hashdump” or Mimikatz [T1003] to collect passwords and/or password hashes to aid them with unauthorized logins and privilege escalation or to pivot to other victim devices.

    Defense Evasion

    Ghost actors used their access through Cobalt Strike to display a list of running processes [T1057] to determine which antivirus software [T1518.001] is running so that it can be disabled [T1562.001]. Ghost frequently runs a command to disable Windows Defender on network connected devices. Options used in this command are: Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIntrusionPreventionSystem 1 -DisableBehaviorMonitoring 1 -DisableScriptScanning 1 -DisableIOAVProtection 1 -EnableControlledFolderAccess Disabled -MAPSReporting Disabled -SubmitSamplesConsent NeverSend.

    Discovery

    Ghost actors have been observed using other built-in Cobalt Strike commands for domain account discovery [T1087.002], open-source tools such as “SharpShares” for network share discovery [T1135], and “Ladon 911” and “SharpNBTScan” for remote systems discovery [T1018]. Network administrators would be unlikely to use these tools for network share or remote systems discovery.

    Lateral Movement

    Ghost actors used elevated access and Windows Management Instrumentation Command-Line (WMIC) [T1047] to run PowerShell commands on additional systems on the victim network— often for the purpose of initiating additional Cobalt Strike Beacon infections. The associated encoded string is a base 64 PowerShell command that always begins with: powershell -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIA… [T1132.001][T1564.003].

    This string decodes to “$s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(“” and is involved with the execution of Cobalt Strike in memory on the target machine.

    In cases where lateral movement attempts are unsuccessful, Ghost actors have been observed abandoning an attack on a victim.

    Exfiltration

    Ghost ransom notes often claim exfiltrated data will be sold if a ransom is not paid. However, Ghost actors do not frequently exfiltrate a significant amount of information or files, such as intellectual property or personally identifiable information (PII), that would cause significant harm to victims if leaked. The FBI has observed limited downloading of data to Cobalt Strike Team Servers [T1041]. Victims and other trusted third parties have reported limited uses of Mega.nz [T1567.002] and installed web shells for similar limited data exfiltration. Note: The typical data exfiltration is less than hundreds of gigabytes of data.

    Command and Control

    Ghost actors rely heavily on Cobalt Strike Beacon malware and Cobalt Strike Team Servers for command and control (C2) operations, which function using hypertext transfer protocol (HTTP) and hypertext transfer protocol secure (HTTPS) [T1071.001]. Ghost rarely registers domains associated with their C2 servers. Instead, connections made to a uniform resource identifier (URI) of a C2 server, for the purpose of downloading and executing Beacon malware, directly reference the C2 server’s IP address. For example, http://xxx.xxx.xxx.xxx:80/Google.com where xxx.xxx.xxx.xxx represents the C2 server’s IP address.

    For email communication with victims, Ghost actors use legitimate email services that include traffic encryption features. [T1573] Some examples of emails services that Ghost actors have been observed using are Tutanota, Skiff, ProtonMail, Onionmail, and Mailfence.

    Note: Table 2 contains a list of Ghost ransom email addresses.

    Impact and Encryption

    Ghost actors use Cring.exe, Ghost.exe, ElysiumO.exe, and Locker.exe, which are all ransomware executables that share similar functionality. Ghost variants can be used to encrypt specific directories or the entire system’s storage [T1486]. The nature of executables’ operability is based on command line arguments used when executing the ransomware file. Various file extensions and system folders are excluded during the encryption process to avoid encrypting files that would render targeted devices inoperable.

    These ransomware payloads clear Windows Event Logs [T1070.001], disable the Volume Shadow Copy Service, and delete shadow copies to inhibit system recovery attempts [T1490]. Data encrypted with Ghost ransomware variants cannot be recovered without the decryption key. Ghost actors hold the encrypted data for ransom and typically demand anywhere from tens to hundreds of thousands of dollars in cryptocurrency in exchange for decryption software [T1486].

    The impact of Ghost ransomware activity varies widely on a victim-to-victim basis. Ghost actors tend to move to other targets when confronted with hardened systems, such as those where proper network segmentation prevents lateral moment to other devices.

    Indicators of Compromise (IOC)

    Table 1 lists several tools and applications Ghost actors have used for their operations. The use of these tools and applications on a network should be investigated further.

    Note: Authors of these tools generally state that they should not be used in illegal activity.

    Table 1: Tools Leveraged by Ghost Actors
    Name Description Source
    Cobalt Strike Cobalt Strike is penetration testing software. Ghost actors  use an unauthorized version of Cobalt Strike. N/A
    IOX Open-source proxy, used to establish a reverse proxy to a Ghost C2 server from an internal victim device. github[.]com/EddieIvan01/iox
    SharpShares.exe SharpShares.exe is used to enumerate accessible network shares in a domain. Ghost actors use this primarily for host discovery. github[.]com/mitchmoser/SharpShares
    SharpZeroLogon.exe SharpZeroLogon.exe attempts to exploit CVE-2020-1472 and is run against a target Domain Controller. github[.]com/leitosama/SharpZeroLogon
    SharpGPPPass.exe SharpGPPPass.exe attempts to exploit CVE-2014-1812 and targets XML files created through Group Policy Preferences that may contain passwords. N/A
    SpnDump.exe SpnDump.exe is used to list service principal name identifiers, which Ghost actors use for service and hostname enumeration. N/A
    NBT.exe A compiled version of SharpNBTScan, a NetBIOS scanner. Ghost actors use this tool for hostname and IP address enumeration. github[.]com/BronzeTicket/SharpNBTScan
    BadPotato.exe BadPotato.exe is an exploitation tool used for privilege escalation. github[.]com/BeichenDream/BadPotato
    God.exe God.exe is a compiled version of GodPotato and is used for privilege escalation. github[.]com/BeichenDream/GodPotato
    HFS (HTTP File Server) A portable web server program that Ghost actors use to host files for remote access and exfiltration. rejitto[.]com/hfs
    Ladon 911 A multifunctional scanning and exploitation tool, often used by Ghost actors with the MS17010 option to scan for SMB vulnerabilities associated with CVE-2017-0143 and CVE-2017-0144. github[.]com/k8gege/Ladon
    Web Shell A backdoor installed on a web server that allows for the execution of commands and facilitates persistent access. Slight variation of github[.]com/BeichenDream/Chunk-Proxy/blob/main/proxy.aspx
    Table 2: MD5 File Hashes Associated with Ghost Ransomware Activity
    File name MD5 File Hash
    Cring.exe c5d712f82d5d37bb284acd4468ab3533
    Ghost.exe

    34b3009590ec2d361f07cac320671410

    d9c019182d88290e5489cdf3b607f982

    ElysiumO.exe

    29e44e8994197bdb0c2be6fc5dfc15c2

    c9e35b5c1dc8856da25965b385a26ec4

    d1c5e7b8e937625891707f8b4b594314

    Locker.exe ef6a213f59f3fbee2894bd6734bbaed2
    iex.txt, pro.txt (IOX) ac58a214ce7deb3a578c10b97f93d9c3
    x86.log (IOX)

    c3b8f6d102393b4542e9f951c9435255

    0a5c4ad3ec240fbfd00bdc1d36bd54eb

    sp.txt (IOX) ff52fdf84448277b1bc121f592f753c5
    main.txt (IOX) a2fd181f57548c215ac6891d000ec6b9
    isx.txt (IOX) 625bd7275e1892eac50a22f8b4a6355d
    sock.txt (IOX) db38ef2e3d4d8cb785df48f458b35090

    Ransom Email Addresses

    Table 3 is a subset of ransom email addresses that have been included in Ghost ransom notes.

    Table 3: Ransom Email Addresses
    Email Addresses
    asauribe@tutanota.com ghostbackup@skiff.com rainbowforever@tutanota.com
    cringghost@skiff.com ghosts1337@skiff.com retryit1998@mailfence.com
    crptbackup@skiff.com ghosts1337@tuta.io retryit1998@tutamail.com
    d3crypt@onionmail.org ghostsbackup@skiff.com rsacrpthelp@skiff.com
    d3svc@tuta.io hsharada@skiff.com rsahelp@protonmail.com
    eternalnightmare@tutanota.com just4money@tutanota.com sdghost@onionmail.org
    evilcorp@skiff.com kellyreiff@tutanota.com shadowghost@skiff.com
    fileunlock@onionmail.org kev1npt@tuta.io shadowghosts@tutanota.com
    fortihooks@protonmail.com lockhelp1998@skiff.com summerkiller@mailfence.com
    genesis1337@tutanota.com r.heisler@skiff.com summerkiller@tutanota.com
    ghost1998@tutamail.com rainbowforever@skiff.com webroothooks@tutanota.com

    Ransom Notes

    Starting approximately in August 2024, Ghost actors began using TOX IDs in ransom notes as an alternative method for communicating with victims. For example: EFE31926F41889DBF6588F27A2EC3A2D7DEF7D2E9E0A1DEFD39B976A49C11F0E19E03998DBDA and E83CD54EAAB0F31040D855E1ED993E2AC92652FF8E8742D3901580339D135C6EBCD71002885B.

    MITRE ATT&CK Tactics and Techniques

    See Table 4 to Table 13 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, version 16.1, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.

    Table 4: Initial Access
    Technique Title  ID Use
    Exploit Public-Facing Application T1190 Ghost actors exploit multiple vulnerabilities in public-facing systems to gain initial access to servers.
    Table 5: Execution
    Technique Title  ID Use
    Windows Management Instrumentation T1047 Ghost actors abuse WMI to run PowerShell scripts on other devices, resulting in their infection with Cobalt Strike Beacon malware.
    PowerShell T1059.001 Ghost actors use PowerShell for various functions including to deploy Cobalt Strike.
    Windows Command Shell T1059.003 Ghost actors use the Windows Command Shell to download malicious content on to victim servers.
    Table 6: Persistence
    Technique Title  ID Use
    Account Manipulation T1098 Ghost actors change passwords for already established accounts.
    Local Account T1136.001 Ghost actors create new accounts or makes modifications to local accounts.
    Domain Account T1136.002 Ghost actors create new accounts or makes modifications to domain accounts.
    Web Shell T1505.003 Ghost actors upload web shells to victim servers to gain access and for persistence.
    Table 7: Privilege Escalation
    Technique Title  ID Use
    Exploitation for Privilege Escalation T1068 Ghost actors use a suite of open source tools in an attempt to gain elevated privileges through exploitation of vulnerabilities.
    Token Impersonation/Theft T1134.001 Ghost actors use Cobalt Strike to steal process tokens of processes running at a higher privilege.
    Table 8: Defense Evasion
    Technique Title  ID Use
    Application Layer Protocol: Web Protocols T1071.001 Ghost actors use HTTP and HTTPS protocols while conducting C2 operations. 
    Impair Defenses: Disable or Modify Tools T1562.001 Ghost actors disable antivirus products.
    Hidden Window T1564.003 Ghost actors use PowerShell to conceal malicious content within legitimate appearing command windows.
    Table 9: Credential Access
    Technique Title  ID Use
    OS Credential Dumping T1003 Ghost actors use Mimikatz and the Cobalt Strike “hashdump” command to collect passwords and password hashes.
    Table 10: Discovery
    Technique Title  ID Use
    Remote System Discovery T1018 Ghost actors use tools like Ladon 911 and ShapNBTScan for remote systems discovery.
    Process Discovery T1057 Ghost actors run a ps command to list running processes on an infected device.
    Domain Account Discovery T1087.002 Ghost actors run commands such as net group “Domain Admins” /domain to discover a list of domain administrator accounts.
    Network Share Discovery T1135 Ghost actors use various tools for network share discovery for the purpose of host enumeration.
    Software Discovery T1518 Ghost actors use their access to determine which antivirus software is running.
    Security Software Discovery T1518.001 Ghost actors run Cobalt Strike to enumerate running antivirus software.
    Table 11: Exfiltration
    Technique Title  ID Use
    Exfiltration Over C2 Channel T1041 Ghost actors use both web shells and Cobalt Strike to exfiltrate limited data.
    Exfiltration to Cloud Storage T1567.002 Ghost actors sometimes use legitimate cloud storage providers such as Mega.nz for malicious exfiltration operations.
    Table 12: Command and Control
    Technique Title  ID Use
    Web Protocols T1071.001 Ghost actors use Cobalt Strike Beacon malware and Cobalt Strike Team Servers which communicate over HTTP and HTTPS.
    Ingress Tool Transfer T1105 Ghost actors use Cobalt Strike Beacon malware to deliver ransomware payloads to victim servers.
    Standard Encoding T1132.001 Ghost actors use PowerShell commands to encode network traffic which reduces their likelihood of being detected during lateral movement.
    Encrypted Channel T1573 Ghost actors use encrypted email platforms to facilitate communications. 
    Table 13: Impact
    Technique Title  ID Use
    Data Encrypted for Impact T1486 Ghost actors use ransomware variants Cring.exe, Ghost.exe, ElysiumO.exe, and Locker.exe to encrypt victim files for ransom.
    Inhibit System Recovery T1490 Ghost actors delete volume shadow copies.

    Mitigations

    The FBI, CISA, and MS-ISAC recommend organizations reference their #StopRansomware Guide and implement the mitigations below to improve cybersecurity posture on the basis of the Ghost ransomware activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections.

    • Maintain regular system backups that are known-good and stored offline or are segmented from source systems [CPG 2.R]. Ghost ransomware victims whose backups were unaffected by the ransomware attack were often able to restore operations without needing to contact Ghost actors or pay a ransom.
    • Patch known vulnerabilities by applying timely security updates to operating systems, software, and firmware within a risk-informed timeframe [CPG 1.E].
    • Segment networks to restrict lateral movement from initial infected devices and other devices in the same organization [CPG 2.F].
    • Require Phishing-Resistant MFA for access to all privileged accounts and email services accounts.
    • Train users to recognize phishing attempts.
    • Monitor for unauthorized use of PowerShell. Ghost actors leverage PowerShell for malicious purposes, although it is often a helpful tool that is used by administrators and defenders to manage system resources. For more information, visit NSA and CISA’s joint guidance on PowerShell best practices.
      • Implement the principle of least privilege when granting permissions so that employees who require access to PowerShell are aligned with organizational business requirements.
    • Implement allowlisting for applications, scripts, and network traffic to prevent unauthorized execution and access [CPG 3.A].
    • Identify, alert on, and investigate abnormal network activity. Ransomware activity generates unusual network traffic across all phases of the attack chain. This includes running scans to discover other network connected devices, running commands to list, add, or alter administrator accounts, using PowerShell to download and execute remote programs, and running scripts not usually seen on a network. Organizations that can successfully identify and investigate this activity are better able to interrupt malicious activity before ransomware is executed [CPG 3.A].
      • Ghost actors run a significant number of commands, scripts, and programs that IT administrators would have no legitimate reason for running. Victims who have identified and responded to this unusual behavior have successfully prevented Ghost ransomware attacks.
    • Limit exposure of services by disabling unused ports such as, RDP 3398, FTP 21, and SMB 445, and restricting access to essential services through securely configured VPNs or firewalls.
    • Enhance email security by implementing advanced filtering, blocking malicious attachments, and enabling DMARC, DKIM, and SPF to prevent spoofing [CPG 2.M].

    Validate Security Controls

    In addition to applying mitigations, the FBI, CISA, and MS-ISAC recommend exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory.

    To get started:

    1. Select an ATT&CK technique described in this advisory (see Table 3 to Table 13).
    2. Align your security technologies against the technique.
    3. Test your technologies against the technique.
    4. Analyze your detection and prevention technologies’ performance.
    5. Repeat the process for all security technologies to obtain a set of comprehensive performance data.
    6. Tune your security program, including people, processes, and technologies, based on the data generated by this process.

    Reporting

    Your organization has no obligation to respond or provide information back to the FBI in response to this joint advisory. If, after reviewing the information provided, your organization decides to provide information to the FBI, reporting must be consistent with applicable state and federal laws.

    The FBI is interested in any information that can be shared, to include logs showing communication to and from foreign IP addresses, a sample ransom note, communications with threat actors, Bitcoin wallet information, and/or decryptor files.

    Additional details of interest include a targeted company point of contact, status and scope of infection, estimated loss, operational impact, date of infection, date detected, initial attack vector, and host and network-based indicators.

    The FBI, CISA, and MS-ISAC do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, the FBI and CISA urge you to promptly report ransomware incidents to FBI’s Internet Crime Complain Center (IC3), a local FBI Field Office, or CISA via the agency’s Incident Reporting System or its 24/7 Operations Center (report@cisa.gov) or by calling 1-844-Say-CISA (1-844-729-2472).

    Disclaimer

    The information in this report is being provided “as is” for informational purposes only. The FBI, CISA, and MS-ISAC do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by the FBI, CISA, and the MS-ISAC.

    Version History

    February 19, 2025: Initial version.

    MIL OSI USA News

  • MIL-OSI United Nations: Experts of the Committee on Economic, Social and Cultural Rights Welcome the Philippines’ Human Rights Commitments , Ask about Attacks on Human Rights Defenders, Indigenous Land Rights and Drug Use Policies

    Source: United Nations – Geneva

    The Committee on Economic, Social and Cultural Rights today concluded its review of the seventh periodic report of the Philippines, with Committee Experts welcoming the State’s human rights plans and commitments, and asking about attacks on human rights defenders, indigenous land rights and drug use policies.

    Asraf Ally Caunhye, Committee Expert and Leader of the Taskforce for the Philippines, in opening remarks, welcomed the State party’s human rights plans and commitments.

    Hesaid, however, that there had been 305 killings of human rights defenders in the Philippines since the last review. The Philippines ranked third globally for killings of human rights defenders. What measures were in place to ensure that those responsible for these crimes were prosecuted and sanctioned?

    Mr. Caunhye said indigenous peoples continued to face violations of their economic, social and cultural rights through the destruction of ancestral lands by extractive industries approved by the State. How would the State party protect the rights of indigenous peoples?

    Ludovic Hennebel, Committee Vice-Chair and Member of the Taskforce for the Philippines, asked about plans to decriminalise drugs for personal use and implement alternatives to imprisonment for drug users. What measures were in place to put an end to the “war on drugs” and to provide reparations to victims?

    Rosemarie G. Edillon, Undersecretary, Policy and Planning Group, National Economic and Development Authority of the Philippines and head of the delegation, introducing the report, said economic development, resilience building, and poverty reduction were central to the Government’s human rights agenda. From 2015 to 2023, the poverty rate dropped from 23.5 to 15.5 per cent of the population. The State was providing social protection to the most vulnerable and disadvantaged.

    There was no State policy to attack human rights defenders, the delegation said. There were remedies to address violations of the right to life, and freedom of association and assembly.

    On indigenous land rights, the delegation said the Indigenous Peoples’ Rights Act protected designated ancestral grounds and cultural heritage as “no-go zones” for development projects and emphasised free, prior and informed consent for all such projects. The Government was mapping and registering indigenous cultural assets to protect them.

    Regarding drug policies, the delegation said the Government was adopting a humanitarian approach to drug use and rehabilitation. Many drug users were treated in communities rather than in rehabilitation centres. Persons who participated in rehabilitation programmes were removed from criminal offender lists.

    In concluding remarks, Mr. Caunhye said discussions had brought to light issues that needed to be addressed to strengthen the implementation of economic, social and cultural rights in the Philippines. This information would inform the Committee’s concluding observations.

    Ms. Edillon, in her concluding remarks, said the State party was united in its goal of advancing economic, social and cultural rights. It would continue with actions that would create change and realise the economic, social and cultural rights of all citizens.

    In her concluding remarks, Laura-Maria Craciunean-Tatu, Committee Chair, thanked the delegation for participating in the dialogue and for providing comprehensive answers.

    The delegation of the Philippines was comprised of representatives from the National Security Council; the National Commission on Muslim Filipinos; the National Commission on Indigenous Peoples; the National Council on Disability Affairs; the Philippine National Police; the Department of Health; the Presidential Human Rights Committee Secretariat; the Dangerous Drugs Board; the Department of Justice; the Department of Health; the National Economic and Development Authority; the Philippine Drug Enforcement Agency; the Department of Education; the Department of Labour and Employment; the Department of Social Welfare and Development; the Department of Foreign Affairs; and the Permanent Mission of the Philippines to the United Nations Office at Geneva.

    The Committee’s seventy-seventh session is being held until 28 February 2025. All documents relating to the Committee’s work, including reports submitted by States parties, can be found on the session’s webpage . Webcasts of the meetings of the session can be found here , and meetings summaries can be found here .

    The Committee will next meet in public at 5:30 p.m. on Friday, 28 February, to close its seventy-seventh session.

    Report.

    The Committee has before it the seventh periodic report of the Philippines (E/C.12/PHL/7).

    Presentation of Report

    ROSEMARIE G. EDILLON, Undersecretary, Policy and Planning Group, National Economic and Development Authority of the Philippines and head of the delegation, said that through the Philippine Development Plan, which she led, the Government aimed to enable and empower every Philippine citizen to achieve a comfortable lifestyle and a secure future. The 1987 Constitution served as a firm foundation for the protection and promotion of economic, social and cultural rights. This foundation was reinforced by laws, policies and programmes that supported workers, promoted equitable economic participation, and provided social protection.

    The Government had put in place a plan for economic and social transformation that accelerated economic and social recovery from the COVID-19 pandemic toward a prosperous, inclusive and resilient society and achievement of the Sustainable Development Goals. Economic development, resilience building, and poverty reduction were central to the Government’s human rights agenda. From 2015 to 2023, the poverty rate dropped from 23.5 per cent to 15.5 per cent of the population. The State had been employing a multi-dimensional strategy to reduce poverty, expanding the economic pie, facilitating access by the poor to the drivers of economic growth, and providing social protection to the most vulnerable and disadvantaged. It had broad-based programmes like the conditional cash transfer programme, which benefitted over 4.4 million households. Beneficiaries were also covered by other social development programmes.

    The labour market had made a strong recovery after the pandemic. Employment figures were favourable, but there was much volatility and uncertainty in domestic and external fronts. For this reason, Congress had passed legislation that mandated a 10-year labour market development plan, which promoted a dynamic, efficient and inclusive labour market environment.

    Legislative measures had been enacted to institutionalise and expand social protection. In healthcare, the universal health care law ensured automatic PhilHealth coverage for all citizens. Family planning initiatives had prevented an estimated 774,000 unsafe abortions and 1,400 maternal deaths annually. The Mental Health Act expanded services to ensure informed consent in treatment, prohibit shackling, and provide culturally sensitive care. Ongoing efforts focused on breaking barriers such as attitudinal biases, inadequate modifications in public spaces, and employment challenges faced by persons with disabilities.

    Following disruptions caused by the pandemic, the Department of Education launched the basic education development plan 2030 and the learning recovery continuity plan to reverse learning loss. Enrolment had rebounded to 28.5 million learners in the 2022–2023 school year, surpassing pre-pandemic levels. The Government was also strengthening access to special education through policies like Department of Education order no. 44, which provided clear guidance for implementing programmes tailored for learners with disabilities.

    Free, prior and informed consent was a cornerstone of the State’s indigenous peoples’ rights. Although challenges persisted in its effective enforcement, the Philippines continued to collaborate with key stakeholders and communities to ensure that indigenous rights and sustainable development initiatives were effectively upheld. It continued to promote and safeguard the cultural integrity of indigenous peoples by conducting initiatives that highlighted traditional knowledge, practices and crafts.

    Building on these initiatives, the Government, in collaboration with civil society, had launched the fourth Philippine human rights plan, a comprehensive roadmap for protecting and promoting human rights. Its second thematic chapter focused on the country’s commitment to the Covenant, integrating human rights into national development efforts and prioritising marginalised communities. The plan was aligned with the Philippine Development Plan 2023-2028 and the Sustainable Development Goals.

    The Philippines reaffirmed its unwavering commitment to the Covenant and its principles. The dialogue with the Committee was an opportunity for introspection and growth. The Committee’s feedback and recommendations would serve as a valuable guide as the State strived to build a society where every citizen could progressively realise their economic, social and cultural rights; and no one was left behind.

    Questions by Committee Experts

    ASRAF ALLY CAUNHYE, Committee Expert and Country Rapporteur, asked about measures taken to incorporate the Covenant into the domestic legal system and to ensure the primacy of Covenant rights. In which court cases had Covenant rights been invoked? The Committee welcomed the State party’s human rights plans and commitments. What steps had been taken to ratify the Optional Protocol? 

    What system was in place to ensure that the judiciary was free from political influence? There had been 305 killings of human rights defenders since the last review. The Philippines ranked third globally for killings of human rights defenders. The existing legal institution was reportedly unable to prevent the red-tagging and killing of human rights defenders, including persons from indigenous communities and minority groups. What measures were in place to ensure that those responsible for these crimes were prosecuted and sanctioned?

    How did the Government prevent the abusive use of the Anti-Terrorism Act to restrict the activities of human rights defenders? What had barred the enactment of the bills on human rights defenders and the Human Rights Charter? How would the national human rights institution be enabled to function independently in accordance with the Paris Principles?

    Indigenous peoples continued to face violations of their economic, social and cultural rights through the destruction of ancestral lands. They were being deprived of their land management and food systems by extractive industries approved by the State. How would the State party protect the rights of indigenous peoples? What measures were in place to ensure that the National Commission on Indigenous Peoples expedited the issuance of land titles?

    What steps had been taken to ensure that free, prior and informed consent was obtained for extractive projects? What progress had been made in developing a national action plan on business and human rights? How did the State ensure that enterprises exercised due diligence when carrying out extractive activities and provided reparations for indigenous peoples affected by such activities?

    What measures were in place to implement the State’s commitments under the Paris Agreement? What resources had been allocated to addressing climate change? How was the State party addressing environmental pollution caused by extractive and logging activities?

    Despite a decline in poverty levels, 18 per cent of the population lived below the poverty line. Prevailing inequality in wealth remained high. The top 10 per cent of the population earned 45 per cent of gross national income, while the bottom 50 per cent earned only around four per cent. What measures would the State party take to eradicate poverty and support households living in poverty, rationalise fiscal policy, and introduce a progressive tax base that increased taxes for the wealthiest?

    Corruption was reportedly rampant in the police, the judiciary and other State institutions. What measures were in place to combat corruption? Were there cases in which politicians had been sentenced for corruption offences? Were there measures to allow citizens to access information held by Government bodies? Would the State party set up an anti-corruption commission or court?

    There was no anti-discrimination law in the Philippines. What steps had been taken to adopt an anti-discrimination bill? How would the State party protect vulnerable persons from discrimination? What measures had the State party taken to increase the representation of women in politics and decision-making positions, and in high income sectors of the economy? How was the State party providing childcare services to empower women to take part in the workforce?

    Responses by the Delegation 

    The delegation said the judiciary was independent and the Judicial Bar Council nominated judges independently. Justice programmes had been included in Government fiscal programmes to ensure that they were appropriately funded.

    The conditional cash transfer programme benefitted the poorest households with family members who were still in school. The poverty rate was at 15.5 per cent as of 2023. This rate had decreased thanks to State support programmes. The State party was investing in physical and digital connectivity for island provinces, which facilitated poor households’ access to growth centres.

    The Philippines was vulnerable to natural disasters. The Government was investing in disaster risk reduction and mitigation. Concerning the Paris Agreement, the State’s goals were to reduce emissions by 75 per cent, reduce dependence on fossil fuels, and increase the use of renewable energy. The Electric Vehicle Industry Development Act reduced tariffs on electric vehicles to encourage their import and use.

    The State party had specific laws on anti-discrimination in different fields. It did not have a bill on sexual orientation and gender identity, but had issued an executive order that concerned discrimination on the basis of gender preferences.

    The State party’s justice system, including the Supreme Court, and its national human rights institution, the Commission on Human Rights, effectively addressed complaints of human rights violations. There was thus no need to ratify the Optional Protocol.

    There were many non-governmental organizations in the Philippines that had expressed opposition to the current bill on human rights defenders. The State party had engaged with civil society organizations on the revision of the bill. The bill called for human rights defenders to not advocate for the violent overthrow of the Government.

    The State party was supporting the participation of women in the labour force. It had advocated for policies and legislation that allowed for nighttime work for women, safe spaces in workplaces, lengthened maternity and paternity leave and telework, and was conducting studies on inclusive work arrangements for women, youth and persons with disabilities.

    The Philippines’ Anti-Terrorism Act supported the country’s response to terrorism and safeguarded the rights of those accused of the crime. The State had issued guidelines on detentions and surveillance that ensured that persons’ rights were not violated. The Philippines’ rank in the Global Terrorism Indexhad fallen thanks to implementation of the Act. Investigations had been launched into all claims of misuse, and arrest warrants had been issued for officers who had misused the law. Enforcement of the Act was carried out with the highest level of responsibility. The State party ensured that its actions adhered to due process and the rule of law.

    The Philippines was a State party to the United Nations Convention against Corruption and had implement a national corruption prevention programme. Recently, it had hosted a regional conference on open governance and enacted a revision to the Government Procurement Act, which closed loopholes. An electronic procurement service had been launched to increase transparency. Many Government processes had been digitised, lessening opportunities for corruption.

    The Indigenous Peoples’ Rights Act protected designated ancestral grounds and cultural heritage as “no-go zones” for development projects and emphasised free, prior and informed consent for all such projects. The Government was mapping and registering indigenous cultural assets to protect them.

    The State had an indirect taxation system, as many families relied on overseas remittances for their income, which were not being taxed. The tax system punished undesirable behaviours such as the consumption of alcohol and cigarettes. Revenues from these taxes were being allocated to the health sector.

    Follow-Up Questions by Committee Experts 

    Committee Experts asked follow-up questions on measures to ensure that internally displaced persons had access to adequate food, basic housing, healthcare, education and social protection services; the status of the bill on the protection of internally displaced persons; measures other than the tax system to reduce disparities in wealth and income; steps to ensure gender parity in Government bodies; whether the State party had an implementation mechanism for recommendations issued to it by international bodies; how the State party linked climate adaptation policies with the land registration system to compensate people affected by natural disasters; how the State party could receive income from major emitters to fund climate adaptation plans; the ramifications of tax policies on economic, social and cultural rights; projects to strengthen anti-corruption bodies; and whether the State party trained judges and prosecutors on the Covenant.

    Responses by the Delegation

    The delegation said the National Commission on Indigenous Peoples was revising guidelines on the Indigenous Peoples’ Rights Act. The Commission had issued 272 approved ancestral domain titles to indigenous peoples.

    The national disaster risk reduction management framework addressed preparedness, rescue, response, recovery and rehabilitation. The State party conducted post-disaster needs assessments and tried to compensate for economic loss. A “digital locker” was being developed to allow citizens to store land titles, which would support reparation claims in cases of disasters.

    Discussions on the national action plan on business and human rights were in advanced stages. The State party sought to develop business and human rights policies that addressed specific issues related to children, indigenous peoples and environmental protection.

    The Government was interested in generating revenues from major emitters. It had developed a law that allocated resources to measuring loss and damage from climate change, which would help in this regard. The State party hosted the Loss and Damage Fund, and there were many international investments in environmental, social and governance projects in the Philippines.

    The Philippines had been recognised by the United Nations for its national recommendations tracking database. Judges were provided with training on the Covenant.

    Women parliamentary members had pushed for policies promoting women’s rights and inclusive governance. Community consultations and education programmes were in place to promote women’s participation in politics.

    The State party had proposed bills to amend taxes on passive income. It provided tax incentives to businesses that chose to operate outside of Manila.

    Questions by a Committee Expert

    SEREE NONTHASOOT, Committee Expert and Member of the Taskforce for the Philippines , expressed concerns about high levels of unemployment and informal employment in the Philippines. The informal sector provided livelihoods for about 60 per cent of the population, the majority of whom were female. What measures were in place to regularise the informal sector? The Committee was concerned about the quality of employment provided to persons with disabilities.

    What measures were in place to inspect sweatshops and to issue sanctions to employers who violated workers’ rights? What measures were in place to address workplace harassment and gender-based violence. Who was excluded from the social security system? It reportedly did not cover persons in street situations.

    There was significant variation between minimum wages in the capital and other regions. How did the State party support adequate living and working standards outside the capital? Did workers who were not paid minimum wages have access to a complaints mechanism? There had been a significant increase in child labour in the State party. How was this being addressed?

    The Committee was concerned by reports of red-tagging and killing of trade union workers. How was the Government promoting freedom of association? What was the role of relevant agencies in protecting trade union rights and the right to strike?

    Responses by the Delegation

    The delegation said the unemployment rate for 2023-2024 was 4.3 per cent. The rate quickly recovered after the pandemic. The State party had determined that less than 40 per cent of workers were in the informal sector. It was developing policy recommendations related to protecting the rights of informal sector workers and revising occupational safety and health standards to protect against accidents. The State was expanding opportunities for skills training and upskilling to help citizens increase their employability. There was a policy and regulatory framework in place to protect the rights of workers in the “gig economy”.

    The Government was encouraging investment outside of the capital. It conducted consultations and examined trends in real wages before setting regional minimum wages. Setting a standard minimum wage for the entire State would discourage businesses from investing in remote provinces.

    There was no State policy to attack human rights defenders. There were remedies to address violations of the right to life, and freedom of association and assembly. The Government rejected the word red-tagging due to the absence of such a policy.

    The “Reach Out” programme aimed to reach out to families in street situations, welcoming them in temporary shelters. Abandoned children were placed in foster families. Over 2,000 individuals had benefitted from the programme in 2023.

    The National Commission against Child Labour had inspected over 10,000 establishments in 2020, identifying violations of child labour laws. Many children identified as labourers were provided with educational materials and support. Family cash transfer programmes included seminars for parents which discouraged child labour. Parents who engaged their children in child labour could be taken off the programme.

    The Government was providing training for persons with disabilities to help them pass eligibility requirements for public sector jobs. It also conducted skills matching to help persons with disabilities access work in the private sector.

    Follow-Up Questions by Committee Experts

    Committee Experts asked follow-up questions on whether regional minimum wages were indexed and reviewed regularly; the role of the Government in protecting Filipino national migrant workers overseas; the number of labour inspections conducted annually; whether the Commission on Human Rights received complaints from workers; whether the State party would adopt policies mandating businesses to adopt diversity and inclusion regulations; plans to revise the Labour Code to remove barriers to forming and joining trade unions; and disaggregated data collected on persons not in employment, education or training.

    Responses by the Delegation

    The delegation said the Government considered regional poverty lines when setting provincial minimum wages. This was a starting wage, and the Government was supporting workers to receive higher wages.

    The State party had created a Department of Migrant Workers, which protected the rights of national migrant workers overseas. The Department was forming bilateral agreements with other countries to protect migrant workers from abuse. Several thousands of workers had been repatriated during the pandemic, many of whom had received assistance. Their children were provided with scholarships.

    Collecting data on persons not in employment, education or training was a goal of the Philippine Development Plan. There were special employment programmes for students and alternative learning systems in place to reduce the number of such persons.

    The State party had intensified efforts to identify and prevent child labour. More than 50,000 child labourers had been provided with necessary services and more than 30,000 child labourers had been removed from labour.

    The Philippines had several thousands of trade unions and workers’ associations with over four million members in total. The State engaged in dialogue with the International Labour Organization regarding incidents in which workers were killed or disappeared, and had adopted measures to prevent such incidents in the future. A committee had been formed to investigate these cases, and investigations into several cases had been concluded.

    In 2023, the State party had inspected more than 400,000 establishments to ensure they complied with health and safety standards.

    Questions by a Committee Expert

    LUDOVIC HENNEBEL, Committee Vice-Chair and Member of the Taskforce for the Philippines , asked about progress made in implementing recommendations from other treaty bodies on polygamy. What measures were in place to reform divorce procedures? 

    Had the State party received complaints regarding the violation of children’s rights during conflict or on the recruitment and use of children in armed conflict? What sanctions were imposed for persons who forced children to work? How was the State party preventing sexual and online exploitation of children, and supporting birth registration for children from indigenous and Muslim communities? What measures were in place to protect victims of rape and to repeal laws allowing perpetrators to avoid punishment by marrying victims?

    How did the State party promote equal access to civil unions for members of the lesbian, gay, bisexual, transgender and intersex community and protect the bodily integrity of intersex persons?

    How were people in the informal sector supported to access housing? What measures were in place to prevent evictions? How did the State party promote access to health for vulnerable groups, to mental health care in rural areas, and to emergency contraception and post-abortion care? How did it promote education on sexual and reproductive health for rural and young people?

    Was the State party planning to decriminalise drugs for personal use and implement alternatives to imprisonment for drug users? What protection was in place to prevent stigmatisation and criminalisation of persons receiving treatment for drug addiction? What measures were in place to put an end to the “war on drugs” and to provide reparations to victims of the war?

    Responses by the Delegation

    The delegation said the Philippines recognised several types of contractual employment, including for work performed outside the employer’s facilities and independent contractors. These workers were able to file complaints with the Government in cases of violations of labour rights.

    A law on agrarian emancipation had freed 6,000 farmers from debt. The State was also implementing agricultural support programmes. The area under the Verde Island Passage would be declared as a protected area, and the State would allocate resources to protecting the area. The State’s Blue Economy Bill would mandate policies for managing marine and coastal resources. The State party had also enacted a law on seafarers’ rights.

    The natural disaster risk reduction and management act regulated support for persons displaced by natural disasters. Such persons could access State-funded shelters. The Government continued to provide support to persons displaced by the 2017 Marawi siege. The Marawi Compensation Board ensured tax-free compensation for housing and property lost during the siege. The State also provided livelihoods, healthcare and educational support for victims.

    The Executive Branch had been advocating for a law on freedom of information, which would be passed soon. A freedom of information programme had been established to grant public access to official, non-confidential documents of public concern. A witness protection programme was also in place. The Anti-Red Tape Authority promoted transparency in Government operations, while the Ombudsman acted on confidential complaints of corruption. Punitive actions for corruption offences were severe.

    In State law, polygamy was illegal, and bigamy was a criminal offence. However, Muslim men with financial ability and their wives’ permission could marry multiple wives under traditional law, which also mandated divorces.

    The Philippines advocated for the protection of children in armed conflict. It had ratified the Optional Protocol to the Convention on the Rights of the Child on the involvement of children in armed conflict. Members of the Armed Forces under the age of 18 did not take part in combat. When violations occurred, investigations were carried out. However, the New People’s Army continued to recruit children. There were over 500 documented cases of this terrorist group’s use of children. The Government continued to exert efforts to ensure that schools were not used to exploit children.

    The State was strengthening efforts to address adolescent pregnancy through the implementation of comprehensive sexuality education and referral networks to reproductive health facilities. Over 100 schools were implementing the education programme, and over 1.1 million leaners had participated. Behavioural change materials had also been developed for schools and health facilities.

    The Philippines remained a prime target for online sexual abuse of children. Legislation had been implemented in 2022 to penalise all forms of online abuse of children. State agencies were cooperating to identify perpetrators.

    The Government was collecting data on malnutrition and stunting. Stunting in children under five had decreased from 33 per cent in 2018 to 23 per cent in 2024.

    Housing had been declared as a national concern by the current Government. The national housing programme had provided an average of 35,000 social housing units per year in recent years. Around 75,000 housing units had been provided to persons living in areas vulnerable to natural disasters and to indigenous peoples.

    The Government was adopting a humanitarian approach to drug use and rehabilitation. The drug clearing project sought to take away drugs from the people and discourage people from using drugs. Rehabilitation support was provided to drug users. Over 60 per cent of regions had been declared “drug cleared”, and over 40 per cent “drug-free”.

    Follow-Up Questions by Committee Experts

    Committee Experts asked follow-up questions on the passage of the extrajudicial killing bill and its relationship with the State drug policy; whether police were prohibited from reporting drug-related deaths to the media; whether detentions of drug users were voluntary; how the State supported people with drug-use records, who were criminalised, to access the work market; issues with the coverage of social security and nutrition programmes; measures to expedite agrarian reform to address high levels of poverty among farmers; measures to protect small-scale fishers from large-scale fishing businesses; indicators to assess multi-dimensional poverty and inform policies to tackle poverty; measures to support and protect the children of overseas workers from domestic abuse; how the energy market was regulated to make access to energy affordable; the impact of the prohibition of abortion on maternal mortality rates and measures implemented to respond to treaty bodies’ recommendations on increasing access to pre- and post-natal care services; and measures to legalise abortion in cases where there was risk to the health of the mother.

    Responses by the Delegation

    The delegation said there were several programmes supporting children in their first 1,000 days of life, including conditional cash transfers. Health workers were provided with training on caring for newborns and there were pre- and post-natal care programmes in place.

    The Philippines was an early adopter of a multidimensional poverty index, which helped to identify areas in which increased support was needed. A community-based monitoring system had been set up to collect data on multidimensional poverty.

    The State party had observed that for families with mothers who migrated overseas, grandparents typically cared for children and family circles also provided support. The Government had instructed teachers on identifying evidence of domestic abuse. Migrant workers were required to develop financial plans before leaving the country. The reintegration programme was being strengthened to help returning migrant workers.

    The State had reached 100 per cent electrification of rural regions, and was now working to address pockets of households that did not have electricity, supporting their access to renewable energy.

    Maternal deaths had been steadily decreasing in recent years. The Government was continuing to strengthen maternal and newborn care programmes, including by upskilling birthing nurses and reducing unsafe abortions.

    The State party prevented commercial fishers from fishing in waters reserved for municipal fishers and spawning grounds. The Clean and Healthy Oceans Programme aimed to reduce illegal and unregulated fishing by improving compliance with regulations. Programmes were in place to develop aquatic parks to support small-scale fishers, who could also access support for livelihoods and fishing tools.

    Questions by a Committee Expert

    LAURA-MARIA CRACIUNEAN-TATU, Committee Chair and Member of the Taskforce for the Philippines , commended the State party on the constant increase in the budget allocated to education, which had reached 3.2 per cent of gross domestic product. However, this was well below the United Nations’ recommendation of at least four per cent of gross domestic product. Were there further plans to increase the education budget? The Philippines’ global ranking in terms of quality of education was in the bottom 25 of 172 nations, the lowest score in Asia. What measures were envisioned to increase access to quality education for all?

    The State party had put in place a five-year development plan for children with disabilities, which ended in 2019. What results were achieved by the plan and what measures were in place to address limited access to education for children with disabilities and indigenous children? In one region, 56 per cent of children were not attending school. What measures were in place to address this issue? What measures were in place to address the impact of COVID-19 lockdowns on access to education? How was the national policy framework on schools as zones for peace implemented? Legislation had been implemented that discontinued mother tongue education for minority groups. What was the rationale behind the adoption of this law?

    There was increasing disparity in access to the internet across different regions. What measures were in place to improve access to the internet for poor households and regions?

    Responses by the Delegation 

    The delegation said that the Constitution mandated that education needed to be given priority in the budget. Overall spending on education amounted for around 5.5 per cent of gross domestic product. The State party had made kindergarten education compulsory and extended compulsory education by two years, and the curriculum had been revised recently to improve education quality. The Government was working to address the inadequate supply of textbooks and computers in schools through decentralisation. The Philippines had over 100 languages and it was difficult to develop learning materials in each of these languages. The State thus decided to discontinue mother tongue language instruction and standardise English as a medium of instruction from grade five.

    The State party was also working to address the impact of the COVID-19 pandemic on learning outcomes. Recently, legislation had been passed on remedial education. During the pandemic, the Government adopted learning continuity plans to support access to education through online and broadcast education.

    The Government had implemented many measures to manage culturally sensitive education in Muslim and indigenous communities. Education on peace and conflict resolution was being promoted, and the State party was working to repair schools damaged by conflicts. The Government promoted the concept of schools as zones of peace in conflict-affected areas such as Mindanao. Local governments and security forces contributed to protecting schools in peace zones from being used in military activities through measures such as school escorts. The Government continued to provide psychosocial support for children affected by armed conflict.

    The indigenous education programme promoted quality, culturally relevant education for indigenous peoples. It had been implemented in over 3,000 schools. Over 75 indigenous languages were used in instruction, and an additional 4,000 teachers, 95 per cent of whom were indigenous, had recently been hired to provide education to indigenous children.

    The Government was working to improve access to education and healthcare for children with disabilities. Legislation mandating inclusive education for children with disabilities had been adopted and disability support officers had been established in educational institutions.

    The State party had improved the policy and regulatory framework on internet access. The national fibre-optic cable network was being expanded to southern regions. The State party was collaborating with Starlink to allow southern provinces to access the internet via satellites. Telecommunications companies were provided with incentives to operate in the Philippines, and wi-fi access points were being set up in schools and public places.

    The State’s campaign against illegal drugs was now geared towards rehabilitation and reintegration of drug users. The House of Representatives had investigated extrajudicial killings occurring in the context of the war on drugs and the Government had decided to amend the Penal Code to increase penalties for extrajudicial killings.

    Follow-Up Questions by Committee Experts

    Committee Experts asked follow-up questions on how the State party promoted education in Spanish and Arabic; the results of the education programme on Islamic values; how the State party protected the expression of indigenous culture and indigenous cultural sites; whether indigenous leaders participated in creating policies impacting their communities; legal and administrative provisions to protect indigenous languages; the number of legal cases invoking economic, social and cultural rights in which reparations had been granted for violations; the role of the Commission of Human Rights in investigating complaints from workers and places of detention; how the State party would protect fishing zones for small-scale fishers; measures for reducing threats and attacks against human rights defenders; plans to decriminalise abortion; and measures to protect the lesbian, gay, bisexual, transgender and intersex community.

    Responses by the Delegation

    The delegation said there were schools in Mindanao that provided Arabic and Islamic education. Education in Spanish and Arabic was an option in mainstream schools. Four-year courses on Arabic teaching were provided in local universities.

    There was no legal framework on cultural misappropriation, but the Government was working to protect intellectual property rights by registering the cultural assets and expressions of indigenous peoples. Indigenous communities needed to be consulted regarding all projects and policies affecting them. Indigenous leaders were included in local development councils.

    Courts had cited the Covenant in decisions upholding standards of living and access to economic, social and cultural rights, including in cases in which remedies were granted for environmental harm caused by mining operations. There needed to be a new Charter governing the mandate of the Commission on Human Rights, which had traditionally focused on civil and political rights but was recently working to promote economic, social and cultural rights.

    Court cases were underway into violations of regulations on fishing zones by commercial fishers. The Government protected the rights of legitimate environmental defenders. Protection of the environment was included as a pillar of the national security policy.

    The State party had pivoted to a community-based approach to illegal drugs. Many drug users were treated in communities rather than in rehabilitation centres. Persons who participated in rehabilitation programmes were removed from criminal offender lists, but not drug user lists.

    The State party had not yet developed a comprehensive bill on the rights of internally displaced persons. Persons affected by the Marawi siege had been provided with access to water and electricity, and reconstruction efforts were ongoing in affected areas.

    The State had created a committee on lesbian, gay, bisexual, transgender and intersex affairs, which was developing policies and programmes to promote equality and inclusion of the community. The Constitution and various State legislation prohibited discrimination based on sexual orientation and gender identity. The police had formulated a gender sensitivity programme to ensure protection of this community.

    Pre-natal checkups were provided free of charge in primary health facilities, and mobile clinics provided maternal health services in isolated areas. The Government, while maintaining the prohibition of abortion, had taken measures to ensure quality post-abortion care was provided without stigmatisation.

    Closing Remarks

    ASRAF ALLY CAUNHYE, Committee Expert and Country Rapporteur for the Philippines , said the dialogue had been fruitful and constructive, addressing a range of issues confronting the Philippines. Discussions had brought to light issues that needed to be addressed to strengthen the implementation of economic, social and cultural rights, and would inform the Committee’s concluding observations. Mr. Caunhye expressed thanks to all persons who had contributed to the dialogue.

    ROSEMARIE G. EDILLON, Undersecretary, Policy and Planning Group, National Economic and Development Authority of the Philippines and head of the delegation, thanked the Committee for the dialogue. The State party was united in its goal of advancing economic, social and cultural rights. The President had a clear vision for national development that focused on improving access to all economic, social and cultural rights. The State party would continue with actions that would create change and realise the economic, social and cultural rights of all citizens.

    LAURA-MARIA CRACIUNEAN-TATU, Committee Chair , thanked the delegation for participating in the dialogue and for providing comprehensive answers. In some instances, additional data would have been appreciated. Human rights mechanisms were not mutually exclusive; they all served to enhance protections of rights holders. The Committee thanked civil society organizations for submitting information to the Committee and called for further cooperation between civil society and the Government.

    __________

    Produced by the United Nations Information Service in Geneva for use of the media; 
    not an official record. English and French versions of our releases are different as they are the product of two separate coverage teams that work independently.

     

    CESCR25.006E

    MIL OSI United Nations News

  • MIL-OSI Security: Fourteen Members and Associates of Violent Transnational Motorcycle Gang Indicted on RICO and Murder Charges

    Source: United States Attorneys General

    An indictment was unsealed today in the Southern District of Texas charging 14 members and associates of the Bandidos Outlaw Motorcycle Gang for their alleged roles in a criminal enterprise engaged in murder, robbery, arson, narcotics distribution, and witness intimidation in and around Houston.

    The indictment accuses the defendants of various crimes, including engaging in a conspiracy to commit racketeering (RICO) activity and committing violent crimes in furtherance of the gang such as murder, attempted murder, and assault. The indictment alleges that the Bandidos are a self-identified “outlaw” motorcycle organization with a membership of approximately 1,500 to 2,000 in the United States and an additional 1,000 to 1,500 members internationally, including in Mexico.

    “Today’s indictment is an important step in eliminating the Bandidos Outlaw Motorcycle Gang,” said Supervisory Official Antoinette T. Bacon of the Justice Department’s Criminal Division. “The Bandidos declare war on rivals — and they wage that war on our streets. Criminal behavior like this has no place in America, and the Department of Justice is fully committed to bringing peace back to our communities.”

    “Ensuring the safety of the public is Southern District of Texas’ paramount concern,” said U.S. Attorney Nicholas J. Ganjei for the Southern District of Texas. “The indictment here not only alleges shocking crimes of violence, but also alleges that these offenses were committed openly and wantonly, where any innocent member of the public could have been hurt or killed.”

    According to court documents and statements in court, beginning in 2019, a violent turf war erupted between the Bandidos and B*EAST, a rival outlaw motorcycle gang in the Houston area. As part of this turf war, Bandidos national leadership allegedly put out a “smash on site” order to commit physical assaults, including murder, against B*EAST members. The turf war has resulted in gunfire exchanged on public roadways and in public establishments with innocent civilians present, according to the charges.

    John M. Pfeffer, also known as Big John, 32, Darvi Hinojosa, also known as 10 Round, 35, and Bradley Rickenbacker, also known as Dolla Bill, 37, all of Katy, Texas; Michael H. Dunphy, also known as Money Mike, 57, of Cleveland, Texas; Christopher Sanchez, also known as Monster, 40, of Tomball, Texas; and Brandon K. Hantz, also known as Loco and Gun Drop, 33, of Crosby, Texas, are charged with conspiracy to commit racketeering activity. Pfeffer, Dunphy, Hinojosa, Rickenbacker, and Sanchez are further charged with multiple counts of assault in aid of racketeering. Pfeffer, Hinojosa, Rickenbacker, and Sanchez are also charged with using a firearm during and in relation to a crime of violence, while Sanchez faces charges of being a felon in possession of a firearm. Hantz is also charged with arson.

    If convicted, Pfeffer, Hinojosa, Rickenbacker, and Sanchez each face a maximum penalty of life in prison, while Dunphy and Hantz each face a maximum penalty of 20 years in prison on each of their counts.

    The indictment also charges David Vargas, also known as Brake Check and First Time, 33, of Houston, with murder in aid of racketeering; using a firearm during and in relation to a crime of violence resulting in death; attempted murder in aid of racketeering; and using a firearm during and in relation to the attempted murders. All those charges relate to the killing of a rival and the shooting of two others. If convicted, Vargas faces a mandatory penalty of life in prison or the death penalty.

    Further, Marky Baker, also known as Pinche Guero and Guero, 40; Ronnie McCabe, also known as Meathead, 56; and Jeremy Cox, also known as JD, 37, all of Houston; Roy Gomez, also known as Repo, 50, of Richmond, Texas; and Marcel Lett, 56, of Pearland, Texas, are charged along with Pfeffer and Rickenbacker with assault in aid of racketeering and using a firearm during and in relation to a crime of violence. These charges are in relation to an alleged assault and robbery that resulted in the death of a rival. If convicted, they each face a maximum penalty of life in prison.

    Hinojosa is also charged along with John Sblendorio, also known as Tech9, 54, of Houston, with conspiracy to commit murder in aid of racketeering, attempted murder in aid of racketeering, assault in aid of racketeering, and using a firearm during and in relation to a crime of violence in connection with the shooting of a rival gang member. Hinojosa is also charged with conspiracy to distribute cocaine and three counts of possession with intent to distribute cocaine. If convicted, Sblendorio and Hinojosa each face a maximum penalty of life in prison.

    In addition, Sean G. Christison, also known as Skinman, 30, of Katy, is charged with possession with intent to distribute cocaine and possession of a firearm in furtherance of a drug trafficking crime. He faces a maximum penalty of life in prison.

    For all defendants, a federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

    The FBI, Texas Board of Criminal Justice — Office of Inspector General, Texas Department of Public Safety, and Montgomery County Sheriff’s Office conducted the investigation, with assistance from the Harris County Sheriff’s Office; Houston and Pasadena Police Departments; Texas Alcoholic Beverage Commission; LaMarque and Katy Police Departments; U.S. Marshals Service; Bureau of Alcohol, Tobacco, Firearms and Explosives; and Cypress-Fairbanks Independent School District Police Department.

    Trial Attorneys Grace H. Bowen and Christopher Taylor of the Criminal Division’s Violent Crime and Racketeering Section and Assistant U.S. Attorneys Byron H. Black and Kelly Zenón-Matos for the Southern District of Texas are prosecuting the case.

    This investigation was part of an Organized Crime Drug Enforcement Task Forces (OCDETF) operation. OCDETF identifies, disrupts and dismantles the highest-level drug traffickers, money launderers, gangs and transnational criminal organizations that threaten the United States by using a prosecutor-led, intelligence-driven, multi-agency approach that leverages the strengths of federal, state and local law enforcement agencies against criminal networks. Additional information about the OCDETF Program can be found on the Justice Department’s OCDETF webpage.

    This case is being prosecuted as part of the joint federal, state and local Project Safe Neighborhoods (PSN) Program, the centerpiece of the Justice Department’s violent crime reduction efforts. PSN is an evidence-based program proven to be effective at reducing violent crime. Through PSN, a broad spectrum of stakeholders work together to identify the most pressing violent crime problems in the community and develop comprehensive solutions to address them. As part of this strategy, PSN focuses enforcement efforts on the most violent offenders and partners with locally based prevention and reentry programs for lasting reductions in crime. For more information about PSN, please visit www.justice.gov/psn.

    An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

    MIL Security OSI

  • MIL-OSI Europe: Written question – Possible measures to control illegal immigration at European borders – E-000619/2025

    Source: European Parliament

    Question for written answer  E-000619/2025
    to the Commission
    Rule 144
    Jorge Buxadé Villalba (PfE)

    With the recent inauguration of US President Donald Trump, new measures and decrees have immediately been implemented to reinforce immigration policies. These measures include stricter border restrictions, the signing of agreements for the return of illegal immigrants to their countries of origin and a large deployment of troops to ensure compliance with these policies.

    The situation in Europe is serious, specifically in Spain, where the number of irregular arrivals continues to increase. In 2024, these arrivals rose by 12.3 % compared to 2023. Crime and a lack of security in our streets are causing great concern among citizens, and the lack of effective mechanisms to manage this situation makes it difficult to find a solution to illegal immigration.

    • 1.Does the Commission consider the current European policies robust enough to guarantee the effective control of our borders?
    • 2.Is the Commission considering an update to the recently adopted Migration Pact to strengthen the mechanisms for the expulsion and return of irregular immigrants, and taking, as a reference, similar measures implemented in the US, such as the Laken Riley Act?

    Submitted: 11.2.2025

    Last updated: 19 February 2025

    MIL OSI Europe News

  • MIL-OSI USA: Attorney General James Announces Takedown of Fentanyl and Cocaine Trafficking Ring in the Hudson Valley 

    Source: US State of New York

    NEW YORK – New York Attorney General Letitia James today announced the takedown of a drug trafficking ring in the Hudson Valley that illegally sold cocaine, powder fentanyl, and counterfeit oxycodone pills containing fentanyl across Dutchess, Ulster, and Orange Counties. An investigation led by the Office of the Attorney General’s (OAG) Organized Crime Task Force (OCTF) recovered two and a half kilograms of cocaine worth approximately $45,000, thousands of counterfeit oxycodone pills containing fentanyl worth over $500,000, and three and a half kilograms of powder fentanyl worth over $200,000. Five illegal handguns, including two ghost guns, and four high-capacity magazines were also seized during the operation. A 122-count indictment charging four individuals for their roles in the drug trafficking network was unsealed in Dutchess County Court. The indictment charges Xavier Grant, Antawone West, Michael Jones, and Kenyi Torres with multiple felonies for narcotics and firearms offenses.

    “Drug traffickers who distribute lethal amounts of opioids put communities throughout our state in danger,” said Attorney General James. “Not only did these individuals sell deadly narcotics, they disguised fentanyl in fake prescription pills, putting the lives of their customers at even greater risk. I thank our partners in law enforcement for their collaboration in this effort to take a dangerous criminal organization off our streets as we continue to work to keep New Yorkers safe.”

    The takedown was the result of an eleven-month joint investigation led by OCTF and the New York State Police’s (NYSP) Special Investigations Unit – Hudson Valley (SIU-HV) and Troop K – Violent Gang and Narcotics Enforcement Team (K-VGNET).

    The investigation included hundreds of hours of physical and covert surveillance, analysis of voluminous electronic evidence, including cellphone communications, covert video and audio recordings, and other traditional investigative techniques. During their communications, the defendants frequently utilized coded and cryptic terminology in an attempt to disguise their illicit activities, such as referring to orders of counterfeit oxycodone pills containing fentanyl as “blues,” “blueberries,” or “perks,” a nod to their legitimate, prescription medication counterparts. 

    The investigation revealed that Grant, West, Jones, and Torres obtained cocaine, powder fentanyl, and counterfeit oxycodone pills containing fentanyl for further distribution. Additionally, the investigation revealed that the four defendants worked together to store, supply, and distribute the narcotics in Dutchess, Orange, and Ulster Counties. The narcotics were stored in various stash locations in the residential areas of Poughkeepsie and often sold in parking lots. The investigation also seized five illegal handguns, four of which were loaded, and two of which were ghost guns, in addition to four illegal high-capacity magazines.

    The investigation into this narcotics trafficking network led to the recovery of:

    • Two and a half kilograms of cocaine;
    • Thousands of counterfeit oxycodone pills containing fentanyl weighing over two and a half kilograms;
    • Three and a half kilograms of powder fentanyl;
    • Five illegal handguns, including two ghost guns and four high-capacity magazines;
    • Drug paraphernalia, including scales, ziplock bags, glassine envelopes, and other packaging materials used to package and measure narcotics;
    • Two “kilo” presses; and
    • Approximately $255,000 in cash.

    Some of the alleged narcotics and firearms seized during the investigation, including cocaine, counterfeit oxycodone pills containing fentanyl, powder fentanyl, five handguns, four high-capacity magazines, and “kilo” presses.

    The 122-count indictment, unsealed in Dutchess County Court, includes counts for various felony narcotics offenses, including charges against Jones and West for Criminal Sale of a Controlled Substance in the First Degree and Criminal Possession of a Controlled Substance in the First Degree, respectively. Each carries a maximum sentence of 20 years in prison. Additional charges include various counts of Criminal Sale of a Controlled Substance (class B felonies) and Criminal Possession of a Controlled Substance (class A-II and B felonies), as well as Conspiracy to commit those crimes.

    Jones and West are also charged with firearms offenses including Criminal Possession of a Weapon in the Second Degree, a class C violent felony, Criminal Possession of a Weapon in the Third Degree, a class D felony, and Criminal Possession of a Firearm, a class E felony.

    Grant and Torres are each charged with, among other things, multiple counts of Criminal Sale of a Controlled Substance in the Second Degree, a class A-II felony, which carries a maximum sentence of 10 years in prison. They are also charged with Conspiracy to commit those crimes. The charges against the defendants are merely accusations and the defendants are presumed innocent unless and until proven guilty.

    Some of the alleged counterfeit oxycodone pills containing fentanyl seized during this investigation.

    “I want to thank the Attorney General’s Office, and our law enforcement partners for their vigilant hard work that has resulted in the arrests of these dangerous individuals,” said New York State Police Superintendent Steven G. James. “The sale of these highly addictive drugs perpetuates a cycle of substance abuse which poses a significant threat to safety and quality of life within our neighborhoods. This sends a strong message to dealers that we will not tolerate illegal drugs and weapons being brought into or sold in our communities.”

    Those charged in the indictment include:

    • Xavier Grant a/k/a “X,” 22 years old of Poughkeepsie, New York;
    • Antawone West, 25 years old of Poughkeepsie, New York;
    • Michael Jones a/k/a “Slime,” 33 years old of Poughkeepsie, New York; and
    • Kenyi Torres, 45 years old of Middletown, New York.

    This takedown marks the latest major drug bust in OAG’s Suburban and Upstate Response to the Growing Epidemic (SURGE) Initiative, a law enforcement effort that brings together state and local law enforcement to target New York’s heroin, opioid, and narcotics trafficking networks. Since launching in 2017, SURGE has taken 984 alleged traffickers off the streets.

    The investigation was led by OCTF Detectives David Walsh and Steven Cohan, under the supervision of OCTF Detective Supervisor Bradford Miller, OCTF Downstate Assistant Chief Ismael Hernandez, and OCTF Deputy Chief Andrew Boss. The Attorney General’s Investigations Division is led by Chief Oliver Pu-Folkes. 

    Attorney General James would also like to thank Dutchess County District Attorney Anthony Parisi, the Dutchess County Sheriff’s Office, the City of Poughkeepsie Police Department, and the Dutchess County Drug Task Force for their assistance throughout the investigation.

    The case is being prosecuted by OCTF Assistant Deputy Attorney General Joseph Barca under the supervision of Downstate OCTF Deputy Chief Lauren Abinanti, with the assistance of OCTF Legal Support Analysts Madeline Rosen, Alex DiGiacomo, and former Legal Support Analyst Christine Cintron. Nicole Keary is the Deputy Attorney General in Charge of OCTF. The Division for Criminal Justice is led by Chief Deputy Attorney General José Maldonado. Both the Investigations Division and the Division for Criminal Justice are overseen by First Deputy Attorney General Jennifer Levy.

    MIL OSI USA News

  • MIL-OSI Security: #StopRansomware: Ghost (Cring) Ransomware

    Source: US Department of Homeland Security

    Summary

    Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.

    The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) are releasing this joint advisory to disseminate known Ghost (Cring)—(“Ghost”)—ransomware IOCs and TTPs identified through FBI investigation as recently as January 2025.

    Beginning early 2021, Ghost actors began attacking victims whose internet facing services ran outdated versions of software and firmware. This indiscriminate targeting of networks containing vulnerabilities has led to the compromise of organizations across more than 70 countries, including organizations in China. Ghost actors, located in China, conduct these widespread attacks for financial gain. Affected victims include critical infrastructure, schools and universities, healthcare, government networks, religious institutions, technology and manufacturing companies, and numerous small- and medium-sized businesses.

    Ghost actors rotate their ransomware executable payloads, switch file extensions for encrypted files, modify ransom note text, and use numerous ransom email addresses, which has led to variable attribution of this group over time. Names associated with this group include Ghost, Cring, Crypt3r, Phantom, Strike, Hello, Wickrme, HsHarada, and Rapture. Samples of ransomware files Ghost used during attacks are: Cring.exe, Ghost.exe, ElysiumO.exe, and Locker.exe.

    Ghost actors use publicly available code to exploit Common Vulnerabilities and Exposures (CVEs) and gain access to internet facing servers. Ghost actors exploit well known vulnerabilities and target networks where available patches have not been applied.

    The FBI, CISA, and MS-ISAC encourage organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of Ghost ransomware incidents.

    Download the PDF version of this report:

    For a downloadable copy of IOCs, see:

    Technical Details

    Note: This advisory uses the MITRE ATT&CK® Matrix for Enterprise framework, version 16.1. See the MITRE ATT&CK Tactics and Techniques section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.

    Initial Access

    The FBI has observed Ghost actors obtaining initial access to networks by exploiting public facing applications that are associated with multiple CVEs [T1190]. Their methodology includes leveraging vulnerabilities in Fortinet FortiOS appliances (CVE-2018-13379), servers running Adobe ColdFusion (CVE-2010-2861 and CVE-2009-3960), Microsoft SharePoint (CVE-2019-0604), and Microsoft Exchange (CVE-2021-34473CVE-2021-34523, and CVE-2021-31207— commonly referred to as the ProxyShell attack chain).

    Execution

    Ghost actors have been observed uploading a web shell [T1505.003] to a compromised server and leveraging Windows Command Prompt [T1059.003] and/or PowerShell [T1059.001] to download and execute Cobalt Strike Beacon malware [T1105] that is then implanted on victim systems. Despite Ghost actors’ malicious implementation, Cobalt Strike is a commercially available adversary simulation tool often used for the purposes of testing an organization’s security controls.

    Persistence

    Persistence is not a major focus for Ghost actors, as they typically only spend a few days on victim networks. In multiple instances, they have been observed proceeding from initial compromise to the deployment of ransomware within the same day. However, Ghost actors sporadically create new local [T1136.001] and domain accounts [T1136.002] and change passwords for existing accounts [T1098]. In 2024, Ghost actors were observed deploying web shells [T1505.003] on victim web servers.

    Privilege Escalation

    Ghost actors often rely on built in Cobalt Strike functions to steal process tokens running under the SYSTEM user context to impersonate the SYSTEM user, often for the purpose of running Beacon a second time with elevated privileges [T1134.001].

    Ghost actors have been observed using multiple open-source tools in an attempt at privilege escalation through exploitation [T1068] such as “SharpZeroLogon,” “SharpGPPPass,” “BadPotato,” and “GodPotato.” These privilege escalation tools would not generally be used by individuals with legitimate access and credentials. 

    See Table 1 for a descriptive listing of tools.

    Credential Access

    Ghost actors use the built in Cobalt Strike function “hashdump” or Mimikatz [T1003] to collect passwords and/or password hashes to aid them with unauthorized logins and privilege escalation or to pivot to other victim devices.

    Defense Evasion

    Ghost actors used their access through Cobalt Strike to display a list of running processes [T1057] to determine which antivirus software [T1518.001] is running so that it can be disabled [T1562.001]. Ghost frequently runs a command to disable Windows Defender on network connected devices. Options used in this command are: Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIntrusionPreventionSystem 1 -DisableBehaviorMonitoring 1 -DisableScriptScanning 1 -DisableIOAVProtection 1 -EnableControlledFolderAccess Disabled -MAPSReporting Disabled -SubmitSamplesConsent NeverSend.

    Discovery

    Ghost actors have been observed using other built-in Cobalt Strike commands for domain account discovery [T1087.002], open-source tools such as “SharpShares” for network share discovery [T1135], and “Ladon 911” and “SharpNBTScan” for remote systems discovery [T1018]. Network administrators would be unlikely to use these tools for network share or remote systems discovery.

    Lateral Movement

    Ghost actors used elevated access and Windows Management Instrumentation Command-Line (WMIC) [T1047] to run PowerShell commands on additional systems on the victim network— often for the purpose of initiating additional Cobalt Strike Beacon infections. The associated encoded string is a base 64 PowerShell command that always begins with: powershell -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIA… [T1132.001][T1564.003].

    This string decodes to “$s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(“” and is involved with the execution of Cobalt Strike in memory on the target machine.

    In cases where lateral movement attempts are unsuccessful, Ghost actors have been observed abandoning an attack on a victim.

    Exfiltration

    Ghost ransom notes often claim exfiltrated data will be sold if a ransom is not paid. However, Ghost actors do not frequently exfiltrate a significant amount of information or files, such as intellectual property or personally identifiable information (PII), that would cause significant harm to victims if leaked. The FBI has observed limited downloading of data to Cobalt Strike Team Servers [T1041]. Victims and other trusted third parties have reported limited uses of Mega.nz [T1567.002] and installed web shells for similar limited data exfiltration. Note: The typical data exfiltration is less than hundreds of gigabytes of data.

    Command and Control

    Ghost actors rely heavily on Cobalt Strike Beacon malware and Cobalt Strike Team Servers for command and control (C2) operations, which function using hypertext transfer protocol (HTTP) and hypertext transfer protocol secure (HTTPS) [T1071.001]. Ghost rarely registers domains associated with their C2 servers. Instead, connections made to a uniform resource identifier (URI) of a C2 server, for the purpose of downloading and executing Beacon malware, directly reference the C2 server’s IP address. For example, http://xxx.xxx.xxx.xxx:80/Google.com where xxx.xxx.xxx.xxx represents the C2 server’s IP address.

    For email communication with victims, Ghost actors use legitimate email services that include traffic encryption features. [T1573] Some examples of emails services that Ghost actors have been observed using are Tutanota, Skiff, ProtonMail, Onionmail, and Mailfence.

    Note: Table 2 contains a list of Ghost ransom email addresses.

    Impact and Encryption

    Ghost actors use Cring.exe, Ghost.exe, ElysiumO.exe, and Locker.exe, which are all ransomware executables that share similar functionality. Ghost variants can be used to encrypt specific directories or the entire system’s storage [T1486]. The nature of executables’ operability is based on command line arguments used when executing the ransomware file. Various file extensions and system folders are excluded during the encryption process to avoid encrypting files that would render targeted devices inoperable.

    These ransomware payloads clear Windows Event Logs [T1070.001], disable the Volume Shadow Copy Service, and delete shadow copies to inhibit system recovery attempts [T1490]. Data encrypted with Ghost ransomware variants cannot be recovered without the decryption key. Ghost actors hold the encrypted data for ransom and typically demand anywhere from tens to hundreds of thousands of dollars in cryptocurrency in exchange for decryption software [T1486].

    The impact of Ghost ransomware activity varies widely on a victim-to-victim basis. Ghost actors tend to move to other targets when confronted with hardened systems, such as those where proper network segmentation prevents lateral moment to other devices.

    Indicators of Compromise (IOC)

    Table 1 lists several tools and applications Ghost actors have used for their operations. The use of these tools and applications on a network should be investigated further.

    Note: Authors of these tools generally state that they should not be used in illegal activity.

    Table 1: Tools Leveraged by Ghost Actors
    Name Description Source
    Cobalt Strike Cobalt Strike is penetration testing software. Ghost actors  use an unauthorized version of Cobalt Strike. N/A
    IOX Open-source proxy, used to establish a reverse proxy to a Ghost C2 server from an internal victim device. github[.]com/EddieIvan01/iox
    SharpShares.exe SharpShares.exe is used to enumerate accessible network shares in a domain. Ghost actors use this primarily for host discovery. github[.]com/mitchmoser/SharpShares
    SharpZeroLogon.exe SharpZeroLogon.exe attempts to exploit CVE-2020-1472 and is run against a target Domain Controller. github[.]com/leitosama/SharpZeroLogon
    SharpGPPPass.exe SharpGPPPass.exe attempts to exploit CVE-2014-1812 and targets XML files created through Group Policy Preferences that may contain passwords. N/A
    SpnDump.exe SpnDump.exe is used to list service principal name identifiers, which Ghost actors use for service and hostname enumeration. N/A
    NBT.exe A compiled version of SharpNBTScan, a NetBIOS scanner. Ghost actors use this tool for hostname and IP address enumeration. github[.]com/BronzeTicket/SharpNBTScan
    BadPotato.exe BadPotato.exe is an exploitation tool used for privilege escalation. github[.]com/BeichenDream/BadPotato
    God.exe God.exe is a compiled version of GodPotato and is used for privilege escalation. github[.]com/BeichenDream/GodPotato
    HFS (HTTP File Server) A portable web server program that Ghost actors use to host files for remote access and exfiltration. rejitto[.]com/hfs
    Ladon 911 A multifunctional scanning and exploitation tool, often used by Ghost actors with the MS17010 option to scan for SMB vulnerabilities associated with CVE-2017-0143 and CVE-2017-0144. github[.]com/k8gege/Ladon
    Web Shell A backdoor installed on a web server that allows for the execution of commands and facilitates persistent access. Slight variation of github[.]com/BeichenDream/Chunk-Proxy/blob/main/proxy.aspx
    Table 2: MD5 File Hashes Associated with Ghost Ransomware Activity
    File name MD5 File Hash
    Cring.exe c5d712f82d5d37bb284acd4468ab3533
    Ghost.exe

    34b3009590ec2d361f07cac320671410

    d9c019182d88290e5489cdf3b607f982

    ElysiumO.exe

    29e44e8994197bdb0c2be6fc5dfc15c2

    c9e35b5c1dc8856da25965b385a26ec4

    d1c5e7b8e937625891707f8b4b594314

    Locker.exe ef6a213f59f3fbee2894bd6734bbaed2
    iex.txt, pro.txt (IOX) ac58a214ce7deb3a578c10b97f93d9c3
    x86.log (IOX)

    c3b8f6d102393b4542e9f951c9435255

    0a5c4ad3ec240fbfd00bdc1d36bd54eb

    sp.txt (IOX) ff52fdf84448277b1bc121f592f753c5
    main.txt (IOX) a2fd181f57548c215ac6891d000ec6b9
    isx.txt (IOX) 625bd7275e1892eac50a22f8b4a6355d
    sock.txt (IOX) db38ef2e3d4d8cb785df48f458b35090

    Ransom Email Addresses

    Table 3 is a subset of ransom email addresses that have been included in Ghost ransom notes.

    Table 3: Ransom Email Addresses
    Email Addresses
    asauribe@tutanota.com ghostbackup@skiff.com rainbowforever@tutanota.com
    cringghost@skiff.com ghosts1337@skiff.com retryit1998@mailfence.com
    crptbackup@skiff.com ghosts1337@tuta.io retryit1998@tutamail.com
    d3crypt@onionmail.org ghostsbackup@skiff.com rsacrpthelp@skiff.com
    d3svc@tuta.io hsharada@skiff.com rsahelp@protonmail.com
    eternalnightmare@tutanota.com just4money@tutanota.com sdghost@onionmail.org
    evilcorp@skiff.com kellyreiff@tutanota.com shadowghost@skiff.com
    fileunlock@onionmail.org kev1npt@tuta.io shadowghosts@tutanota.com
    fortihooks@protonmail.com lockhelp1998@skiff.com summerkiller@mailfence.com
    genesis1337@tutanota.com r.heisler@skiff.com summerkiller@tutanota.com
    ghost1998@tutamail.com rainbowforever@skiff.com webroothooks@tutanota.com

    Ransom Notes

    Starting approximately in August 2024, Ghost actors began using TOX IDs in ransom notes as an alternative method for communicating with victims. For example: EFE31926F41889DBF6588F27A2EC3A2D7DEF7D2E9E0A1DEFD39B976A49C11F0E19E03998DBDA and E83CD54EAAB0F31040D855E1ED993E2AC92652FF8E8742D3901580339D135C6EBCD71002885B.

    MITRE ATT&CK Tactics and Techniques

    See Table 4 to Table 13 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, version 16.1, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.

    Table 4: Initial Access
    Technique Title  ID Use
    Exploit Public-Facing Application T1190 Ghost actors exploit multiple vulnerabilities in public-facing systems to gain initial access to servers.
    Table 5: Execution
    Technique Title  ID Use
    Windows Management Instrumentation T1047 Ghost actors abuse WMI to run PowerShell scripts on other devices, resulting in their infection with Cobalt Strike Beacon malware.
    PowerShell T1059.001 Ghost actors use PowerShell for various functions including to deploy Cobalt Strike.
    Windows Command Shell T1059.003 Ghost actors use the Windows Command Shell to download malicious content on to victim servers.
    Table 6: Persistence
    Technique Title  ID Use
    Account Manipulation T1098 Ghost actors change passwords for already established accounts.
    Local Account T1136.001 Ghost actors create new accounts or makes modifications to local accounts.
    Domain Account T1136.002 Ghost actors create new accounts or makes modifications to domain accounts.
    Web Shell T1505.003 Ghost actors upload web shells to victim servers to gain access and for persistence.
    Table 7: Privilege Escalation
    Technique Title  ID Use
    Exploitation for Privilege Escalation T1068 Ghost actors use a suite of open source tools in an attempt to gain elevated privileges through exploitation of vulnerabilities.
    Token Impersonation/Theft T1134.001 Ghost actors use Cobalt Strike to steal process tokens of processes running at a higher privilege.
    Table 8: Defense Evasion
    Technique Title  ID Use
    Application Layer Protocol: Web Protocols T1071.001 Ghost actors use HTTP and HTTPS protocols while conducting C2 operations. 
    Impair Defenses: Disable or Modify Tools T1562.001 Ghost actors disable antivirus products.
    Hidden Window T1564.003 Ghost actors use PowerShell to conceal malicious content within legitimate appearing command windows.
    Table 9: Credential Access
    Technique Title  ID Use
    OS Credential Dumping T1003 Ghost actors use Mimikatz and the Cobalt Strike “hashdump” command to collect passwords and password hashes.
    Table 10: Discovery
    Technique Title  ID Use
    Remote System Discovery T1018 Ghost actors use tools like Ladon 911 and ShapNBTScan for remote systems discovery.
    Process Discovery T1057 Ghost actors run a ps command to list running processes on an infected device.
    Domain Account Discovery T1087.002 Ghost actors run commands such as net group “Domain Admins” /domain to discover a list of domain administrator accounts.
    Network Share Discovery T1135 Ghost actors use various tools for network share discovery for the purpose of host enumeration.
    Software Discovery T1518 Ghost actors use their access to determine which antivirus software is running.
    Security Software Discovery T1518.001 Ghost actors run Cobalt Strike to enumerate running antivirus software.
    Table 11: Exfiltration
    Technique Title  ID Use
    Exfiltration Over C2 Channel T1041 Ghost actors use both web shells and Cobalt Strike to exfiltrate limited data.
    Exfiltration to Cloud Storage T1567.002 Ghost actors sometimes use legitimate cloud storage providers such as Mega.nz for malicious exfiltration operations.
    Table 12: Command and Control
    Technique Title  ID Use
    Web Protocols T1071.001 Ghost actors use Cobalt Strike Beacon malware and Cobalt Strike Team Servers which communicate over HTTP and HTTPS.
    Ingress Tool Transfer T1105 Ghost actors use Cobalt Strike Beacon malware to deliver ransomware payloads to victim servers.
    Standard Encoding T1132.001 Ghost actors use PowerShell commands to encode network traffic which reduces their likelihood of being detected during lateral movement.
    Encrypted Channel T1573 Ghost actors use encrypted email platforms to facilitate communications. 
    Table 13: Impact
    Technique Title  ID Use
    Data Encrypted for Impact T1486 Ghost actors use ransomware variants Cring.exe, Ghost.exe, ElysiumO.exe, and Locker.exe to encrypt victim files for ransom.
    Inhibit System Recovery T1490 Ghost actors delete volume shadow copies.

    Mitigations

    The FBI, CISA, and MS-ISAC recommend organizations reference their #StopRansomware Guide and implement the mitigations below to improve cybersecurity posture on the basis of the Ghost ransomware activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections.

    • Maintain regular system backups that are known-good and stored offline or are segmented from source systems [CPG 2.R]. Ghost ransomware victims whose backups were unaffected by the ransomware attack were often able to restore operations without needing to contact Ghost actors or pay a ransom.
    • Patch known vulnerabilities by applying timely security updates to operating systems, software, and firmware within a risk-informed timeframe [CPG 1.E].
    • Segment networks to restrict lateral movement from initial infected devices and other devices in the same organization [CPG 2.F].
    • Require Phishing-Resistant MFA for access to all privileged accounts and email services accounts.
    • Train users to recognize phishing attempts.
    • Monitor for unauthorized use of PowerShell. Ghost actors leverage PowerShell for malicious purposes, although it is often a helpful tool that is used by administrators and defenders to manage system resources. For more information, visit NSA and CISA’s joint guidance on PowerShell best practices.
      • Implement the principle of least privilege when granting permissions so that employees who require access to PowerShell are aligned with organizational business requirements.
    • Implement allowlisting for applications, scripts, and network traffic to prevent unauthorized execution and access [CPG 3.A].
    • Identify, alert on, and investigate abnormal network activity. Ransomware activity generates unusual network traffic across all phases of the attack chain. This includes running scans to discover other network connected devices, running commands to list, add, or alter administrator accounts, using PowerShell to download and execute remote programs, and running scripts not usually seen on a network. Organizations that can successfully identify and investigate this activity are better able to interrupt malicious activity before ransomware is executed [CPG 3.A].
      • Ghost actors run a significant number of commands, scripts, and programs that IT administrators would have no legitimate reason for running. Victims who have identified and responded to this unusual behavior have successfully prevented Ghost ransomware attacks.
    • Limit exposure of services by disabling unused ports such as, RDP 3398, FTP 21, and SMB 445, and restricting access to essential services through securely configured VPNs or firewalls.
    • Enhance email security by implementing advanced filtering, blocking malicious attachments, and enabling DMARC, DKIM, and SPF to prevent spoofing [CPG 2.M].

    Validate Security Controls

    In addition to applying mitigations, the FBI, CISA, and MS-ISAC recommend exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory.

    To get started:

    1. Select an ATT&CK technique described in this advisory (see Table 3 to Table 13).
    2. Align your security technologies against the technique.
    3. Test your technologies against the technique.
    4. Analyze your detection and prevention technologies’ performance.
    5. Repeat the process for all security technologies to obtain a set of comprehensive performance data.
    6. Tune your security program, including people, processes, and technologies, based on the data generated by this process.

    Reporting

    Your organization has no obligation to respond or provide information back to the FBI in response to this joint advisory. If, after reviewing the information provided, your organization decides to provide information to the FBI, reporting must be consistent with applicable state and federal laws.

    The FBI is interested in any information that can be shared, to include logs showing communication to and from foreign IP addresses, a sample ransom note, communications with threat actors, Bitcoin wallet information, and/or decryptor files.

    Additional details of interest include a targeted company point of contact, status and scope of infection, estimated loss, operational impact, date of infection, date detected, initial attack vector, and host and network-based indicators.

    The FBI, CISA, and MS-ISAC do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, the FBI and CISA urge you to promptly report ransomware incidents to FBI’s Internet Crime Complain Center (IC3), a local FBI Field Office, or CISA via the agency’s Incident Reporting System or its 24/7 Operations Center (report@cisa.gov) or by calling 1-844-Say-CISA (1-844-729-2472).

    Disclaimer

    The information in this report is being provided “as is” for informational purposes only. The FBI, CISA, and MS-ISAC do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by the FBI, CISA, and the MS-ISAC.

    Version History

    February 19, 2025: Initial version.

    MIL Security OSI

  • MIL-OSI Security: Anchorage Man Sentenced to Over 11 Years for Attempting to Coerce a Minor

    Source: Federal Bureau of Investigation (FBI) State Crime Alerts (b)

    ANCHORAGE, Alaska – An Anchorage man was sentenced today to over 11 years in prison and will serve the rest of his life on supervised release for attempting to coerce and entice a minor in 2023.

    According to court documents, in early July 2023, Benjamin Roundy, aka “Aleks” or “Alekzander Marko,” 43, responded to a public group chat post on an internet-based app by an individual who identified herself as a 13-year-old living in Anchorage. The group chat post was actually made by an undercover agent.

    Court documents explain that Roundy communicated with the undercover agent for nearly a month, first on the app and then via text message, and he initiated sexual conversations. Roundy discussed sexual acts he wanted to perform on the individual, who be believed to be a child, and made repeated requests for explicit photos of her.

    On Aug. 4, 2023, Roundy asked the undercover agent to meet in person at the parking lot of a grocery store in Anchorage. The undercover agent told Roundy she was going to walk home from a friend’s house, and Roundy asked what street the friend lived on. Shortly after learning the fictional address of the friend, the defendant left his home to meet the undercover agent, who he thought was a minor.

    Court documents further explain that Roundy texted the undercover agent instructions on where to meet him. When he received no response to his instructions, Roundy drove to a parking lot where he could see the street of the fictitious friend. Law enforcement arrested Roundy in the parking lot shortly thereafter and discovered a new bottle of personal lubricant and condoms in his vehicle.

    The investigation revealed thousands of images and videos depicting child sexual abuse on Roundy’s electronic devices and data detailing his online presence, which included searches for child sexual abuse materials (CSAM) and related terms.

    On April 25, 2024, Roundy pleaded guilty to one count of attempted coercion and enticement of a minor.

    “Mr. Roundy’s conduct was heinous, as he tried to meet with who he believed was an underage girl in Anchorage to engage in sex, sought explicit images of the child, and obtained graphic images and videos depicting the sexual abuse of other minors for years,” said First Assistant U.S Attorney Kathryn R. Vogel for the District of Alaska. “Our office’s commitment to safeguarding Alaska’s children from those who seek to exploit their innocence is unwavering. We will relentlessly pursue justice by working with law enforcement to identify, investigate and hold accountable anyone who targets children.”

    “The defendant posed a significant threat to children in Alaska and abroad, as demonstrated by his disturbing pattern of conduct involving child exploitation,” said Special Agent in Charge Rebecca Day of the FBI Anchorage Field Office. “Even in the darkest corners of the Internet, the FBI’s Child Exploitation and Human Trafficking Task Force will find a way to seek justice for our most vulnerable.”

    The FBI and Anchorage Police Department investigated this case as part of the FBI’s Child Exploitation and Human Trafficking Task Force.

    Assistant U.S. Attorney Adam Alexander of the District of Alaska and Trial Attorney Rachel L. Rothberg of the Criminal Division’s Child Exploitation and Obscenity Section (CEOS) prosecuted the case.

    This case was brought as part of Project Safe Childhood, a nationwide initiative to combat the growing epidemic of child sexual exploitation and abuse launched in May 2006 by the Department of Justice. Led by U.S. Attorneys’ Offices and CEOS, Project Safe Childhood marshals federal, state, and local resources to better locate, apprehend and prosecute individuals who exploit children via the Internet, as well as to identify and rescue victims. For more information about Project Safe Childhood, please visit https://www.justice.gov/psc.

    ###

    MIL Security OSI

  • MIL-OSI Security: Twenty Years Later, FBI Continues to Pursue Information on the Disappearance of Danielle Imbo and Richard Petrone, Jr.

    Source: Federal Bureau of Investigation FBI Crime News (b)

    The FBI continues to seek the public’s assistance as we investigate the disappearance of Danielle (Ottobre) Imbo and Richard Petrone, Jr., 20 years ago today.

    Imbo and Petrone were last seen in the late evening hours of Saturday, February 19, 2005, leaving a bar on Philadelphia’s South Street for Petrone’s black 2001 Dodge Dakota pickup truck with the license plate YFH 2319.

    An extensive investigation to date has generated some promising leads; however, neither they nor the vehicle have ever been located.

    Danielle was last seen wearing a dark colored jacket, cream colored sweater, and blue jeans and carrying a two-handle black purse at the time of her disappearance. She has worked as a loan mortgage processor.

    Richard was last seen wearing a gray Polo brand sweatshirt and blue jeans. He has a tattoo of the word “Angela” on his left arm and a tattoo of clowns on his right arm.

    “Today marks a somber 20 years since this tragic disappearance and their case exemplifies that the passage of time does not diminish our pursuit of justice,” said Wayne A. Jacobs, Special Agent in Charge of FBI Philadelphia. “Our office remains unwavering in seeking justice for Danielle and Richard, their loved ones, and our city.”

    The FBI is offering a reward of up to $15,000 for information leading to the arrest and conviction of anyone involved in the disappearance of Richard Petrone and Danielle Imbo.

    If you have any information concerning this person, please contact your local FBI office or the nearest American Embassy or Consulate.

    FBI Philadelphia can be reached at (215) 418-4000.

    MIL Security OSI

  • MIL-OSI Security: Fifty-Two-Month Prison Sentence for a D.C. Convicted Felon Who Traveled to the Jersey Shore to Rob an Overnight Pharmacy

    Source: Federal Bureau of Investigation (FBI) State Crime News

               WASHINGTON – Ashawntea Henderson, 32, of Washington, D.C., was sentenced today in U.S. District Court in Washington D.C. to 52 months in federal prison for participating in an early morning robbery of a drug store at the Jersey Shore. During the May 2020 robbery, he and his co-conspirators jumped the counter, overpowered the night pharmacist, stole thousands of prescription narcotics, and then – as they attempted to flee to the District – crashed into a responding police cruiser.

               The sentencing was announced U.S. Attorney Edward R. Martin, FBI Special Agent in Charge Sean Ryan of the Washington Field Office Criminal and Cyber Division, and FBI Special Agent in Charge Terence Reilly of the Newark Field Office.

                Henderson pleaded guilty on October 30, 2024, to interference of commerce by robbery (Hobbs Act robbery). In addition to the 52-month prison sentence, Judge Amy Berman Jackson ordered Henderson to serve three years of supervised release.

    According to court documents, Henderson and his co-conspirators researched potential targets including Walgreens and CVS pharmacies which were open all night. On May 9, 2020, Henderson and others drove more than 200 miles from Washington, D.C. to a Walgreens Pharmacy on State Road 33, in Neptune, New Jersey.

    At 3:09 a.m., Henderson and two others dressed in masks and gloves entered the Walgreens. All three jumped over the pharmacy counter and demanded codeine, Adderall, and Percocet. One of the co-conspirators grabbed the night pharmacist, demanded that he open the locked cabinets containing additional pills, and forced the pharmacist to assist them. After grabbing thousands of prescription medicines – including Oxycodone, morphine, amphetamine, and Nucynta – Henderson and the two co-conspirators fled in a black Nissan Altima operated by a fourth co-conspirator. At one point, the Nissan collided with a responding police officer’s patrol car but continued at high speed back to Washington D.C.

    After returning to the District, as they celebrated at a hotel, one of the co-conspirators received a text from a known drug distributor asking the price for a drug of the same type stolen from Neptune, New Jersey. The co-conspirator and the drug distributor continued to exchange texts about the sale of drugs for the following weeks.

               Henderson is currently serving a five-year prison sentence in Maryland in connection with his 2022 possession of a firearm. 

               The case was investigated by the FBI Washington Field Office’s Violent Crimes Task Force and the Neptune Township Police Department. The matter is being prosecuted by AUSAs Justin Song, Sarah Martin and Cameron Tepfer.

    23cr190

    MIL Security OSI

  • MIL-OSI Security: UPDATE: Detectives name man killed in Hackney stabbing

    Source: United Kingdom London Metropolitan Police

    The victim of a fatal stabbing in Hackney has been named as 20-year-old Jason Junior Romeo.

    Police were called to reports of an altercation in Bodney Road, E5 at 17:59hrs on Tuesday, 18 February. Officers and the London Ambulance Service worked to treat Jason at the scene but he sadly died as a result of a stab wound.

    Two men in their 20s have been arrested and remain in police custody.

    Detective Superintendent Kelly Allen, leading the investigation in Hackney, said: “Jason had his whole life ahead of him but this senseless attack has taken that from both him and his loved ones. Our continued thoughts go out to his family, who are being supported by specialist officers.

    “If anyone saw this incident, or was nearby, please do share that information with officers. We are especially interested in any footage from the surrounding area.”

    The public can contact the police via 101 or contact Crimestoppers anonymously on 0800 555 111 with any information, reference CAD 5635/18Feb.

    A crime scene will remain in place until the forensic investigation has concluded.

    Detective Chief Superintendent James Conway, who leads policing in Hackney and Tower Hamlets, said: “It is absolutely devastating for Jason’s family and extremely distressing for our communities that another young life has been taken away as a consequence of knife crime. We continue to work closely with our local community partners and Hackney Council to tackle the causes and effects of knife crime.

    “I repeat an appeal I have sadly had to make too frequently. If any young person feels they need to carry a knife please speak to a parent, carer, teacher, youth leader or adult you trust and we can get you the support to step back from that decision safely.

    “I will have additional uniformed and plain clothed officers working in the area as a consequence of this tragic event. While the investigation continues to work to understand the motive for this attack, we will work tirelessly to reduce the risk of any further violence.”

    MIL Security OSI

  • MIL-OSI Europe: AFRICA/SUDAN – Crisis between Sudan and Kenya after the signing in Nairobi of the constitutive act of an alternative Sudanese government

    Source: Agenzia Fides – MIL OSI

    Khartoum (Agenzia Fides) – A violation of “international law, the Charter of the United Nations, the Constitutive Act of the African Union and the Convention on the Prevention and Punishment of the Crime of Genocide.” This is how the Ministry of Foreign Affairs of the Sudanese government, led by General Abdel Fattah al Burhan, defined Kenya’s decision to welcome the “signing of a political agreement between the terrorist militia Janjaweed, responsible for the ongoing acts of genocide in Sudan, and its affiliated individuals and groups”.The document, called the “Political Charter for the Government of Peace and Unity,” promoted by the Rapid Support Forces (RSF) led by Mohamed Hamdan “Hemeti” Dagalo, together with other Sudanese political and military actors, effectively represents the creation of a parallel government to that led by Al Burhan from Port Sudan. The capital Khartoum is still disputed between the two adversaries, although the military of Al Burhan’s Sudanese Armed Forces (SAF) appears to have regained some important strategic points in the region in recent weeks.“Since the stated aim of this agreement is to establish a parallel government in part of Sudanese territory, this step promotes the fragmentation of African states, violates their sovereignty and interferes in their internal affairs,” the Sudanese Foreign Ministry said in a statement. “This is therefore a clear violation of the UN Charter, the founding act of the African Union and the established principles of the modern international order.” Meanwhile, the term “Janjaweed” used in the statement evokes sad memories, especially for people in Darfur, the RSF’s bastion. The Janjaweed were the militias allied with the Khartoum regime that bloodily suppressed the uprisings in this region of western Sudan in the early 2000s. The RSF is its evolution, which in turn has rebelled against the regular army over the years.According to the statement, by hosting the event, Kenya is also complicit in the crimes committed by the RSF (“genocide, ethnically motivated massacres of civilians, attacks on camps for displaced persons and rapes”).The formation of an alternative government is seen as an attempt by the RSF leader, Dagalo, to gain international legitimacy. Both the Sudanese army and the RSF are subject to international sanctions for war crimes and crimes against humanity committed in the conflict. However, Al Burhan’s government enjoys international recognition that Dagalo’s troops do not. Nairobi’s decision to host the event should be seen against the backdrop of the renewed relations of the Sudanese government with Russia and Iran. Russia, through the private military company Wagner, had initially supported the RSF and has now decided to support General Al Burhan, who in return has granted Moscow a military base on the Red Sea. Iran, which until 15 years ago had close military relations with the Al-Bashir regime, which were severed by the latter under pressure from the West and some Gulf countries, now sees a new window opened for the resumption of relations with the meeting of the two foreign ministers on February 17, during which Tehran stressed the importance of Sudan’s territorial integrity and the end of foreign interference in Sudan. (L.M.) (Agenzia Fides, 19/2/2025)
    Share:

    MIL OSI Europe News

  • MIL-OSI Security: Convicted Drug Trafficker Found Guilty Of Distributing Fentanyl That Resulted In The Deaths Of Two Hillsborough County Men

    Source: Office of United States Attorneys

    Tampa, Florida – Acting United States Attorney Sara C. Sweeney announces that a federal jury has found Marquis Lamar McCullough (39, Tampa) guilty of two counts of distribution of fentanyl and one count of possession with intent to distribute fentanyl. For both counts of distribution of fentanyl, the jury also found that the death of a person resulted from the use of the fentanyl that McCullough had distributed. McCullough, who was previously convicted of trafficking in cocaine, faces mandatory sentences of life imprisonment. 

    According to testimony and evidence presented at trial, on April 22, 2021, deputies from the Hillsborough County Sheriff’s Office (HCSO) responded to the residence of K.K. to conduct a wellness check. They found K.K. dead when they entered his apartment, standing with his feet on the floor and his head and torso on top of the bathroom counter. Deputies found two baggies with small quantities of a substance, suspected to be heroin or fentanyl, in K.K.’s residence. Detectives reviewed K.K.’s cellphone and found communications with a woman who appeared to help K.K. purchase fentanyl the previous evening. The woman—who was a heroin user and not a dealer—was arrested on an unrelated charge and interviewed by detectives. She told them that K.K. could not get heroin from his usual source, so he asked her to buy heroin for him from her source, and she agreed to do it if she got to keep a bag for herself. The woman arranged a meeting with her supplier, “Slim,” and K.K. took her to meet Slim. With money provided by K.K., the woman bought several bags from Slim, provided most of them to K.K., and kept a couple of bags for herself.

    On April 28, 2021, HCSO detectives conducted a controlled purchase during which detectives observed “Slim” deliver fentanyl and identified him as Marquis Lamar McCullough.

    On May 6, 2021, the son of N.M. found his father dead, lying in his bed, and called 911 to report the death. HCSO deputies and detectives responded to the residence, and inside N.M.’s wallet they found a baggie with a small amount of a substance suspected to be heroin or fentanyl. While reviewing calls and texts on N.M.’s phone, a detective who had participated in the surveillance operation eight days earlier recognized that the last three calls placed by N.M. were to McCullough’s phone number, and the call and text history indicated that McCullough was N.M.’s supplier. Later that day, HCSO detectives planned for another purchase of heroin or fentanyl from McCullough, using N.M.’s cellphone to set up the meeting. When McCullough arrived at the meeting location, he tried to call N.M., but when his calls went unanswered, McCullough fled the area. An arrest team pursued his vehicle and took McCullough into custody.

    The Drug Enforcement Administration laboratory determined that the substances found at the residences of K.K. and N.M., and the substances purchased from McCullough on April 28, 2021, all contained fentanyl. The Hillsborough County Medical Examiner’s Office investigated both deaths and determined that the use of fentanyl caused the deaths of K.K. and N.M. 

    This case was investigated by the Federal Bureau of Investigation, the Drug Enforcement Administration, the Hillsborough County Sheriff’s Office, and the Hillsborough County Medical Examiner’s Office. It is being prosecuted by Assistant United States Attorneys Michael Sinacore and Ross Roberts.

    This case was part of an Organized Crime Drug Enforcement Task Force (OCDETF) investigation. OCDETF identifies, disrupts, and dismantles the highest-level criminal organizations that threaten the United States using a prosecutor-led, intelligence-driven, multi-agency approach. Additional information about the OCDETF Program can be found at www.justice.gov/OCDETF.

    MIL Security OSI

  • MIL-OSI Security: Evansville Fentanyl Dealers Sentenced to a Combined Decade in Federal Prison for Manufacturing Counterfeit Drugs Using a Pill Press

    Source: Office of United States Attorneys

    EVANSVILLE— Ethan Parker, 31 and Joshua Harvey 33, of Evansville, have been sentenced for their parts in a fentanyl trafficking scheme. Parker was sentenced to four years in federal prison, followed by one year of supervised release after pleading guilty to possession and distribution of a tableting machine. Harvey was sentenced to 92 months in federal prison followed by five years of supervised release after pleading guilty to conspiracy to distribute fentanyl.

    According to court documents, between January 1, 2022, and April 4, 2022, Parker and Harvey conspired together to manufacture and distribute more than 40 grams of fentanyl laced pills to individuals in and around the city of Evansville.

    In the furtherance of the conspiracy, on multiple occasions in February and March of 2022, Harvey sold fentanyl-laced counterfeit pills in Evansville, Indiana, and Henderson, Kentucky. On March 23, 2022, Parker, communicating through an encrypted messaging application, agreed to sell Harvey 100 fentanyl-laced counterfeit pills for $350. On April 4, 2022, Harvey possessed approximately 31.9 grams of fentanyl-laced counterfeit pills with the intent to distribute them to dealers.

    On August 25, 2021, Parker sold a blue pill press, along with an Alprazolam imprinting die, for $1,400, knowing that the pill press would be used to manufacture a controlled substance. The die could be used to manufacture counterfeit Alprazolam (Xanax). On April 4, 2022, Parker was found in possession of another pill press and pill imprinting dies of various shapes and imprints for use in the manufacture of fentanyl-laced counterfeit pills.

    “Fentanyl dealers value their profits far more than the lives of our families and neighbors,” said John E. Childress, Acting United States Attorney for the Southern District of Indiana. “We must fight to save lives by investigating and prosecuting criminals who exploit the epidemic of substance use disorder to satisfy their own greed. Our office, the DEA, and the Evansville Police Department are committed to holding fentanyl traffickers accountable for pushing deadly poison on our streets.”

    “The charges against Mr. Parker and Mr. Harvey were necessary and justified. This case exemplified high level investigative work conducted by the Evansville-Vanderburgh County Drug Task Force in collaboration with the DEA Evansville HIDTA Task Force,” said DEA Assistant Special Agent in Charge Michael Gannon. “Mr. Parker and Mr. Harvey were responsible for distributing significant quantities of fake pills containing fentanyl. In addition, the investigation led to the seizure of two pill presses capable of manufacturing fake Xanax pills and fentanyl pills.  Taking two pill presses off the streets is a major win for our community. The DEA remains committed to working hand-in-hand with our partners to hold reckless drug dealers, who peddle poison to our communities, accountable for their actions and make our community safer.” 

    The Drug Enforcement Administration and the Evansville Police Department investigated this case. The sentences were imposed by U.S. District Judge Richard L. Young. This prosecution is part of the Indiana High Intensity Drug Trafficking Areas (HIDTA) program.

    Acting U.S. Attorney Childress thanked Assistant U.S. Attorney Todd S. Shellenbarger, who prosecuted this case.

    According to the Drug Enforcement Administration, as little as two milligrams of fentanyl can be fatal, depending on a person’s body size, tolerance, and past usage—a tiny amount that can fit on the tip of a pencil. Seven out of ten illegal fentanyl tablets seized from U.S. streets and analyzed by the DEA have been found to contain a potentially lethal dose of the drug.

    One Pill Can Kill: Avoid pills bought on the street because One Pill Can Kill. Fentanyl has now become the leading cause of death for adults in the United States. Fentanyl is a highly potent opioid that drug dealers dilute with cutting agents to make counterfeit prescription pills that appear to be Oxycodone, Percocet, Xanax, and other drugs. Fake prescription pills laced with fentanyl are usually shaped and colored to look like pills sold at pharmacies. For example, fake prescription pills known as “M30s” imitate Oxycodone obtained from a pharmacy, but when sold on the street the pills routinely contain fentanyl. These pills are usually round tablets and often light blue in color, though they may be in different shapes and a rainbow of colors. They often have “M” and “30” imprinted on opposite sides of the pill. Do not take these or any other pills bought on the street – they are routinely fake and poisonous, and you won’t know until it’s too late.

    ###

    MIL Security OSI

  • MIL-OSI Security: Leader of Large-Scale Drug Trafficking Organization Pleads Guilty in Federal Court

    Source: Office of United States Attorneys

    CONCORD – A Boston man pleaded guilty yesterday in federal court in Concord to conspiring to distribute fentanyl and cocaine in New Hampshire, Acting U.S. Attorney Jay McCormack announces.

    Juan Ramon Soto Baez, 55, pleaded guilty to one count of conspiracy to distribute controlled substances, namely, cocaine and fentanyl.  U.S. District Court Judge Samantha Elliott scheduled sentencing for May 29, 2025.  On April 26, 2023, the defendant was charged along with 20 other defendants. To date, 10 defendants involved in the conspiracy have been convicted.

    According to the plea agreement and statements made in court, the defendant was the leader of a Massachusetts-based drug trafficking organization that distributed large quantities of fentanyl and cocaine in New Hampshire, particularly Manchester, between September of 2019 and April of 2023.  The organization was run like a business, operating “dispatch” telephone lines where customers could call in to order narcotics. The defendant or a trusted member of the conspiracy working for him would take customer orders on the phone, and then he would either deliver the order himself or send a runner to conduct the drug sale at an arranged meeting location.

    During the timeframe of the conspiracy, law enforcement agents observed and recorded the defendant and his co-conspirators selling fentanyl and cocaine on nineteen occasions. On the day of the defendant’s arrest, a search of a residence associated with the conspiracy yielded $15,000 and drug ledgers.  A search of a vehicle used by the drug trafficking organization yielded roughly 94 grams of fentanyl and 196 grams of cocaine packaged in small baggies for distribution.

    The charging statute provides a sentence of no greater than 20 years in prison, at least three (3) years of supervised release, and a maximum fine of $1,000,000. Sentences are imposed by a federal district court judge based upon the U.S. Sentencing Guidelines and statutes which govern the determination of a sentence in a criminal case.

    The Federal Bureau of Investigation and the Drug Enforcement Administration led the investigation. Valuable assistance was provided by the Manchester Police Department. Assistant U.S. Attorney Aaron Gingrande is prosecuting the case. 

    This effort is part of an Organized Crime Drug Enforcement Task Forces (OCDETF) operation. OCDETF identifies, disrupts, and dismantles the highest-level criminal organizations that threaten the United States using a prosecutor-led, intelligence-driven, multi-agency approach. Additional information about the OCDETF Program can be found at https://www.justice.gov/OCDETF.

    ###

     

    MIL Security OSI

  • MIL-OSI Security: Jury Convicts Valrico Man Of Drug Trafficking

    Source: Office of United States Attorneys

    Tampa, Florida – Acting United States Attorney Sara C. Sweeney announces that a federal jury has found Tryon Metteria Byrd IV (45, Valrico) guilty of conspiring to distribute, and distributing, methamphetamine and cocaine. Byrd faces a minimum penalty 5 five years, up to 40 years, in federal prison. His sentencing hearing is scheduled for May 14, 2025.

    According to testimony and evidence presented at trial, Byrd and his co-conspirators distributed methamphetamine and cocaine out of three residences in St. Petersburg. Byrd sold directly to undercover detectives from the St. Petersburg Police Department from a residence owned by his family.

    Byrd’s co-conspirators, Eric L. Lemon, Eric Lekent Lemon Jr., and Dominic Giannantonio pleaded guilty and have been sentenced for their roles in the drug conspiracy. Lemon was sentenced to 21 years and 6 months in federal prison, Lemon Jr. was sentenced to 4 years and 3 months’ imprisonment, and Giannantonio was sentenced to 11 years and 3 months in prison.

    This case was investigated by the St. Petersburg Police Department and the Bureau of Alcohol, Tobacco, Firearms and Explosives. It was prosecuted by Assistant United States Attorney David P. Sullivan.

    This case was part of an Organized Crime Drug Enforcement Task Force (OCDETF) investigation. OCDETF identifies, disrupts, and dismantles the highest-level criminal organizations that threaten the United States using a prosecutor-led, intelligence-driven, multi-agency approach. Additional information about the OCDETF Program can be found at www.justice.gov/OCDETF.

    MIL Security OSI

  • MIL-OSI Security: Spring Hill Man Sentenced for Dog Fighting

    Source: Office of United States Attorneys

    Tampa, FL — Jose Miguel Carrillo, of Spring Hill, Florida, was sentenced yesterday to 84 months in prison after pleading guilty to conspiring to violate the dog fighting prohibitions of the federal Animal Welfare Act and being a felon in possession of a firearm.

    According to court filings, Carrillo conspired with others to purchase, acquire, and breed dogs for use in dog fights. Carillo also staged dog fights at his home and traveled to dog fights in Massachusetts, Florida, and Connecticut.

    A June 2023 search warrant was executed at Carrillo’s home and led to the seizure of 10 pit bull-type dogs, most of which were later adopted by new owners, as well as a firearm and ammunition. Carrillo also possessed dog fighting paraphernalia including a bloodstained dog fighting box, a skin stapler, syringes, and injectable veterinary medications.

    “To its core, dog fighting is a cruel and criminal exploitation of animals for entertainment,” said Principal Deputy Assistant Attorney General Adam Gustafson of the Justice Department’s Environment and Natural Resources Division. “Today’s sentence sends a strong deterrent message that the Justice Department will vigorously prosecute these cases.”

    “Exploiting and endangering the welfare of animals for personal gain is cruel and abhorrent,” said Acting U.S. Attorney Sara C. Sweeney for the Middle District of Florida. “Because of the hard work of our law enforcement partners, justice was served.”

    “The Office of Inspector General is committed to working with all of our law enforcement and prosecutorial partners in pursuing individuals who choose to participate in animal fighting activities and engage in violations involving animal welfare, while also committing other serious offenses in our communities,” said Special Agent in Charge Charmeka Parker of the U.S. Department of Agriculture’s Office of Inspector General (USDA-OIG).

    Photo of dogs at Carrillo’s home, from court documents in United State v. Jose Carrillo, number 8:23-CR-00222, in U.S. District Court for the Middle District of Florida.

    Photo of a bloodstained dog fighting pit at Carrillo’s home, from court documents in United State v. Jose Carrillo, number 8:23-CR-00222, in U.S. District Court for the Middle District of Florida.

    To report animal fighting crimes, please contact your local law enforcement or the USDA-OIG’s complaint hotline at: usdaoig.oversight.gov/hotline or 1-800-424-9121.

    The USDA-OIG; Bureau of Alcohol, Tobacco, Firearms, and Explosives; Pasco (Florida) Sheriff’s Office and the Fitchburg (Massachusetts) Police Department investigated the case. Assistance was provided by the U.S. Marshals Service, Massachusetts State Police, New Hampshire State Police, Animal Rescue League of Boston’s Law Enforcement Division, U.S. Coast Guard Investigative Service, Homeland Security Investigations and U.S. Customs and Border Protection.

    Senior Trial Attorney Matthew T. Morris of the Environment and Natural Resources Division’s Environmental Crimes Section and Assistant U.S. Attorneys Erin Favorit and Tiffany Fields for the Middle District of Florida prosecuted the case. Trial Attorney Caitlyn Cook of the Environment and Natural Resources Division’s Wildlife and Marine Resources Section assisted with the transfer of the seized dogs to new owners.

    MIL Security OSI

  • MIL-OSI Security: McKees Rocks Resident Pleads Guilty to Possession of Child Sexual Abuse Materials

    Source: Office of United States Attorneys

    PITTSBURGH, Pa. – A resident of McKees Rocks, Pennsylvania, pleaded guilty in federal court on February 18, 2025, to a charge of child exploitation, Acting United States Attorney Troy Rivetti announced today.

    Brandon Jennings, 38, pleaded guilty before Senior United States District Judge Joy Flowers Conti to one count of possession of material depicting the sexual exploitation of a minor.

    In connection with the guilty plea, the Court was advised that, in and around March 2021 and July 2021, Jennings possessed 926 images and 803 videos depicting the sexual exploitation of minors, some of whom were prepubescent.

    Judge Flowers Conti scheduled sentencing for June 25, 2025. The law provides for a maximum total sentence of up to 20 years in prison, a fine of up to $250,000, or both. Under the federal Sentencing Guidelines, the actual sentence imposed would be based upon the seriousness of the offense and the prior criminal history, if any, of the defendant.

    Assistant United States Attorney V. Joseph Sonson is prosecuting this case on behalf of the government.

    The Federal Bureau of Investigation and Allegheny County Police Department conducted the investigation that led to the prosecution of Jennings.

    This case was brought as part of Project Safe Childhood, a nationwide initiative launched in May 2006 by the Department of Justice to combat the growing epidemic of child sexual exploitation and abuse. Led by the United States Attorneys’ Offices and the Criminal Division’s Child Exploitation and Obscenity Section, Project Safe Childhood marshals federal, state, and local resources to locate, apprehend, and prosecute individuals who sexually exploit children, and to identify and rescue victims. For more information about Project Safe Childhood, please visit www.justice.gov/psc.
     

    MIL Security OSI

  • MIL-OSI Security: Former Reno Police Officer Indicted for Civil Rights Violations

    Source: Federal Bureau of Investigation (FBI) State Crime Alerts (c)

    RENO – A former Reno Police Department officer made his initial court appearance today for allegedly depriving two individuals of their civil rights under color of law by violating their right to be free from unreasonable search and seizure.

    A federal grand jury returned an indictment charging Tyler Michael Baehr, 30, of Reno, with two counts of depravation of rights under color of law. Baehr appeared before United States Magistrate Judge Craig S. Denney who scheduled a jury trial to begin April 8, 2025, before United States District Judge Miranda M. Du.

    According to allegations contained in the indictment and statements made in court, on December 31, 2023, Baehr willfully deprived an individual of the right to be free from unreasonable search and seizure by taking her cellular phone during a routine traffic stop and unlawfully seizing sexually explicit photos of her from her phone. On August 12, 2024, Baehr willfully deprived another individual of the right to be free from unreasonable search and seizure by taking her cellular phone during a routine traffic stop and unlawfully searching through her private photos and messages.

    If convicted, Baehr faces the maximum statutory penalty of 2 years in prison. A federal district court judge will determine any sentence based on the U.S. Sentencing Guidelines and other statutory factors.

    Acting United States Attorney Sue Fahami and Acting Special Agent in Charge Jeremy N. Schwartz for the FBI made the announcement.

    This case was investigated by the FBI and Sparks Police Department. Assistant United States Attorney Andolyn Johnson is prosecuting the case.

    An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

    ###

     

    MIL Security OSI

  • MIL-OSI USA: Florida Man Sentenced for Dog Fighting

    Source: US State Government of Utah

    Jose Miguel Carrillo, of Spring Hill, Florida, was sentenced yesterday to 84 months in prison after pleading guilty to conspiring to violate the dog fighting prohibitions of the federal Animal Welfare Act and being a felon in possession of a firearm.

    According to court filings, Carrillo conspired with others to purchase, acquire, and breed dogs for use in dog fights. Carillo also staged dog fights at his home and traveled to dog fights in Massachusetts, Florida, and Connecticut.

    A June 2023 search warrant was executed at Carrillo’s home and led to the seizure of 10 pit bull-type dogs, most of which were later adopted by new owners, as well as a firearm and ammunition. Carrillo also possessed dog fighting paraphernalia including a bloodstained dog fighting box, a skin stapler, syringes, and injectable veterinary medications.

    “To its core, dog fighting is a cruel and criminal exploitation of animals for entertainment,” said Principal Deputy Assistant Attorney General Adam Gustafson of the Justice Department’s Environment and Natural Resources Division. “Today’s sentence sends a strong deterrent message that the Justice Department will vigorously prosecute these cases.”

    “Exploiting and endangering the welfare of animals for personal gain is cruel and abhorrent,” said Acting U.S. Attorney Sara C. Sweeney for the Middle District of Florida. “Because of the hard work of our law enforcement partners, justice was served.”

    “The Office of Inspector General is committed to working with all of our law enforcement and prosecutorial partners in pursuing individuals who choose to participate in animal fighting activities and engage in violations involving animal welfare, while also committing other serious offenses in our communities,” said Special Agent in Charge Charmeka Parker of the U.S. Department of Agriculture’s Office of Inspector General (USDA-OIG).

    To report animal fighting crimes, please contact your local law enforcement or the USDA-OIG’s complaint hotline at: usdaoig.oversight.gov/hotline or 1-800-424-9121.

    The USDA-OIG; Bureau of Alcohol, Tobacco, Firearms, and Explosives; Pasco County (Florida) Sheriff’s Office and the Fitchburg (Massachusetts) Police Department investigated the case. Assistance was provided by the U.S. Marshals Service, Massachusetts State Police, New Hampshire State Police, Animal Rescue League of Boston’s Law Enforcement Division, U.S. Coast Guard Investigative Service, Homeland Security Investigations and U.S. Customs and Border Protection.

    Senior Trial Attorney Matthew T. Morris of the Environment and Natural Resources Division’s Environmental Crimes Section and Assistant U.S. Attorneys Erin Favorit and Tiffany Fields for the Middle District of Florida prosecuted the case. Trial Attorney Caitlyn Cook of the Environment and Natural Resources Division’s Wildlife and Marine Resources Section assisted with the transfer of the seized dogs to new owners. 

    MIL OSI USA News

  • MIL-OSI Security: California Man Who Molested Teen on Flight Sentenced to Two Years in Prison

    Source: Federal Bureau of Investigation (FBI) State Crime News

    Seattle – A 42-year-old Los Angeles County, California man was sentenced today in U.S. District Court in Seattle to two years in prison for abusive sexual contact aboard an aircraft enroute to Seattle from Burbank, California, announced Acting U.S. Attorney Teal Luthy Miller. Justin Baker was arrested March 14, 2024, when the Alaska Airlines plane arrived at SEA.  Baker has been in custody since the jury returned its guilty verdict on October 23, 2024.  At sentencing U.S. District Judge John C. Coughenour imposed the maximum sentence allowed by law saying, “I was particularly struck by the candor of the victim and her bravery in testifying.”

    “This was a calculated and predatory sexual assault on an 18-year-old girl,” said Acting U.S. Attorney Miller. “Mr. Baker underestimated the victim’s strength in testifying, as well as the commitment we have in the Western District of Washington to hold these aircraft offenders accountable.”

    According to records filed in the case and testimony at trial, Baker was in the middle seat, with the victim seated to his right next to the wall of the plane. Baker learned the victim was preparing to go to college and was just 18 years old. According to testimony at trial, Baker showed the teen sexually explicit text messages he had on his phone and then draped his jacket over his lap as well as her lower body. The victim attempted to move away from Baker and closer to the wall. He reached under the jacket and groped her leg. Despite the victim saying “No” and moving away when he first tried to touch her, he continued to grope her genitals over her clothing. Then he reached into her top and groped her breast

    Ultimately, the victim got out of her seat to contact the flight crew. As she tried to pass by Baker, he groped her buttocks and pulled her back down into her seat. Ultimately the victim was able to leave and report the assault.

    Speaking in court today, Assistant United States Attorney Grace Zoller said Baker, “treated the victim like an object… He dehumanized her.”

    The victim shared how the assault has “shattered the trajectory of her life.” She told the court about anxiety around airports and flying, and how her family and loved ones “have watched me change in ways I have never imagined.” Her goal she said is to “hold Baker accountable.”

    Judge Coughenour said he was imposing the maximum two-year sentence because of the “seriousness of the crime, the harm to the victim and the danger (Baker) poses to the community.”

    When released from prison, Baker will be on five years of federal supervision and will be required to register as a sex offender.

    The case was investigated by the FBI and the Port of Seattle Police. The case was prosecuted by Assistant United States Attorneys Kristine Foerster and Grace Zoller.

    MIL Security OSI

  • MIL-OSI Security: Lowell Man Pleads Guilty to Trafficking Methamphetamine Pills

    Source: Office of United States Attorneys

    Defendant sold thousands of the counterfeit “Adderall” pills supplied by the Asian Boyz gang

    BOSTON – A Lowell man pleaded guilty on Feb. 14, 2025 to trafficking methamphetamine pills supplied by three fellow Asian Boyz gang associates.

    Bill Phim, a/k/a “Bonez,” 36, pleaded guilty to two counts of conspiracy to distribute and to possess with intent to distribute 500 grams and more of methamphetamine, and two counts of distribution of and possession with intent to distribute 50 grams and more of methamphetamine.  U.S. District Court Judge Nathaniel M. Gorton scheduled sentencing for May 14, 2025.

    A long-term investigation proved that Asian Boyz gang members and associates had access to a plentiful supply of homemade methamphetamine pills marketed as the pharmaceutical product, Adderall. These pills were similar in shape, size, and appearance to genuine Adderall. On 12 different dates in 2022, Phim sold these counterfeit “Adderall” pills to an undercover agent. In total, Phim sold the undercover agent over 10,000 pills for more than $36,000.

    Phim’s supplier for the first five pill deals with the undercover agent was Asian Boyz gang member, Erickson Dao. Between February and May 2022, Dao gave Phim the pills from his home in Lowell shortly before Phim was planning to meet the undercover agent for the sales.  After the deals, Phim either returned to Dao’s house to split the cash paid by the undercover agent, or he used an electronic payments service to send Dao his share of the drug proceeds.

    For the next five deals, Phim conspired with Asian Boyz gang associate, Brian Gingras, to source the pills. Between May 2022 and September 2022, Gingras met Phim prior to the planned deals with the undercover agent to deliver the pills personally. The investigation revealed that Gingras was stashing the pills in a nearby storage unit.  

    For the final two pill sales with the undercover agent, alleged Asian Boyz gang member Marcus Holder allegedly delivered pills to Phim in Lowell immediately before Phim met the undercover agent, on Sept. 30, 2022, and again on Oct. 18, 2022.  

    The charges of conspiracy to distribute and to possess with intent to distribute 500 grams and more of methamphetamine. The charges of distribution of and possession with intent to distribute 50 grams and more of methamphetamine provides for a sentence of at least five years and up to 40 years in prison, at least four years and up to life of supervised release and a fine of up to $5 million.

    In January 2025, both Gingras and Dao pleaded guilty. Gingras is scheduled to be sentenced on April 15, 2025. Dao is scheduled to be sentenced on May 13, 2025. Holder has pleaded not guilty and his case is pending trial.  
     
    U.S. Attorney Leah B. Foley, Jodi Cohen, Special Agent in Charge of the Federal Bureau of Investigation, Boston Division and Superintendent Gregory C. Hudon of the Lowell Police Department made the announcement. Valuable assistance was provided by the Massachusetts State Police and the Billerica, Haverhill, North Andover and Salem Police Departments. Assistant U.S. Attorney Fred M. Wyshak, III of the Organized Crime & Gang Unit is prosecuting the case.

    This case is part of Project Safe Neighborhoods (PSN), a program bringing together all levels of law enforcement and the communities they serve to reduce violent crime and gun violence, and to make our neighborhoods safer for everyone. On May 26, 2021, the Department launched a violent crime reduction strategy strengthening PSN based on these core principles: fostering trust and legitimacy in our communities, supporting community-based organizations that help prevent violence from occurring in the first place, setting focused and strategic enforcement priorities and measuring the results.

    This case is also part of an Organized Crime Drug Enforcement Task Forces (OCDETF) operation. OCDETF identifies, disrupts, and dismantles the highest-level criminal organizations that threaten the United States using a prosecutor-led, intelligence-driven, multi-agency approach. Additional information about the OCDETF Program can be found at https://www.justice.gov/OCDETF.

    The details contained in the charging documents are allegations. The remaining defendant in the case is presumed innocent unless and until proven guilty beyond a reasonable doubt in a court of law.
     

    MIL Security OSI

  • MIL-OSI Security: Florida Man Sentenced for Dog Fighting

    Source: United States Attorneys General 1

    Jose Miguel Carrillo, of Spring Hill, Florida, was sentenced yesterday to 84 months in prison after pleading guilty to conspiring to violate the dog fighting prohibitions of the federal Animal Welfare Act and being a felon in possession of a firearm.

    According to court filings, Carrillo conspired with others to purchase, acquire, and breed dogs for use in dog fights. Carillo also staged dog fights at his home and traveled to dog fights in Massachusetts, Florida, and Connecticut.

    A June 2023 search warrant was executed at Carrillo’s home and led to the seizure of 10 pit bull-type dogs, most of which were later adopted by new owners, as well as a firearm and ammunition. Carrillo also possessed dog fighting paraphernalia including a bloodstained dog fighting box, a skin stapler, syringes, and injectable veterinary medications.

    “To its core, dog fighting is a cruel and criminal exploitation of animals for entertainment,” said Principal Deputy Assistant Attorney General Adam Gustafson of the Justice Department’s Environment and Natural Resources Division. “Today’s sentence sends a strong deterrent message that the Justice Department will vigorously prosecute these cases.”

    “Exploiting and endangering the welfare of animals for personal gain is cruel and abhorrent,” said Acting U.S. Attorney Sara C. Sweeney for the Middle District of Florida. “Because of the hard work of our law enforcement partners, justice was served.”

    “The Office of Inspector General is committed to working with all of our law enforcement and prosecutorial partners in pursuing individuals who choose to participate in animal fighting activities and engage in violations involving animal welfare, while also committing other serious offenses in our communities,” said Special Agent in Charge Charmeka Parker of the U.S. Department of Agriculture’s Office of Inspector General (USDA-OIG).

    To report animal fighting crimes, please contact your local law enforcement or the USDA-OIG’s complaint hotline at: usdaoig.oversight.gov/hotline or 1-800-424-9121.

    The USDA-OIG; Bureau of Alcohol, Tobacco, Firearms, and Explosives; Pasco County (Florida) Sheriff’s Office and the Fitchburg (Massachusetts) Police Department investigated the case. Assistance was provided by the U.S. Marshals Service, Massachusetts State Police, New Hampshire State Police, Animal Rescue League of Boston’s Law Enforcement Division, U.S. Coast Guard Investigative Service, Homeland Security Investigations and U.S. Customs and Border Protection.

    Senior Trial Attorney Matthew T. Morris of the Environment and Natural Resources Division’s Environmental Crimes Section and Assistant U.S. Attorneys Erin Favorit and Tiffany Fields for the Middle District of Florida prosecuted the case. Trial Attorney Caitlyn Cook of the Environment and Natural Resources Division’s Wildlife and Marine Resources Section assisted with the transfer of the seized dogs to new owners. 

    MIL Security OSI

  • MIL-OSI Security: Security News: Florida Man Sentenced for Dog Fighting

    Source: United States Department of Justice 2

    Jose Miguel Carrillo, of Spring Hill, Florida, was sentenced yesterday to 84 months in prison after pleading guilty to conspiring to violate the dog fighting prohibitions of the federal Animal Welfare Act and being a felon in possession of a firearm.

    According to court filings, Carrillo conspired with others to purchase, acquire, and breed dogs for use in dog fights. Carillo also staged dog fights at his home and traveled to dog fights in Massachusetts, Florida, and Connecticut.

    A June 2023 search warrant was executed at Carrillo’s home and led to the seizure of 10 pit bull-type dogs, most of which were later adopted by new owners, as well as a firearm and ammunition. Carrillo also possessed dog fighting paraphernalia including a bloodstained dog fighting box, a skin stapler, syringes, and injectable veterinary medications.

    “To its core, dog fighting is a cruel and criminal exploitation of animals for entertainment,” said Principal Deputy Assistant Attorney General Adam Gustafson of the Justice Department’s Environment and Natural Resources Division. “Today’s sentence sends a strong deterrent message that the Justice Department will vigorously prosecute these cases.”

    “Exploiting and endangering the welfare of animals for personal gain is cruel and abhorrent,” said Acting U.S. Attorney Sara C. Sweeney for the Middle District of Florida. “Because of the hard work of our law enforcement partners, justice was served.”

    “The Office of Inspector General is committed to working with all of our law enforcement and prosecutorial partners in pursuing individuals who choose to participate in animal fighting activities and engage in violations involving animal welfare, while also committing other serious offenses in our communities,” said Special Agent in Charge Charmeka Parker of the U.S. Department of Agriculture’s Office of Inspector General (USDA-OIG).

    To report animal fighting crimes, please contact your local law enforcement or the USDA-OIG’s complaint hotline at: usdaoig.oversight.gov/hotline or 1-800-424-9121.

    The USDA-OIG; Bureau of Alcohol, Tobacco, Firearms, and Explosives; Pasco County (Florida) Sheriff’s Office and the Fitchburg (Massachusetts) Police Department investigated the case. Assistance was provided by the U.S. Marshals Service, Massachusetts State Police, New Hampshire State Police, Animal Rescue League of Boston’s Law Enforcement Division, U.S. Coast Guard Investigative Service, Homeland Security Investigations and U.S. Customs and Border Protection.

    Senior Trial Attorney Matthew T. Morris of the Environment and Natural Resources Division’s Environmental Crimes Section and Assistant U.S. Attorneys Erin Favorit and Tiffany Fields for the Middle District of Florida prosecuted the case. Trial Attorney Caitlyn Cook of the Environment and Natural Resources Division’s Wildlife and Marine Resources Section assisted with the transfer of the seized dogs to new owners. 

    MIL Security OSI

  • MIL-OSI Global: Traumatic brain injuries have toxic effects that last weeks after initial impact − an antioxidant material reduces this damage in mice

    Source: The Conversation – USA – By Aaron Priester, Postdoctoral Fellow in Materials Science and Engineering, Missouri University of Science and Technology

    Brain damage can release harmful chemicals such as free radicals that cause further damage. fatido/E+ via Getty Images

    Traumatic brain injury is a leading cause of death and disability in the world. Blunt force trauma to the brain, often from a bad fall or traffic accident, accounts for the deaths of over 61,000 Americans each year. Over 80,000 will develop some long-term disability.

    While much of the physical brain damage occurs instantly – called the primary stage of injury – additional brain damage can result from the destructive chemical processes that arise in the body minutes to days to weeks following initial impact. Unlike the primary stage of injury, this secondary stage could potentially be prevented by targeting the molecules driving damage.

    I am a materials science engineer, and my colleagues and I are working to design treatments to neutralize the harm of secondary traumatic brain injury and reduce neurodegeneration. We designed a new material that could target and neutralize brain-damaging molecules in mice, improving their cognitive recovery and offering a potential new treatment for people.

    Biochemical fallout

    The primary stage of traumatic brain injury can severely damage and even destroy the blood-brain barrier – an interface protecting the brain by limiting what can enter it.

    Disruption of this barrier triggers damaged neurons or the immune system to release certain chemicals that result in destructive biochemical processes. One process called excitotoxicity occurs when too many calcium ions are allowed into neurons, activating enzymes that fragment DNA and damage cells, causing death. Another process, neuroinflammation, results from the activation of cells called microglia that can trigger inflammation in damaged areas of the brain.

    Traumatic brain injury can result in long-term damage.
    stockdevil/iStock via Getty Images Plus

    These secondary phase processes also produce harmful molecules called reactive oxygen species. These molecules, which include free radicals, chemically modify and deform essential proteins in cells, rendering them useless. They can also break DNA strands, leading to potentially damaging genetic mutations.

    If left unchecked, harm from this oxidative stress can have devastating consequences for long-term health and neurocognitive recovery. Researchers have linked the biochemical changes and byproducts resulting from this cascade of damaging molecules to the development of long-term neurological disorders such as Alzheimer’s, Parkinson’s and ALS, among others.

    However, compounds called antioxidants can target this oxidative stress and improve long-term neurocognitive recovery by chemically interacting with reactive oxygen species in a way that can neutralize their damaging properties.

    Finding the ideal antioxidant

    My team and I studied whether an antioxidant called a thiol group could help treat traumatic brain injury.

    Thiol groups are chemical compounds that contain a sulfur atom bound to a hydrogen atom. Sulfur atoms are much larger than hydrogen atoms, which means the sulfur atom in a thiol has a strong pull on a hydrogen atom’s lone electron. This weakens the bond between the hydrogen and its electron, allowing the hydrogen to easily give up its electron to other atoms.

    As a result, thiols readily interact with many different reactive oxygen species, including the ones that damage DNA. We chose thiols not only for their antioxiant properties, but also for their ability to bind to and neutralize other brain-damaging molecules called lipid peroxidation products. These neurotoxic compounds are formed as byproducts when reactive oxygen species damage fats in the body.

    To get these thiols into the body, we incorporated them into materials called polymers. These are long chains of organic molecules made of individual units called monomers. To get the monomers to link together, a lone electron – or free radical – initiates a bond with a monomer, triggering a chain reaction. Think of this process like knocking down a series of dominoes: The push of your hand (the free radical in this instance) hits a domino (the monomer) and subsequently knocks down the rest of the dominoes to form a line (the polymer).

    Polymers are long chains of the same molecule, over and over again.

    Because thiols can inhibit this process of polymerization, we had to make a monomer with a so-called protecting group that can be chemically removed after polymerization to become our thiols. Since a-lipoic acid, a common supplement found in pharmacies, contains such a protecting thiol group, we used it to make our monomer.

    We then made a chain of these monomers with RAFT, a controlled process by which polymers can be designed to leave the body through the urine. To do this, a water-soluble co-monomer can be added into the chain, allowing the polymer to dissolve in the bloodstream.

    Finally, we treated the polymers to remove the protecting group, producing thiol polymers ready for further testing.

    Testing on TBI

    Next, we tested how well our thiol polymers neutralized reactive oxygen species.

    First, we used a technique called UV-visible spectrophotometry, which shines a laser into a cell sample containing both our polymer and brain-damaging molecules. If there are reactive oxygen species present in the sample, the light will be minimally absorbed. But if our polymer neutralizes these compounds, then the light will be heavily absorbed. Through these studies, we found that our thiol polymer neutralized reactive oxygen species such as hydrogen peroxide by as much as 50%, and other neurotoxic molecules such as acrolein by as much as 100%, thus protecting neurons from damage.

    We conducted additional tests by exposing fluorescent proteins to free radicals, finding that proteins that weren’t treated with our thiol polymers were destroyed. Proteins that were treated continued to be fluorescent, indicating that our thiol polymer neutralized the free radical and protected the protein.

    Lastly, we injected the thiol polymers into mice with traumatic brain injury. Brain scans showed that our polymer not only successfully concentrated in the damaged area of the brain but also provided immediate protection from further injury. Our thiol polymer was able to reduce reactive oxygen species in injured mice to just 3% over the normal levels found in uninjured mice. Untreated mice with traumatic brain injury had a 45% increase compared with uninjured mice.

    Future work on thiol polymers

    Our findings suggest that these thiol polymers may serve as a potential treatment for the secondary stage of traumatic brain injury. Further testing can help determine whether this material could potentially reduce the risk of long-term disability.

    We are currently developing a cheap process to incorporate thiols with tiny nanoparticles. This may help increase the number of thiols in the material while also improving its ability to circulate in the bloodstream for longer protection.

    Many additional studies in animals are needed to confirm the effectiveness of our material in treating traumatic brain injury. If our results continue to be positive, we aim to test the effectiveness of our material in people through clinical trials. We hope these treatments could improve the long-term outcomes for victims of car crashes, falls or even sport-related injuries to the brain.

    Aaron Priester received funding from the NIH.

    ref. Traumatic brain injuries have toxic effects that last weeks after initial impact − an antioxidant material reduces this damage in mice – https://theconversation.com/traumatic-brain-injuries-have-toxic-effects-that-last-weeks-after-initial-impact-an-antioxidant-material-reduces-this-damage-in-mice-247655

    MIL OSI – Global Reports