Category: Justice

MIL-OSI Canada: CBSA seizes 187.5 kg of cocaine at the Ambassador Bridge leading to criminal charges by the RCMP

Source: Government of Canada News (2)

July 22, 2025 Windsor, Ontario Canada Border Services Agency

On May 23, 2025, Canada Border Services Agency (CBSA) border services officers at the Ambassador Bridge port of entry intercepted 187.5 kg of suspected cocaine concealed in the trailer of a commercial truck coming into Canada from the United States.

During a secondary examination of the trailer, CBSA officers discovered 2 suitcases and 5 garbage bags containing 161 bricks of suspected cocaine. The approximate value of the cocaine is $23.4 million.

CBSA officers seized the drugs and arrested the driver, Kambiz Karandish, 55, of Richmond Hill, Ontario, and transferred him and the suspected cocaine to the custody of the Royal Canadian Mounted Police (RCMP). Karandish has been charged by the RCMP with Importation of Cocaine, and Possession of Cocaine for the Purpose of Trafficking under the Controlled Drugs and Substances Act.

The CBSA and the RCMP are committed to protecting our communities from harmful contraband and organized crime.

The investigation is ongoing.

MIL OSI Canada News –

July 23, 2025
MIL-OSI Asia-Pac: Hongkong Post cyberattack probed

Source: Hong Kong Information Services

Hongkong Post said today that Police have initiated investigation into an incident involving an unauthorised party cyberattacking the EC-Ship system with countless attempts at midnight on July 20 and the following day to access and retrieve information through the system’s address book function.

Hongkong Post has notified all affected account holders by email, reminding them to remain vigilant and immediately inform people in their address books of the incident.

The services concerned have resumed normal and account holders can continue to use the services, it added.

For enquiries, call 2921 2222.

MIL OSI Asia Pacific News –

July 23, 2025
MIL-OSI Europe: Eurojust helps catch alleged author of threatening emails to schools in Czechia, Slovakia and Latvia
Source: European Union 2

Eurojust has assisted the authorities in the Czech Republic, Slovakia and Latvia with the apprehension of the alleged perpetrator who was responsible for sending thousands of emails in September last year threatening schools with explosions. The mass threats, which were also sent to other educational institutions and leisure centres, caused major public concern and led to the suspension of classes at the beginning of the school year.

Eurojust supported the national authorities involved by setting up a joint investigation team (JIT) dedicated to the case, as well as providing additional cross-border judicial support.
The alleged perpetrator also used the social network Telegram to spread his threats. He was apprehended in the Ukrainian city of Dnipro last week but was released pending potential further steps to be taken by the authorities.

© Dnipropetrovsk Regional Prosecutor’s Office

Given the mass scale of the threats at the same time across three countries, the police authorities involved coordinated their investigations, assisted by the setting up of the JIT. The joint investigative efforts, using the cybercrime expertise of the police, led to the identification of an alleged perpetrator, operating from the Ukrainian city of Dnipro.

With the participation of Czech and Slovak police officers, a joint action took place in Dnipro last week, during which the alleged perpetrator was apprehended and one individual was questioned. Furthermore, two locations were searched, which led to the seizure of computer equipment.

Thanks to the good and close cooperation of all the authorities concerned, the operation was successfully carried out under extremely difficult circumstances, very close to the frontline of the war in Ukraine, with Ukrainian, Czech and Slovak officers exposed to heavy risks.

Eurojust offered support not only through the establishment of the JIT but also by organising a coordination meeting to prepare for the joint action day in Ukraine. The operation was carried out at the request of and by the following authorities:

Czech Republic: High Public Prosecutor’s Office in Prague; National Counterterrorism, Extremism and Cybercrime Agency (NCTEKK)

Latvia: Rīga Pārdaugava Prosecution Office; 1st Unit of Cybercrime Enforcement Department of the Central Criminal Police Department of the State Police

Slovakia: General Prosecutor´s Office of the Slovak Republic; Police Department West, Anti-Crime Unit, Bureau for Combating Organized Crime of the Presidium of the Police Corps (Police ACU); Counter Terrorism Centre, Presidium of the Police Corps

Ukraine: Dnipropetrovsk regional Prosecutor’s Office; Main Department of National Police in Dnipropetrovsk region; Division for Combating Cybercrime in Dnipropetrovsk region of the Cyber Police Department of National Police of Ukraine
MIL OSI Europe News –
July 23, 2025
MIL-OSI United Kingdom: New Forensic Science Regulator appointed for England and Wales
Source: United Kingdom – Government Statements

News story

New Forensic Science Regulator appointed for England and Wales

The regulator ensures that the highest standards in forensic science are met across the criminal justice system.
Dr Marc Bailey has been appointed as the Forensic Science Regulator for England and Wales.

Dr Bailey is a scientist who has significant regulatory experience. He has held multiple roles within the Medicines and Healthcare products Regulatory Agency (MHRA) and led international research in quality systems and standardisation, including whilst working at the National Physical Laboratory.

The Forensic Science Regulator is responsible for ensuring that the provision of forensic science services across England and Wales meet the highest standards of quality and integrity. This includes assessing compliance, providing advice to ministers, setting quality standards and ensuring that all forensic science providers adhere to these standards.

Dr Bailey will work closely with the police, forensic science providers and the legal profession to ensure that forensic science in England and Wales remains at the forefront of innovation and reliability.

Dr Bailey will officially assume his duties after Gary Pugh’s term concludes on 25 July 2025.

Crime and Policing Minister Dame Diana Johnson said:

Dr Bailey is going to bring a wealth of experience and expertise as the new Forensic Science Regulator.

This pivotal role is essential in ensuring the highest standards of forensic science are upheld.

By setting rigorous standards and providing robust oversight, the Forensic Science Regulator will continue to ensure that forensic science supports the work of the police, allowing them to investigate crimes and bring justice for victims.

I’d like to thank Gary Pugh for his previous work in this role.

Dr Bailey said:

I am delighted to be appointed to the post of Forensic Science Regulator.

I look forward to enacting and developing the regulation of Forensic Science and working with the team that support my role to ensure that the criminal justice system has full confidence in forensic science evidence.

Share this page

The following links open in a new tab

Share on Facebook (opens in new tab)

Share on Twitter (opens in new tab)

Updates to this page

Published 22 July 2025
MIL OSI United Kingdom –
July 23, 2025
MIL-OSI United Nations: Secretary-General’s remarks to the Security Council – on Multilateralism and Peaceful Settlement of Disputes [bilingual as delivered; scroll down for all-English and all-French versions]

Source: United Nations secretary general

Mr. President, Excellencies,

I want to thank Deputy Prime Minister and Foreign Minister Ishaq Dar and Pakistan for convening today’s open debate.

The topic of today’s debate shines a light on the clear connection between international peace and multilateralism.

Eighty years ago, the United Nations was founded with a primary purpose — to safeguard humanity from the scourge of war.

The architects of the United Nations Charter recognized that the peaceful resolution of disputes is the lifeline when geopolitical tensions escalate… when unresolved disputes fuel the flames of conflict…and when states lose trust in each other.

The Charter lays out a number of important tools to forge peace.

Article 2.3 of the UN Charter is clear:

“All Members shall settle their international disputes by peaceful means in such a manner that international peace and security, and justice, are not endangered.”

Chapter VI of the Charter is equally clear on the specific responsibilities of this Council to help ensure the pacific settlement of disputes “by negotiation, enquiry, mediation, conciliation, arbitration, judicial settlement, resort to regional agencies or arrangements, or other peaceful means of their own choice.”

Action 16 of the Pact of the Future calls on Member States to recommit to all the mechanisms of preventive diplomacy and the peaceful settlement of disputes.

I commend Pakistan for utilizing its presidency to put forward a resolution urging all Member States to make full use of these tools in our collective pursuit of global peace.

This is needed now more than ever.

Around the world, we see an utter disregard for — if not outright violations of — international law — including international human rights law, international refugee law, international humanitarian law, and the UN Charter itself, without any accountability.

These failures to uphold international obligations are coming at a time of widening geopolitical divides and conflicts.

And the cost is staggering — measured in human lives, shattered communities, and lost futures.

We need look no further than the horror show in Gaza — with a level of death and destruction without parallel in recent times.

Malnourishment is soaring. Starvation is knocking on every door.

And now we are seeing the last gasp of a humanitarian system built on humanitarian principles.

That system is being denied the conditions to function. Denied the space to deliver. Denied the safety to save lives.

With Israeli military operations intensifying and new displacement orders issued in Deir al-Balah, devastation is being layered upon devastation.

I am appalled that UN premises have been struck – among them facilities of the UN Office for Project Services and the World Health Organization, including WHO’s main warehouse.

This is despite all parties having been informed of the locations of these UN facilities.

These premises are inviolable and must be protected under international humanitarian law – without exception.

From Gaza to Ukraine, from the Sahel to Sudan, Haiti and Myanmar, and many other parts of the world, conflict is raging, international law is being trampled, and hunger and displacement are at record levels.

And terrorism, violent extremism and transnational crime remain persistent scourges pushing security further out of reach.

Diplomacy may not have always succeeded in preventing conflicts, violence and instability.

But it still holds the power to stop them.

Mr. President,

Peace is a choice.

And the world expects the UN Security Council to help countries make this choice.

This Council is at the centre of the global architecture for peace and security.

Its creation reflected a central truth.

Competition between states is a geopolitical reality.

But cooperation — anchored in shared interests and the greater good — is the sustainable pathway to peace.

Too often, we see divisions, entrenched positions and escalatory discourse blocking solutions and the effectiveness of the Council.

But we have also seen some inspiring examples of finding common ground and forging solutions to global problems.

For example, today marks three years since the signing of the Black Sea Initiative and the Memorandum of Understanding with the Russian Federation — efforts that show what we can achieve through mediation and the good offices of the United Nations, even during the most challenging moments.

And we’ve seen many other recent examples.

From the Sevilla Conference on Financing for Development, to the Oceans Conference in Nice, to the Agreement on Marine Biological Diversity of Areas Beyond National Jurisdiction and the Cybercrime Treaty, to the Pact for the Future adopted last year.

The Pact, in particular, demonstrates a clear re-commitment by the world to strengthen the United Nations collective security system.

Drawing from the New Agenda for Peace, it prioritizes preventive diplomacy and mediation — all areas where this Council can play a vital role.

As we look to the theme of today’s debate, I see three areas where we can live up to the Pact’s call to renew our commitment to — and the world’s faith in — the multilateral problem-solving architecture.

First — this Council’s members, in particular its permanent members, must continue working to overcome divisions.

The majority of situations on the Security Council’s agenda are complex and resist quick fixes.
But even in the darkest days of the Cold War, the collective dialogue and decision-making in this Council underpinned a common and effective system of global security.

One that successfully deployed a range of peacekeeping missions.

One that opened the door for vital humanitarian aid to flow to people in need.

And one that helped prevent a Third World War.

I urge you to summon this same spirit by keeping channels open, continuing to listen in good faith, and working to overcome differences and building consensus.

We must also work to ensure that this Council reflects the world of today, not the world of 80 years ago.

This Council should be made more representative of today’s geopolitical realities.

And we must continue improving the working methods of this Council to make it more inclusive, transparent, efficient and accountable.

I urge you to continue building consensus to move the intergovernmental negotiations forward.

Second — this Council must continue strengthening cooperation with regional and subregional partners.

The landmark adoption of Security Council Resolution 2719 supporting African Union-led peace support operations through assessed contributions is a good example of how we can join efforts with regional organizations to support more effective responses.

I also commend this Council’s steps to strengthen and re-build regional security frameworks to encourage dialogue and advance the peaceful settlement of disputes.

Troisièmement, les États Membres doivent honorer leurs obligations en vertu du droit international, y compris la Charte des Nations Unies, le droit international des droits humains et le droit international humanitaire.

Le Pacte pour l’avenir appelle tous les États Membres à respecter leurs engagements envers la Charte, ainsi que les principes de respect de la souveraineté, de l’intégrité territoriale et de l’indépendance politique des États.

Tous ces principes sont ancrés dans le droit international et reposent sur l’engagement de donner la priorité à la prévention des conflits et au règlement pacifique des différends par le dialogue et la diplomatie.

Le Pacte reconnaît également la contribution essentielle de la Cour internationale de Justice, qui fêtera son 80ème anniversaire l’année prochaine.

Monsieur le Président,

À l’occasion du 80ème anniversaire de notre Organisation et de la Charte qui lui a donné vie et forme, nous devons renouveler notre engagement envers l’esprit multilatéral de la paix par la diplomatie.

Je me réjouis de travailler avec vous en ce sens, afin de parvenir à la paix et la sécurité internationales que les peuples du monde entier espèrent et méritent.

Je vous remercie.

[all-English]

Mr. President, Excellencies,

I want to thank Deputy Prime Minister and Foreign Minister Ishaq Dar and Pakistan for convening today’s open debate.

The topic of today’s debate shines a light on the clear connection between international peace and multilateralism.

Eighty years ago, the United Nations was founded with a primary purpose — to safeguard humanity from the scourge of war.

The architects of the United Nations Charter recognized that the peaceful resolution of disputes is the lifeline when geopolitical tensions escalate… when unresolved disputes fuel the flames of conflict…and when states lose trust in each other.

The Charter lays out a number of important tools to forge peace.

Article 2.3 of the UN Charter is clear:

“All Members shall settle their international disputes by peaceful means in such a manner that international peace and security, and justice, are not endangered.”

Chapter VI of the Charter is equally clear on the specific responsibilities of this Council to help ensure the pacific settlement of disputes “by negotiation, enquiry, mediation, conciliation, arbitration, judicial settlement, resort to regional agencies or arrangements, or other peaceful means of their own choice.”

Action 16 of the Pact of the Future calls on Member States to recommit to all the mechanisms of preventive diplomacy and the peaceful settlement of disputes.

I commend Pakistan for utilizing its presidency to put forward a resolution urging all Member States to make full use of these tools in our collective pursuit of global peace.

This is needed now more than ever.

Around the world, we see an utter disregard for — if not outright violations of — international law — including international human rights law, international refugee law, international humanitarian law, and the UN Charter itself, without any accountability.

These failures to uphold international obligations are coming at a time of widening geopolitical divides and conflicts.

And the cost is staggering — measured in human lives, shattered communities, and lost futures.

We need look no further than the horror show in Gaza — with a level of death and destruction without parallel in recent times.

Malnourishment is soaring. Starvation is knocking on every door.

And now we are seeing the last gasp of a humanitarian system built on humanitarian principles.

That system is being denied the conditions to function. Denied the space to deliver. Denied the safety to save lives.

With Israeli military operations intensifying and new displacement orders issued in Deir al-Balah, devastation is being layered upon devastation.

I am appalled that UN premises have been struck – among them facilities of the UN Office for Project Services and the World Health Organization, including WHO’s main warehouse.

This is despite all parties having been informed of the locations of these UN facilities.

These premises are inviolable and must be protected under international humanitarian law – without exception.

From Gaza to Ukraine, from the Sahel to Sudan, Haiti and Myanmar, and many other parts of the world, conflict is raging, international law is being trampled, and hunger and displacement are at record levels.

And terrorism, violent extremism and transnational crime remain persistent scourges pushing security further out of reach.
Diplomacy may not have always succeeded in preventing conflicts, violence and instability.

But it still holds the power to stop them.

Mr. President,

Peace is a choice.

And the world expects the UN Security Council to help countries make this choice.

This Council is at the centre of the global architecture for peace and security.

Its creation reflected a central truth.
Competition between states is a geopolitical reality.

But cooperation — anchored in shared interests and the greater good — is the sustainable pathway to peace.

Too often, we see divisions, entrenched positions and escalatory discourse blocking solutions and the effectiveness of the Council.

But we have also seen some inspiring examples of finding common ground and forging solutions to global problems.

For example, today marks three years since the signing of the Black Sea Initiative and the Memorandum of Understanding with the Russian Federation — efforts that show what we can achieve through mediation and the good offices of the United Nations, even during the most challenging moments.

And we’ve seen many other recent examples.

From the Sevilla Conference on Financing for Development, to the Oceans Conference in Nice, to the Agreement on Marine Biological Diversity of Areas Beyond National Jurisdiction and the Cybercrime Treaty, to the Pact for the Future adopted last year.

The Pact, in particular, demonstrates a clear re-commitment by the world to strengthen the United Nations collective security system.

Drawing from the New Agenda for Peace, it prioritizes preventive diplomacy and mediation — all areas where this Council can play a vital role.

As we look to the theme of today’s debate, I see three areas where we can live up to the Pact’s call to renew our commitment to — and the world’s faith in — the multilateral problem-solving architecture.

First — this Council’s members, in particular its permanent members, must continue working to overcome divisions.

The majority of situations on the Security Council’s agenda are complex and resist quick fixes.

But even in the darkest days of the Cold War, the collective dialogue and decision-making in this Council underpinned a common and effective system of global security.

One that successfully deployed a range of peacekeeping missions.

One that opened the door for vital humanitarian aid to flow to people in need.

And one that helped prevent a Third World War.

I urge you to summon this same spirit by keeping channels open, continuing to listen in good faith, and working to overcome differences and building consensus.

We must also work to ensure that this Council reflects the world of today, not the world of 80 years ago.

This Council should be made more representative of today’s geopolitical realities.

And we must continue improving the working methods of this Council to make it more inclusive, transparent, efficient and accountable.

I urge you to continue building consensus to move the intergovernmental negotiations forward.

Second — this Council must continue strengthening cooperation with regional and subregional partners.

The landmark adoption of Security Council Resolution 2719 supporting African Union-led peace support operations through assessed contributions is a good example of how we can join efforts with regional organizations to support more effective responses.

I also commend this Council’s steps to strengthen and re-build regional security frameworks to encourage dialogue and advance the peaceful settlement of disputes.

And third — Member States must honour their obligations under international law, including the UN Charter, international human rights law and international humanitarian law.

The Pact for the Future calls on all Member States to live up to their commitments in the UN Charter, and the principles of respect for sovereignty, territorial integrity and the political independence of states.

All grounded in international law, and a commitment to prioritizing prevention of conflict and the peaceful settlement of disputes through dialogue and diplomacy.

The Pact also recognized the critical contribution of the International Court of Justice, which celebrates its 80th anniversary next year.

Mr. President,

As we mark the 80th anniversary of our organization and the Charter that gave it life and shape, we need to renew our commitment to the multilateral spirit of peace through diplomacy.

I look forward to working with you in this important effort, to achieve the international peace and security the people of the world need and deserve.

Thank you.

[all-French]

Monsieur le Président, Excellences,

Je tiens à remercier le Vice-Premier Ministre et Ministre des affaires étrangères Ishaq Dar et le Pakistan d’avoir organisé le débat public de ce jour.

Le thème de ce débat met en lumière le lien évident qui existe entre la paix internationale et le multilatéralisme.

Il y a 80 ans, l’Organisation des Nations Unies a été fondée dans le but premier de préserver l’humanité du fléau de la guerre.

Les architectes de la Charte des Nations Unies ont considéré que le règlement pacifique des différends était la seule issue possible lorsque les tensions géopolitiques s’intensifiaient, lorsque des différends non résolus attisaient les conflits et lorsque les États perdaient confiance les uns dans les autres.

La Charte renferme un certain nombre d’outils majeurs destinés à forger la paix.

Son Article 2.3 est clair :

« Les Membres de l’Organisation règlent leurs différends internationaux par des moyens pacifiques, de telle manière que la paix et la sécurité internationales ainsi que la justice ne soient pas mises en danger ».

Son Chapitre VI est tout aussi clair en ce qui concerne les responsabilités confiées au Conseil de sécurité, qui doit contribuer à assurer le règlement pacifique des différends « par voie de négociation, d’enquête, de médiation, de conciliation, d’arbitrage, de règlement judiciaire, de recours aux organismes ou accords régionaux, ou par d’autres moyens pacifiques » du choix des parties.

La mesure 16 du Pacte pour l’avenir appelle les États Membres à démontrer leur attachement à la diplomatie préventive et au règlement pacifique des différends en recourant davantage à tous les mécanismes existants en la matière.

Je félicite le Pakistan d’avoir mis à profit sa présidence pour présenter une résolution exhortant tous les États Membres à utiliser pleinement les outils en question dans le cadre de notre quête collective de la paix dans le monde.

Nous en avons besoin plus que jamais.

Partout dans le monde, nous observons un mépris total pour le droit international – voire des violations pures et simples de ce droit, notamment du droit international des droits humains, du droit international des réfugiés, du droit international humanitaire et de la Charte des Nations Unies elle-même –, sans que la responsabilité de quiconque ne soit engagée.

Ces manquements aux obligations internationales surviennent à un moment où les divisions et les conflits géopolitiques s’aggravent.

Et le coût – en vies humaines, en communautés brisées et en avenirs perdus – est accablant.

Il suffit de regarder l’horreur qui se déroule à Gaza, avec un niveau de mort et de destruction sans équivalent dans l’histoire récente.

La malnutrition explose. La famine frappe à toutes les portes.

Et maintenant, nous assistons à l’agonie d’un système humanitaire fondé sur des principes humanitaires.

Ce système se voit refuser les conditions nécessaires à son fonctionnement. On lui refuse l’espace nécessaire pour agir. On lui refuse la sécurité nécessaire pour sauver des vies.

Alors que les opérations militaires israéliennes s’intensifient et que de nouveaux ordres de déplacement sont émis à Deir al-Balah, la dévastation s’ajoute à la dévastation.

Je suis consterné que des locaux de l’ONU aient été touchés, notamment ceux du Bureau des Nations Unies pour les services d’appui aux projets et de l’Organisation mondiale de la Santé, y compris son entrepôt principal.

Ceci alors que toutes les parties ont été informées de l’emplacement de ces installations de l’ONU.

Ces locaux sont inviolables et doivent être protégés par le droit international humanitaire, sans exception.

De Gaza à l’Ukraine, du Sahel au Soudan, de Haïti au Myanmar, et dans bien d’autres régions du monde, les conflits font rage, le droit international est bafoué, et la faim et les déplacements atteignent des niveaux record.

Et le terrorisme, l’extrémisme violent et la criminalité transnationale restent des fléaux tenaces qui rendent la sécurité encore plus inaccessible.

La diplomatie ne permet pas toujours de prévenir les conflits, la violence et l’instabilité.

Mais elle a toujours le pouvoir de les arrêter.

Monsieur le Président,

La paix est un choix.

Et le monde attend du Conseil de sécurité de l’Organisation qu’il aide les pays à faire ce choix.

Ce Conseil est au cœur de l’architecture mondiale pour la paix et la sécurité.

Sa création reposait sur une vérité fondamentale.

La rivalité entre les États est une réalité géopolitique.

Mais la coopération – ancrée dans des intérêts partagés et le bien commun – représente la voie durable vers la paix.

Nous observons trop fréquemment que les divisions, les positions tranchées et la surenchère verbale bloquent la mise en place de solutions et sape l’efficacité de ce Conseil.

Mais nous avons également observé des exemples admirables de cas où il a été possible de trouver un terrain d’entente et des solutions aux problèmes mondiaux.

Ainsi, nous marquons aujourd’hui le troisième anniversaire de la signature de l’Initiative de la mer Noire et du mémorandum d’accord avec la Fédération de Russie – des mesures qui montrent ce que nous pouvons accomplir grâce à la médiation et aux bons offices de l’ONU, y compris dans les moments les plus difficiles.

Et plus récemment, nous avons été témoins de bien d’autres exemples.

De la Conférence de Séville sur le financement du développement à la Conférence de Nice sur l’océan, en passant par l’Accord sur la diversité biologique marine des zones ne relevant pas de la juridiction nationale, la Convention sur la cybercriminalité et le Pacte pour l’avenir, adopté l’année dernière.

Le Pacte, en particulier, témoigne d’une claire volonté du monde de s’engager de nouveau à renforcer le système de sécurité collective des Nations Unies.

Inspiré du Nouvel Agenda pour la paix, il donne la priorité à la diplomatie préventive et à la médiation, autant de domaines dans lesquels le Conseil peut jouer un rôle essentiel.

En ce qui concerne le thème du débat qui nous réunit aujourd’hui, il y a selon moi trois domaines dans lesquels nous pouvons nous montrer à la hauteur de l’appel, contenu dans le Pacte, à renouveler notre engagement – et la confiance du monde – envers l’architecture multilatérale dont nous disposons pour régler les problèmes.

Premièrement, les membres de ce Conseil, en particulier les membres permanents, doivent continuer à s’efforcer de surmonter les dissensions.

La majorité des situations inscrites à l’ordre du jour du Conseil de sécurité sont complexes et ne se prêtent pas à des solutions rapides.

Mais même dans les jours les plus sombres de la guerre froide, le dialogue et la prise de décision collective au sein de ce Conseil ont permis de maintenir un système de la sécurité mondiale commun et efficace.

Un système qui a déployé avec succès toute une série de missions de maintien de la paix.

Un système qui a ouvert la voie à l’acheminement d’une aide humanitaire vitale aux personnes dans le besoin.

Et un système qui a permis d’éviter une troisième guerre mondiale.

Je vous exhorte à adopter le même état d’esprit en maintenant la communication, en continuant d’écouter de bonne foi, en vous employant à surmonter les divergences et à rechercher le consensus.

Nous devons également veiller à ce que ce Conseil soit à l’image du monde d’aujourd’hui, et non de celui d’il y a 80 ans.

Ce Conseil devrait être plus représentatif des réalités géopolitiques actuelles.

Et nous devons continuer de perfectionner ses méthodes de travail afin de le rendre plus inclusif, plus transparent, plus efficace, et plus responsable.

Je vous demande instamment de continuer d’œuvrer à la recherche du consensus pour faire avancer les négociations intergouvernementales.

Deuxièmement, ce Conseil doit continuer de renforcer la coopération avec les partenaires régionaux et sous-régionaux.

L’adoption historique de la résolution 2719 du Conseil de sécurité, visant à financer les opérations d’appui à la paix menées par l’Union africaine au moyen de contributions statutaires, est un bon exemple de la manière dont nous pouvons unir nos forces à celles des organisations régionales pour favoriser la mise en place de mesures plus efficaces.

Je salue également les mesures prises par ce Conseil pour renforcer et rebâtir les cadres de sécurité régionaux afin d’encourager le dialogue et de favoriser le règlement pacifique des différends.

Troisièmement, les États Membres doivent honorer leurs obligations en vertu du droit international, y compris la Charte des Nations Unies, le droit international des droits humains et le droit international humanitaire.

Le Pacte pour l’avenir appelle tous les États Membres à respecter leurs engagements envers la Charte, ainsi que les principes de respect de la souveraineté, de l’intégrité territoriale et de l’indépendance politique des États.

Tous ces principes sont ancrés dans le droit international et reposent sur l’engagement de donner la priorité à la prévention des conflits et au règlement pacifique des différends par le dialogue et la diplomatie.

Le Pacte reconnaît également la contribution essentielle de la Cour internationale de Justice, qui fêtera son 80ème anniversaire l’année prochaine.

Monsieur le Président,

À l’occasion du 80ème anniversaire de notre Organisation et de la Charte qui lui a donné vie et forme, nous devons renouveler notre engagement envers l’esprit multilatéral de la paix par la diplomatie.

Je me réjouis de travailler avec vous en ce sens, afin de parvenir à la paix et la sécurité internationales que les peuples du monde entier espèrent et méritent.

Je vous remercie.

MIL OSI United Nations News –

July 23, 2025

MIL-OSI Security: #StopRansomware: Interlock

Source: US Department of Homeland Security

Summary

Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Department of Health and Human Services (HHS), and Multi-State Information Sharing and Analysis Center (MS-ISAC)—hereafter referred to as “the authoring organizations”—are releasing this joint advisory to disseminate known Interlock ransomware IOCs and TTPs identified through FBI investigations (as recently as June 2025) and trusted third-party reporting.

The Interlock ransomware variant was first observed in late September 2024, targeting various business, critical infrastructure, and other organizations in North America and Europe. FBI maintains these actors target their victims based on opportunity, and their activity is financially motivated. FBI is aware of Interlock ransomware encryptors designed for both Windows and Linux operating systems; these encryptors have been observed encrypting virtual machines (VMs) across both operating systems. FBI observed actors obtaining initial access via drive-by download from compromised legitimate websites, which is an uncommon method among ransomware groups. Actors were also observed using the ClickFix social engineering technique for initial access, in which victims are tricked into executing a malicious payload under the guise of fixing an issue on the victim’s system. Actors then use various methods for discovery, credential access, and lateral movement to spread to other systems on the network.

Interlock actors employ a double extortion model in which actors encrypt systems after exfiltrating data, which increases pressure on victims to pay the ransom to both get their data decrypted and prevent it from being leaked.

FBI, CISA, HHS, and MS-ISAC encourage organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of Interlock ransomware incidents.

Download the PDF version of this report:

For a downloadable copy of IOCs, see:

Note: This advisory uses the MITRE ATT&CK® Matrix for Enterprise framework, version 17. See the MITRE ATT&CK Tactics and Techniques section of this advisory for tables mapped to the threat actors’ activity.

Overview

Since September 2024, Interlock ransomware actors have impacted a wide range of businesses and critical infrastructure sectors in North America and Europe. These actors are opportunistic and financially motivated in nature and employ tactics to infiltrate and disrupt the victim’s ability to provide their essential services.

Interlock actors leverage a double extortion model, in which they both encrypt and exfiltrate victim data. Ransom notes do not include an initial ransom demand or payment instructions; instead, victims are provided with a unique code and are instructed to contact the ransomware group via a .onion URL through the Tor browser. To date, Interlock actors have been observed encrypting VMs, leaving hosts, workstations, and physical servers unaffected; however, this does not mean they will not expand to these systems in the future. To counter Interlock actors’ threat to VMs, enterprise defenders should implement robust endpoint detection and response (EDR) tooling and capabilities.

The authoring agencies are aware of emerging open-source reporting detailing similarities between the Rhysida and Interlock ransomware variants.¹ For additional information on Rhysida ransomware, see the joint advisory, #StopRansomware: Rhy sida Ransomware .

Initial Access

FBI has observed Interlock actors obtaining initial access [TA0001] via drive-by download [T1189] from compromised legitimate websites, an atypical method for ransomware actors. Interlock ransomware methods for initial access have previously disguised malicious payloads as fake Google Chrome or Microsoft Edge browser updates, though a cybersecurity company recently reported a shift to payload filenames masquerading as updates for common security software (see Table 5 for a list of filenames).²

In some instances, FBI has observed Interlock actors using the ClickFix social engineering technique, in which unsuspecting users are prompted to execute a malicious payload by clicking a fake Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA) [T1189]. The CAPTCHA contains instructions for users to open the Windows Run window, paste the clipboard contents, and then execute a malicious Base64-encoded PowerShell process [T1204.004].³

Note: This ClickFix technique has been used in several other malware campaigns, including Lumma Stealer and DarkGate.⁴

Execution and Persistence

Based on FBI investigations, the fake Google Chrome browser executable functions as a remote access trojan (RAT) [T1105] designed to execute a PowerShell script [T1059.001] that drops a file into the Windows Startup folder. From there, the file is designed to run the RAT every time the victim logs in [T1547.001], establishing persistence [TA0003].

FBI also observed instances in which Interlock actors executed a PowerShell command designed to establish persistence via a Windows Registry key modification [T1547.001]. To do so, Interlock actors used a PowerShell command [T1059.001] designed to add a run key value named “Chrome Updater” [T1036.005] that uses a specific log file as an argument upon user login.

Reconnaissance

To facilitate reconnaissance, a PowerShell script executes a series of commands [T1059.001] designed to gather information on victim machines (see Table 1).

Table 1. PowerShell Commands for Reconnaissance
PowerShell Command	Description
WindowsIdentity.GetCurrent()	Returns a WindowsIdentity object that represents the current Windows user [T1033].
systeminfo	Displays detailed configuration information [T1082] about a computer and its operating system, including operating system configuration, security information, product ID, and hardware properties.
tasklist/svc	Lists unabridged service information [T1007] for each process currently running on the local computer.
Get-Service	Gets objects that represent the services [T1007] on a computer, including running and stopped services.
Get-PSDrive	Gets the drives [T1082] in the current session, such as: Windows logical drives on the computer, including drives mapped to network shares. Drives exposed by PowerShell providers. Session-specified temporary drives and persistent mapped network drives.
arp -a	Displays and modifies entries in the Address Resolution Protocol (ARP) cache table [T1016], which contains entries on the IPv4 and IPv6 addresses on host endpoints.

Command and Control

FBI observed Interlock actors using command and control (C2) [TA0011] applications like Cobalt Strike and SystemBC. Interlock actors also used Interlock RAT⁵ and NodeSnake RAT (as of March 2025)⁶ for C2 and executing commands.

Credential Access, Lateral Movement, and Privilege Escalation

FBI observed that once Interlock actors establish remote control of a compromised system, they use a series of PowerShell commands to download a credential stealer (cht.exe) [TA0006] and keylogger binary (klg.dll) [T1056.001],[T1105]. According to open source reporting, the credential stealer collects login information and associated URLs for victims’ online accounts [T1555.003], while the keylogger dynamic link library (DLL) logs users’ keystrokes in a file named conhost.txt [T1036.005].⁷ As of February 2025, private cybersecurity analysts also observed Interlock ransomware infections executing different versions of information stealers [TA0006], including Lumma Stealer⁸ and Berserk Stealer, to harvest credentials for lateral movement and privilege escalation [T1078].⁹

Interlock actors leverage compromised credentials and Remote Desktop Protocol (RDP)¹⁰ [T1021.001] to move between systems. They also use tools like AnyDesk to enable remote connectivity and PuTTY to assist with lateral movement [T1219].¹¹ In addition to stealing users’ online credentials, Interlock actors have compromised domain administrator accounts (possibly by using a Kerberoasting attack [T1558.003])¹² to gain additional privileges [T1078.002].

Collection and Exfiltration

Interlock actors leverage Azure Storage Explorer (StorageExplorer.exe) to navigate victims’ Microsoft Azure Storage accounts [T1530] prior to exfiltrating data. According to open source reporting, Interlock actors execute AzCopy to exfiltrate data by uploading it to the Azure storage blob [T1567.002].¹³ Interlock actors also exfiltrate data over file transfer tools, including WinSCP [T1048].

Impact

Following data exfiltration, Interlock actors deploy the encryption binary as a 64-bit executable named conhost.exe [T1486],[T1036.005]. FBI has observed Interlock ransomware encryptors for both Windows and Linux operating systems. Encryptors are designed to encrypt files using a combined Advanced Encryption Standard (AES) and Rivest-Shamir-Adleman (RSA) algorithm. In addition, cybersecurity researchers have identified Interlock ransomware samples using a FreeBSD ELF encryptor [T1486], a departure from usual Linux encryptors designed for VMware ESXi servers and VMs.¹⁴

A cybersecurity company identified a DLL binary named tmp41.wasd—executed after encryption using rundll32.exe [T1218.011]—which uses the remove() function to delete the encryption binary [T1070.004];¹⁵ on Linux machines, the encryptor uses a similar technique to execute the removeme function.

Encrypted files are appended with either a .interlock or .1nt3rlock file extension, alongside a ransom note titled !__README__!.txt delivered via group policy object (GPO). Interlock actors use a double-extortion model [T1657], encrypting systems after exfiltrating data. The ransom note provides each victim with a unique code and instructions to contact the ransomware actors via a .onion URL.

Interlock actors do not leave an initial ransom demand or payment instructions on compromised networks, and do not relay this information until contacted by the victim. The actors instruct victims to make ransom payments in Bitcoin to cryptocurrency wallet addresses provided by the actors. The actors threaten to publish the victim’s exfiltrated data to their leak site on the Tor network unless the victim pays the ransom demand; the actors have previously followed through on this threat.¹⁶

See Table 2 for publicly available tools and applications used by Interlock ransomware actors. This includes legitimate tools repurposed for their operations.

Disclaimer: Use of these tools and applications should not be attributed as malicious without analytical evidence to support threat actor use and/or control.

Table 2. Tools Used by Interlock Ransomware Actors
Tool Name	Description
AnyDesk	A common legitimate remote monitoring and management (RMM) tool maliciously used by Interlock actors to obtain remote access and maintain persistence. AnyDesk also supports remote file transfer.
Cobalt Strike	A penetration testing tool used by security professionals to test the security of networks and systems.
PowerShell	A cross-platform task automation solution made up of a command-line shell, a scripting language, and a configuration management framework, which runs on Windows, Linux, and macOS.
PSExec	A tool designed to run programs and execute commands on remote systems.
PuTTY.exe	An open source file transfer application commonly used to remotely connect to systems via Secure Shell (SSH). PuTTY also supports file transfer protocols like Secure File Transfer Protocol (SFTP) and Secure Copy Protocol (SCP).
ScreenConnect	A remote support, access, and meeting software that allows users to control devices remotely over the internet. CISA observed Interlock actors using a cracked version of this software in at least one incident. These versions may be standalone versions not connecting to ScreenConnect’s official cloud domains (domains available upon request from ConnectWise).
SystemBC	Enables Interlock actors to compromise systems, run commands, download malicious payloads, and act as a proxy tool to the actors’ C2 servers.
Windows Console Host	Windows Console Host (`conhost.exe`) manages the user interface for command-line applications in Windows, including Command Prompt and PowerShell.
WinSCP	A free and open source SSH File Transfer Protocol (FTP), WebDAV, Amazon S3, and secure copy protocol client.

See Table 3 and Table 4 for files used by Interlock ransomware actors. These were obtained from FBI investigations as recently as June 2025.

Disclaimer: Some of the hashes are for legitimate tools and applications and should not be attributed as malicious without analytical evidence to support threat actor use and/or control. The authoring agencies recommend organizations investigate or vet these hashes prior to taking action, such as blocking.

Table 3. Files Used by Interlock Ransomware Actors (SHA-256)
File Name	Hash
1.ps1	fba4883bf4f73aa48a957d894051d78e0085ecc3170b1ff50e61ccec6aeee2cd
advanced_port_scanner.exe	4b036cc9930bb42454172f888b8fde1087797fc0c9d31ab546748bd2496bd3e5
Aisa.exe	18a507bf1c533aad8e6f2a2b023fbbcac02a477e8f05b095ee29b52b90d47421
AnyDesk.exe	1a70f4eef11fbecb721b9bab1c9ff43a8c4cd7b2cafef08c033c77070c6fe069
autoservice.dll	a4069aa29628e64ea63b4fb3e29d16dcc368c5add304358a47097eedafbbb565
Autostart.exe	d535bdc9970a3c6f7ebf0b229c695082a73eaeaf35a63cd8a0e7e6e3ceb22795
cht	FAFCD5404A992850FFCFFEE46221F9B2FF716006AECB637B80E5CD5AA112D79C
cht.exe	C20BABA26EBB596DE14B403B9F78DDC3C13CE9870EEA332476AC2C1DD582AA07
cleanup.dll (SystemBC)	1845a910dcde8c6e45ad2e0c48439e5ab8bbbeb731f2af11a1b7bbab3bfe0127
conhost	44887125aa2df864226421ee694d51e5535d8c6f70e327e9bcb366e43fd892c1
conhost.dll	a70af759e38219ca3a7f7645f3e103b13c9fb1db6d13b68f3d468b7987540ddf
conhost.dll	96babe53d6569ee3b4d8fc09c2a6557e49ebc2ed1b965abda0f7f51378557eb1
difxepi.dll (SystemBC)	1845a910dcde8c6e45ad2e0c48439e5ab8bbbeb731f2af11a1b7bbab3bfe0127
iexplore.exe	d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb
klg.dll	A4F0B68052E8DA9A80B70407A92400C6A5DEF19717E0240AC608612476E1137E
!!!OPEN_ME!!!.txt	68A49D5A097E3850F3BB572BAF2B75A8E158DADB70BADDC205C2628A9B660E7A
processhacker-2.39-bin.zip	88f26f3721076f74996f8518469d98bf9be0eaee5b9eccc72867ebfc25ea4e83
PsExec.exe	078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b
putty.exe	7a43789216ce242524e321d2222fa50820a532e29175e0a2e685459a19e09069
puttyportable.exe	97931d2e2e449ac3691eb526f6f60e2f828de89074bdac07bd7dbdfd51af9fa0
PuTTYPortable.zip	ff7ad2376ae01e4b3f1e1d7ae630f87b8262b5c11bc5d953e1ac34ffe81401b5
qrpce91.exe.asd	64a0ab00d90682b1807c5d7da1a4ae67cde4c5757fc7d995d8f126f0ec8ae983
ScreenConnect.ClientService.exe	2814b33ce81d2d2e528bb1ed4290d665569f112c9be54e65abca50c41314d462
SophosendpointAgent.exe	f51b3d054995803d04a754ea3ff7d31823fab654393e8054b227092580be43db
SophosScaner.exe	dfb5ba578b81f05593c047f2c822eeb03785aecffb1504dcb7f8357e898b5024
Starship.exe	94bf0aba5f9f32b9c35e8dfc70afd8a35621ed6ef084453dc1b10719ae72f8e2
start	28c3c50d115d2b8ffc7ba0a8de9572fbe307907aaae3a486aabd8c0266e9426f
start.exe	70bb799557da5ac4f18093decc60c96c13359e30f246683815a512d7f9824c8f
StorageExplorer.exe	73a9a1e38ff40908bcc15df2954246883dadfb991f3c74f6c514b4cffdabde66
Sysmon.sys	1d04e33009bcd017898b9e1387e40b5c04279c02ebc110f12e4a724ccdb9e4fb
upd_2327991.exe	7b9e12e3561285181634ab32015eb653ab5e5cfa157dd16cdd327104b258c332
webujgd.lnk	70EE22D394E107FBB807D86D187C216AD66B8537EDC67931559A8AEF18F6B5B3
WinSCP-6.3.5-Setup.exe	8eb7e3e8f3ee31d382359a8a232c984bdaa130584cad11683749026e5df1fdc3
Proxy Tool	e4d6fe517cdf3790dfa51c62457f5acd8cb961ab1f083de37b15fd2fddeb9b8f
Encryptor	e86bb8361c436be94b0901e5b39db9b6666134f23cce1e5581421c2981405cb1
Encryptor	c733d85f445004c9d6918f7c09a1e0d38a8f3b37ad825cd544b865dba36a1ba6
Encryptor	28c3c50d115d2b8ffc7ba0a8de9572fbe307907aaae3a486aabd8c0266e9426f

Table 4. Files Used by Interlock Ransomware Actors (SHA-1)
File Name	Hash
autorun.log	514946a8fc248de1ccf0dbeee2108a3b4d75b5f6
jar.jar	b625cc9e4024d09084e80a4a42ab7ccaa6afb61d
pack.jar	3703374c9622f74edc9c8e3a47a5d53007f7721e

See Table 5 through Table 16 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.

Table 5. Initial Access
Technique Title	ID	Use
Drive-By Compromise	T1189	Interlock actors obtain initial access by compromising a legitimate website that network users visit, or by disguising malicious payloads as fake browser updates or common security software, including the following:¹⁷ FortiClient.exe Ivanti-Secure-Access-Client.exe GlobalProtect.exe Webex.exe AnyConnectVPN.exe Cisco-Secure-Client.exe zyzoom_antimalware.exe Interlock actors also gain access via the ClickFix social engineering technique, in which users are tricked into executing a malicious payload by clicking on a fake CAPTCHA that prompts users to execute a malicious PowerShell script.

Table 6. Execution
Technique Title	ID	Use
Command and Scripting Interpreter: PowerShell	T1059.001	Interlock actors implement PowerShell scripts to drop a malicious file into the Windows Startup folder. Interlock actors execute a PowerShell command for registry key modification. Interlock actors use a PowerShell script to execute a series of commands to facilitate reconnaissance.
User Execution: Malicious Copy and Paste	T1204.004	Via the ClickFix social engineering technique, users are tricked into clicking a fake CAPTCHA and prompted into executing a malicious Base64-encoded PowerShell process by following instructions to open a Windows Run window (Windows Button + R), pasting clipboard contents (“CTRL + V”), and then executing the malicious script (“Enter”).

Table 7. Persistence
Technique Title	ID	Use
Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder	T1547.001	Interlock actors establish persistence by adding a file into a Windows StartUp folder that executes a RAT every time a user logs in. Interlock actors also implement registry key modification by using a PowerShell command to add a run key value (named “Chrome Updater”) that uses a log file as an argument every time a user logs in.

Table 8. Privilege Escalation
Technique Title	ID	Use
Valid Accounts: Domain Accounts	T1078.002	Interlock actors compromise domain administrator accounts to gain additional privileges.

Table 9. Defense Escalation
Technique Title	ID	Use
Defense Evasion	TA0005	Interlock actors execute the `removeme` function on Linux systems to delete the encryption binary for defense evasion.
Masquerading: Match Legitimate Resource Name or Location	T1036.005	Interlock actors disguise a malicious run key value by naming it “Chrome Updater”; the run key value uses a specific log file as an argument upon user login. Interlock actors disguise files of keystrokes logged by one of their credential stealers with a legitimate Windows filename: `conhost.txt`. Interlock actors disguise an encryption binary, a 64-bit executable, by giving it the same name as the legitimate Console Windows Host executable: `conhost.exe`
System Binary Proxy Execution: Rundll32	T1218.011	Interlock actors use `rundll32.exe` to proxy execution of a malicious DLL binary `tmp41.wasd`.
Indicator Removal: File Deletion	T1070.004	Interlock actors execute a DLL binary `tmp41.wasd` that uses the `remove()` function to delete their encryption binary for defense evasion.

Table 10. Credential Access
Technique Title	ID	Use
Credential Access	TA0006	Interlock actors download credential stealer `cht.exe` and execute other versions information stealers (including Lumma Stealer and Berserk Stealer) to harvest credentials.
Credentials from Password Stores: Credentials from Web Browsers	T1555.003	Interlock actors download a credential stealer that collects login information and associated URLs for victims’ online accounts.
Input Capture	T1056	Interlock actors execute Lumma Stealer and Berserk Stealer information stealers on victim systems.
Input Capture: Keylogging	T1056.001	Interlock actors download `klg.dll`, a keylogger binary, onto compromised systems, where it logs users’ keystrokes in a file named `conhost.txt`.
Steal or Forge Kerberos Tickets: Kerberoasting	T1558.003	Interlock actors possibly use a Kerberoasting attack to compromise domain administrator accounts.

Table 11. Discovery
Technique Title	ID	Use
System Owner/User Discovery	T1033	Interlock actors execute a PowerShell command `WindowsIdentity.GetCurrent()` on victim systems to retrieve a WindowsIdentity object that represents the current Windows user.
System Information Discovery	T1082	Interlock actors execute a PowerShell command `systeminfo` on victim systems to access detailed configuration information about the system, including OS configuration, security information, product ID, and hardware properties. Interlock actors execute a PowerShell command `Get-PSDrive` on victim systems to discover the drives in the current session, such as: Windows logical drives on the computer, including drives mapped to network shares. Drives exposed by PowerShell providers. Session-specified temporary drives and persistent mapped network drives.
System Service Discovery	T1007	Interlock actors execute a PowerShell command `tasklist /svc` on victim systems that lists service information for each process currently running on the system. Actors also execute a PowerShell command `Get-Service` on victim systems that retrieves objects that represent the services (including running and stopped services) on the system.
System Network Configuration Discovery	T1016	Interlock actors execute a PowerShell command `arp -a` on victim systems that displays and modifies entries in the Address Resolution Protocol (ARP) cache table (which contains entries on the IPv4 and IPv6 addresses on host endpoints).

Table 12. Lateral Movement
Technique Title	ID	Use
Valid Accounts	T1078	Interlock actors harvest and abuse valid credentials for lateral movement and privilege escalation.
Remote Services: Remote Desktop Protocol	T1021.001	Interlock actors use RDP and valid credentials to move laterally between systems.

Table 13. Collection
Technique Title	ID	Use
Data from Cloud Storage	T1530	Interlock actors use `StorageExplorer.exe`, the cloud storage solution Azure Storage Explorer, to explore Microsoft Azure Storage accounts.

Table 14. Command and Control
Technique Title	ID	Use
Command and Control	TA0011	Interlock actors use applications Cobalt Strike and SystemBC for C2.
Ingress Tool Transfer	T1105	Interlock actors use a fake Google Chrome or Microsoft Edge browser update to cause users to execute a RAT on the victimized system. Interlock actors download credential stealers (`cht.exe`) and keylogger binaries (`klg.dll`) once actors establish remote control of a compromised system.
Remote Access Tools	T1219	Interlock actors use legitimate remote access tools such as AnyDesk to enable remote connectivity and PuTTY to assist with lateral movement.

Table 15. Exfiltration
Technique Title	ID	Use
Exfiltration Over Web Service: Exfiltration to Cloud Storage	T1567.002	Interlock actors exfiltrate data to cloud storage by executing AzCopy to upload data to the Azure storage blob.
Exfiltration Over Alternative Protocol	T1048	Interlock actors use file transfer tools like WinSCP to exfiltrate data.

Table 16. Impact
Technique Title	ID	Use
Data Encrypted for Impact	T1486	Interlock actors encrypt victim data using a combined AES and RSA algorithm on compromised systems to interrupt availability to system and network resources. Actors code encryptors using C/C++. Interlock actors use encryptors for both Windows and Linux operating systems. Interlock actors also use a FreeBSD ELF encryptor to encrypt victim data.
Financial Theft	T1657	Interlock actors deliver a ransom note titled `!__README__!.txt` via a GPO which provides victims with instructions to use a `.onion` URL to contact the actors over the Tor network. Actors use a double-extortion model, both encrypting victim data and threatening release of victim data on their Tor network leak site if the ransom is not paid.

The authoring agencies recommend organizations implement the mitigations below to improve your organization’s cybersecurity posture on the basis of the Interlock ransomware actors’ activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats and TTPs. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections.

In addition to the below mitigations, Healthcare and Public Health (HPH) organizations should use HPH Sector CPGs to implement cybersecurity protections to address the most common threats and TTPs used against this sector.

At-risk organizations should implement the following mitigations:

Prevent Interlock ransomware actors from obtaining initial access:
- Implement domain name system (DNS) filtering to block users from accessing malicious sites and applications.
- Implement web access firewalls to mitigate and prevent unknown commands or process injection from malicious domains or websites.
- Train users [CPG 2.I] to identify, avoid, and report social engineering attempts.
Implement a recovery plan [CPG 5.A] to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location (e.g., hard drive, storage device, the cloud) [CPG 2.R].
Require all accounts with password logins (e.g., service accounts, admin accounts, and domain admin accounts) to comply with NIST password standards.
- Require employees to use long passwords [CPG 2.B] and consider not requiring recurring password changes, as these can weaken security.
Require MFA [CPG 2.H] for all services to the extent possible, particularly for webmail, virtual private networks (VPNs), and accounts that access critical systems.
- Implement ICAM policies across the organization as a precursor to MFA.
Keep all operating systems, software, and firmware up to date; prioritize patching known exploited vulnerabilities in internet-facing systems [CPG 1.E].
- Timely patching is efficient and cost effective for minimizing an organization’s exposure to cybersecurity threats.
Implement robust EDR capabilities on VMs, systems, and networks.
Segment networks [CPG 2.F] to prevent the spread of ransomware.
- Network segmentation can help prevent the spread of ransomware by controlling traffic flows between—and access to—various subnetworks and by restricting adversary lateral movement.
Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware [CPG 3.A] with a networking monitoring tool [CPG 2.T].
- To aid in detecting ransomware, implement a tool that logs and reports all network traffic, including lateral movement activity on a network.
- Implement EDR tools; these are useful for detecting lateral connections as they provide insight into common and uncommon network connections for each host.
Filter network traffic by preventing unknown or untrusted origins from accessing remote services on internal systems.
- This prevents threat actors from directly connecting to remote access services that they have established for persistence.
Install, regularly update, and enable real time detection for antivirus software on all hosts.
Review domain controllers, servers, workstations, and active directories for new and/or unrecognized accounts.
Audit user accounts with administrative privileges and configure access controls according to the principle of least privilege [CPG 2.E].
Disable unused ports.
Consider adding an email banner to emails received from outside of your organization [CPG 2.M].
Disable hyperlinks in received emails.
Implement time-based access for accounts set at the admin level and higher; for example, the just-in-time (JIT) access method provisions privileged access when needed and can support enforcement of the principle of least privilege (as well as the Zero Trust model):
- This is a process where a network-wide policy is set in place to automatically disable admin accounts at the Active Directory level when the account is not in direct need.
- Individual users may submit their requests through an automated process that grants them access to a specified system for a set timeframe when they need to support the completion of a certain task.
Disable command line and scripting activities and permissions [CPG 2.N].
- Disabling software utilities that run from the command line makes it more difficult for threat actors to escalate privileges and move laterally.
Maintain offline backups of data and regularly maintain backups and restorations [CPG 2.R]; this avoids severe service interruption and irretrievable data in the event of a compromise.
Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted), and covers the entire organization’s data infrastructure [CPG 2.R].

In addition to applying mitigations, the authoring agencies recommend exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory. The authoring agencies recommend testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.

To get started:

Select an ATT&CK technique described in this advisory (see Table 5 through Table 16).
Align your security technologies against the technique.
Test your technologies against the technique.
Analyze your detection and prevention technologies’ performance.
Repeat the process for all security technologies to obtain a set of comprehensive performance data.
Tune your security program, including people, processes, and technologies, based on the data generated by this process.

The authoring agencies recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.

Your organization has no obligation to respond or provide information back to FBI in response to this joint advisory. If, after reviewing the information provided, your organization decides to provide information to FBI, reporting must be consistent with applicable state and federal laws.

FBI is interested in any information that can be shared, to include boundary logs showing communication to and from foreign IP addresses, a sample ransom note, communications with threat actors, Bitcoin wallet information, decryptor files, and/or a benign sample of an encrypted file.

Additional details of interest include a targeted company point of contact, status and scope of infection, estimated loss, operational impact, transaction IDs, date of infection, date detected, initial attack vector, and host- and network-based indicators.

The authoring agencies do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, FBI and CISA urge you to promptly report ransomware incidents to FBI’s Internet Crime Complain Center (IC3), a local FBI Field Office, or CISA via the agency’s Incident Reporting System or its 24/7 Operations Center (contact@mail.cisa.dhs.gov) or by calling 1-844-Say-CISA (1-844-729-2472).

State, local, tribal, and territorial governments should report incidents to the MS-ISAC (SOC@cisecurity.org or 866-787-4722).

HPH Sector organizations should report incidents to FBI or CISA but also can reach out to HHS at HHScyber@hhs.gov for cyber incident support focused on mitigating adverse patient impacts.

The information in this report is being provided “as is” for informational purposes only. The authoring agencies do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favor by the authoring agencies.

Cisco Talos contributed to this advisory.

July 22, 2025: Initial version.

¹ Elio Biasiotto, et. al., “Unwrapping the Emerging Interlock Ransomware Attack,” Talos Intelligence (blog), Cisco Talos, last modified November 7, 2024, https://blog.talosintelligence.com/emerging-interlock-ransomware/.

² Sekoia Threat Detection and Research team, “Interlock Ransomware Evolving Under the Radar,” Sekoia (blog), Sekoia, last modified April 16, 2025, https://blog.sekoia.io/interlock-ransomware-evolving-under-the-radar/.

³ Yashvi Shah and Vignesh Dhatchanamoorthy, “ClickFix Deception: A Social Engineering Tactic to Deploy Malware,” McAfee Labs (blog), McAfee,last modified June 11, 2024, https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clickfix-deception-a-social-engineering-tactic-to-deploy-malware/ and “HC3 Sector Alert: ClickFix Attacks,” Health Sector Cybersecurity Coordination Center, Department of Health and Human Services, last modified October 29, 2024, https://www.hhs.gov/sites/default/files/clickfix-attacks-sector-alert-tlpclear.pdf.

⁴ Shah, “ClickFix Deception: A Social Engineering Tactic to Deploy Malware.”

⁵ Sekoia Threat Detection and Research team, “Interlock Ransomware Evolving Under the Radar.”

⁶ Bill Toulas, “Interlock Ransomware Gang Deploys New NodeSnake RAT on Universities,“ Bleeping Computer, May 28, 2025, https://www.bleepingcomputer.com/news/security/interlock-ransomware-gang-deploys-new-nodesnake-rat-on-universities/.

⁷ Biasiotto, “Unwrapping the Emerging Interlock Ransomware Attack.”

⁸ International law-enforcement and Microsoft took down the Lumma Stealer malware in May 2025 by seizing internet domains the actors used to distribute the malware to actors and taking down domains that hosted the malware’s infrastructure. For more information, see Tara Seals, “Lumma Stealer Takedown Reveals Sprawling Operation,” Dark Reading, May 21, 2025, https://www.darkreading.com/cybersecurity-operations/lumma-stealer-takedown-sprawling-operation, and Steven Masada, “Disrupting Lumma Stealer: Microsoft Leads Global Action Against Favored Cybercrime Tool,” Microsoft On the Issues (blog), Microsoft, last modified May 21, 2025, https://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/.

⁹ Sekoia Threat Detection and Research team, “Interlock Ransomware Evolving Under the Radar.”

¹⁰ Biasiotto, “Unwrapping the Emerging Interlock Ransomware Attack.”

¹¹ Biasiotto, “Unwrapping the Emerging Interlock Ransomware Attack.”

¹² Biasiotto, “Unwrapping the Emerging Interlock Ransomware Attack.”

¹³ Biasiotto, “Unwrapping the Emerging Interlock Ransomware Attack.”

¹⁴ Lawrence Abrams, “Meet Interlock — The New Ransomware Targeting FreeBSD Servers,” Bleeping Computer, November 3, 2024, https://www.bleepingcomputer.com/news/security/meet-interlock-the-new-ransomware-targeting-freebsd-servers/.

¹⁵ Biasiotto, “Unwrapping the Emerging Interlock Ransomware Attack.”

¹⁶ Graham Cluley, “Interlock Ransomware: What You Need to Know,” Fortra (blog), Fortra, last modified May 30, 2025, https://www.tripwire.com/state-of-security/interlock-ransomware-what-you-need-know.

¹⁷ Sekoia Threat Detection and Research team, “Interlock Ransomware Evolving Under the Radar.”

MIL Security OSI –

July 23, 2025

MIL-OSI Submissions: Dog thefts: what really happened during the COVID pandemic

Source: The Conversation – UK – By Daniel Allen, Animal Geographer, Keele University

smrm1977/Shutterstock

Dog theft can be a devastating crime. During the COVID pandemic, newspapers suggested there was an epidemic of “dognapping” in the UK. If you have a dog, the reports may have alarmed you at a time when there were already many reasons to feel afraid.

There are mixed views on whether or not lockdown triggered an increase in dog ownership. Animal welfare charity Battersea attributed a 53% increase in dog adoption to lockdown, and online pet adoption service Pets4Homes said in their 2022 report that demand for puppies rose 104% at the peak of lockdown in May 2020.

But animal charity PDSA said its survey data pointed to a gradual increase in dog ownership since 2011 rather than a dramatic surge during lockdown. However, we do know lockdown saw inflated prices for dogs, with some fashionable breeds going for £9,000.

In terms of criminal activity, social distancing restrictions seemed to lead to a decline in some forms of crime, including shoplifting and burglary. But many media outlets reported the number of dog thefts had increased up to 250% during the pandemic.

Get your news from actual experts, straight to your inbox. Sign up to our daily newsletter to receive all The Conversation UK’s latest coverage of news and research, from politics and business to the arts and sciences.

We wanted to explore if the data supported claims of a dognapping epidemic and whether patterns in dog theft could suggest ways to help reduce it. Our recent study found new insights into dog theft patterns and showed the situation was more complicated than it seemed at first glance.

Under the Theft Act 1968, dog theft is not a specific offence. It comes under other theft offences, such as burglary or theft from a person.

This means police records on dog theft were not included in crime statistics. The only way to access such information is through Freedom of Information (FOI) requests to individual police forces. There are 45 territorial and three special police forces in the UK, and each has its own reporting and recording practices.

Although police FOI data for dog theft must be approached with caution, it is useful. Previous studies exploring police FOI data found an upward trend in recorded dog thefts in England and Wales: rising nearly 20% from 2015 (1,545) to 2018 (1,849) for 41 police forces combined; and up 3.5% year on year from 2019 (1,452) to 2020 (1,504) for 33 police forces.

DogLost, a UK online community for reuniting lost and stolen dogs with their owners, reported a 170% increase in stolen dogs (with Crime Reference Numbers) registered on their website in 2020 (465), compared to 2019 (172). This figure was widely quoted as a national increase “since lockdown started” by the media.

The 250% increase figure first quoted in December 2020 was actually a comparison of two seven-month periods (January-July 2019 and 2020) for only one police force.

Patterns and trends

Our study found the data for the period covering the COVID pandemic is also incomplete. Data was provided by 32 forces (71%) for 2020, by 27 forces (60%) for 2021, and 23 forces (51%) for 2022.

Patterns and trends do, however, emerge. Between 2020 and 2022, the available data shows a 3.7% rise in dog thefts in the UK, from 1,573 to 1,631. When making adjustments for the number of police forces providing data (which decreased over the period), the estimated national figures suggest there may have been more significant rise of up to 44.2%.

While we cannot assume that the forces who supplied data are representative of all 45 regional forces, if this were the case, it would equate to 2,212 recorded dog thefts in 2020, 2,645 in 2021, and 3,191 in 2022.

There was a lot of variation between different areas. For example, Cambridgeshire, Gwent and Northumbria police forces experienced increases of 36%, 49% and 80% respectively in the number of recorded dog thefts between 2020 and 2021.

Monthly analysis of data from regional police forces and DogLost, show that the number of reports of stolen dogs started to go up when the UK entered its first national lockdown and again during part of the third lockdown. But the average number of police-recorded dog thefts was actually slightly higher outside of lockdown periods than during them between 2020 and 2022.

However, in contrast with police trends, DogLost data shows a 65.2% drop in dogs reported stolen on DogLost’s website in 2022 compared to 2020. Lower DogLost numbers may reflect limited visibility or presence of their networks, the use of alternative lost and stolen dog services, or reluctance to share personal details online due to scams targeting dog theft victims.

Dogs are often stolen from inside their own homes.
GoodFocused/Shutterstock

Our study found that, overall, there probably was an increase in dog theft from
2020 to 2022, following already identified increases in the preceding years. This rise was probably driven by a combination of opportunity (more dogs, higher value) and situational factors (accessibility, dogs unattended in gardens while owners were inside).

Our evidence does not support the notion of a widespread epidemic as portrayed by the media. However, increased media interest probably amplified awareness of the issue, and influenced the creation of the Pet Theft Taskforce, a UK government initiative set up in May 2021 to investigate and tackle dog thefts.

New research appears to confirm the idea that dog abduction has significant welfare effects on both dogs and their owners. We also know that few dog thefts are successfully resolved, with under a quarter of stolen dogs likely to be returned and around 1%-5% of reported dog thefts result in someone being charged.

However, there is potential good news. Our ongoing research suggests the number of police-recorded dog thefts decreased slightly in 2023, and again in 2024. This is supported by research from pet insurer Direct Line, which has estimated a 21% decrease in the number of stolen dogs from 2,290 in 2023 to 1,808 in 2024 in the UK.

Daniel Allen is founder of Pet Theft Reform and patron of the Stolen and Missing Pets Alliance (Sampa).

Melanie Flynn is a member of the Research Advisory Committee of the Vegan Society (UK).

John Walliss does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.

– ref. Dog thefts: what really happened during the COVID pandemic – https://theconversation.com/dog-thefts-what-really-happened-during-the-covid-pandemic-252061

MIL OSI –

July 23, 2025
MIL-OSI Submissions: What are education and health care plans and why are parents worried about them being scrapped?

Source: The Conversation – UK – By Jonathan Glazzard, Rosalind Hollis Professor of Education for Social Justice, University of Hull

Drazen Zigic/Shutterstock

For children in England with special educational needs and disabilities, an education and health care plan (EHCP) is a central pillar of support. The government is due to set out its educational strategy for children with special educational needs and disabilities in the autumn, though, and has not ruled out scrapping ECHPs. Their removal would signal radical change in how the system works in England.

ECHPs are individualised plans that set out the needs of a particular child and the support they should receive – from education, health services and social care – in order have the best opportunity to thrive. But demand for ECHPs is soaring and providing support is proving financially catastrophic for local authorities.

One of the criticisms of EHCPs is that they prioritise providing children with individual models of support, rather than developing inclusive cultures within schools and within the broader education system. Education secretary Bridget Phillipson has outlined a vision of building a system where more children with special educational needs and disabilities can attend mainstream schools.

But removing ECHPs leads to the possibility of children who need more specialist support missing out.

Get your news from actual experts, straight to your inbox. Sign up to our daily newsletter to receive all The Conversation UK’s latest coverage of news and research, from politics and business to the arts and sciences.

To secure an ECHP, local authorities carry out a statutory assessment to determine whether a child’s needs warrant additional support. An assessment does not always lead to an EHCP, but if one is issued, it must outline how the child’s needs will be met and the additional resources needed to do so.

These resources might include funding to provide a child with a teaching assistant, funding for equipment and transport to school, or funding to go to a specialist school. This system of support helps school leaders ensure that children and young people have the right support, at the right time.

According to a report published earlier this year, the demand for EHCPs has risen by 140% since 2015. Recent data shows that there are 482,640 children and young people in England with an EHCP.

Many more children have special educational needs, but do not have an ECHP. These pupils are classed as receiving special educational needs support. The percentage of pupils with an EHCP has increased to 5.3%, from 4.8% in 2024. The percentage of pupils with special educational needs support has increased to 14.2%, from 13.6% in 2024.

Despite government investment of £10.7 billion to local authorities in 2024-25, a House of Commons committee report outlines that long waiting times for assessments, as well as to access support such as speech and language therapy, has led to parents losing confidence in the system.

Support may include equipment or additional sessions.
ABO PHOTOGRAPHY/Shutterstock

Funding is allocated to each local authority from central government to fund provision in their areas. It is for local authorities, in consultation with their schools, to determine the individual allocation to schools. However, local authorities are struggling to meet the increased demand for EHCPs. Even when funding is allocated through EHCPs, it is not always sufficient to address the needs of those with complex needs.

And funding is not sufficient to meet demand. Local authorities have accumulated huge deficits due to spending exceeding funding, placing some at risk of going bankrupt.

Future plans

Bridget Phillipson has refused to be drawn on whether EHCPs will be axed. “What I can say very clearly,” she has said, “is that we will strengthen and put in place better support for children.”

Building more inclusive schools is obviously one way of achieving this vision. If scrapping EHCPs means less funding for children for special educational needs and disabilities, though, this cannot be the answer. Children need more support, not less, to enable them to thrive.

The solution is for the government to work out what models of inclusion work well in mainstream schools and to decide how these can be resourced and evaluated. Clarity is also needed on inclusion in mainstream schools can be measured in order to assess whether it is working.

Making more support in mainstream schools work also requires an adequate supply of knowledgeable, well-trained teachers. The government is prioritising this through revision to initial teacher education courses, with an emphasis on all teachers being teachers of special educational needs.

If the government doesn’t get this right, the result may be poorer educational and long-term outcomes for pupils with special educational needs and disabilities. It may also lead to issues with teacher recruitment and retention in mainstream schools, particularly if teachers feel that they do not have the level of support in place that they need to meet the needs of their pupils.

Jonathan Glazzard does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.

– ref. What are education and health care plans and why are parents worried about them being scrapped? – https://theconversation.com/what-are-education-and-health-care-plans-and-why-are-parents-worried-about-them-being-scrapped-260622

MIL OSI –

July 23, 2025
MIL-OSI USA: ICE and FBI arrest Cincinnati man for terroristic threats against ICE agents

Source: US Immigration and Customs Enforcement

CINCINNATI — U.S. Immigration and Customs Enforcement’s Homeland Security Investigations and the FBI arrested a Cincinnati man July 19 after he allegedly made multiple threats online to shoot and kill ICE officers.

Anthony Marcus Kelly, 38, faces federal charges including threatening to assault, kidnap or murder a United States official, as well as transmitting communications containing threats to kidnap or injure another person.

Law enforcement became aware of a social media user going by the name of “Slab” after he allegedly made multiple social media posts calling for the killing of ICE officers and detailing his acquisition of firearms to carry out that threat.

After an investigation, the user making these posts was identified as Kelly, who lives in the Cincinnati area.

In one of his alleged posts, Kelly wrote “Why even bother with these damn courts anymore. #Gestapedos don’t deserve anything but the smoke coming for them anyway. #RevolutionIsTheSolution #DestroyICE they’re rabid dogs that need to be put down. Including #KristiNoem #DogmeatWalking.”

In another, he wrote, “You come here for me, you’re getting shot. And I’m not looking to disable […] I’m shooting for the kill. I won’t give a **** about your names, who you are, or anything else”.

“Let me be crystal clear: Threatening to kill a federal officer is not protest — it’s terrorism,” said acting ICE Director Todd M. Lyons. “Anthony Kelly’s violent threats, while disgusting and completely unhinged, are a symptom of a larger problem: Politicians are trying to turn our law enforcement officials into targets by scaring their constituents and whipping them into a frenzy in a fact-free vacuum. This is what happens when anti-ICE activists don’t realize or care that we’re out there arresting rapists, murderers and child molesters who are in this country illegally. Enough is enough. Anyone who targets ICE personnel will be met with swift, unrelenting justice.”

“Calling for violence against federal law enforcement is not protected by the First Amendment,” said HSI Detroit acting Special Agent in Charge Jared Murphey. “At great personal risk, ICE agents and officers faithfully enforce laws passed by our representatives in Congress. If members of the public disagree with our nation’s laws, they need to write their representatives, not threaten violence against those charged with carrying out the law.”

“Making violent threats against federal law enforcement officers will never be tolerated,” said FBI Cincinnati Special Agent in Charge Elena Iatarola. “Advocating for violence is not only wrong; it is also against the law and has serious consequences.”

Kelly remains in federal custody pending further court proceedings.

All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

MIL OSI USA News –

July 23, 2025
MIL-OSI Security: Gary Man Sentenced to 480 Months in Prison

Source: US FBI

HAMMOND- Yesterday, Taquan Clarke, age 31, of Gary, Indiana, was sentenced by United States District Court Judge Philip P. Simon after a jury found him guilty of conspiring to distribute and possess with intent to distribute cocaine and using a firearm to commit murder, following a 6-day jury trial, announced Acting United States Attorney M. Scott Proctor.

Clarke was sentenced to 480 months in prison for using a firearm to commit murder. He was also sentenced to 240 months in prison for conspiring to distribute and possess with intent to distribute cocaine. He was also sentenced to 3 years of supervised release. Both sentences are to run concurrently.

According to documents in the case, between June 2016 and February 2018, Taquan Clarke and numerous others conspired to possess and possess with intent to distribute cocaine. On July 28, 2017, Clarke was involved in a plot to rob an individual of cocaine and money. During this attempted robbery, Clarke shot the victim, K.H., in the head, resulting in K.H.’s death.

“Taquan Clarke cut short the life of another man,” said Acting U.S. Attorney Proctor. “Thanks to the coordinated efforts of law enforcement, he has been brought to justice for that act. It is an honor to serve with the dedicated agents, officers, and prosecutors who made that happen.”

This case was investigated by the Federal Bureau of Investigation Gang Response Investigative Team, the Gary Police Department, and the Lake County Sheriff’s Department. The trial was handled by Assistant United States Attorneys David J. Nozick and Caitlin M. Padula.

This case is part of Project Safe Neighborhoods (PSN), a program bringing together all levels of law enforcement and the communities they serve to reduce violent crime and gun violence, and to make our neighborhoods safer for everyone. On May 26, 2021, the Department launched a violent crime reduction strategy strengthening PSN based on these core principles: fostering trust and legitimacy in our communities, supporting community-based organizations that help prevent violence from occurring in the first place, setting focused and strategic enforcement priorities, and measuring the results.

MIL Security OSI –

July 23, 2025
MIL-OSI Security: Swedish Man Who Licensed Rights to Late Colombian Drug Lord Pablo Escobar Pleads Guilty to Fraud, Money Laundering Charges

Source: US FBI

LOS ANGELES – A Swedish national who licensed the rights of the late Colombian narco-terrorist Pablo Escobar pleaded guilty today to six federal criminal charges for defrauding investors by marketing and selling products – including flamethrowers and cellphones – that he never delivered.

Olof Kyros Gustafsson, 32, a.k.a. “El Silencio,” pleaded guilty to one count of conspiracy to commit wire fraud and mail fraud, one count of wire fraud, one count of mail fraud, one count of conspiracy to commit money laundering, one count of concealment money laundering, and one count of international concealment money laundering.

Gustafsson has been in federal custody since March 28, when he was extradited to the United States from Spain, where he was arrested in December 2023.

According to his plea agreement, Gustafsson was the CEO of Escobar Inc., a corporation registered in Puerto Rico that held successor-in-interest rights to the persona and legacy of Pablo Escobar, the deceased Colombian narco-terrorist and late head of the Medellín Cartel. Escobar Inc. used Pablo Escobar’s likeness and persona to market and sell purported consumer products to the public.

From July 2019 to November 2023, Gustafsson identified existing products in the marketplace that were being manufactured and sold to the public. He then used the Escobar persona to market and advertise similar and competing products purportedly being sold by Escobar Inc., advertising them at a price substantially lower than existing counterparts being sold by other companies.

Gustafsson then purportedly sold the products – including an Escobar Flamethrower, an Escobar Fold Phone, an Escobar Gold 11 Pro Phone, and Escobar Cash (marketed as a “physical cryptocurrency”) – to customers, receiving payments via PayPal, Stripe, Coinbase, among other payment processors, as well as bank and wire transfers.

Despite receiving customer payments, Gustafsson did not deliver the Escobar Inc. products to paying customers because the products did not exist.

In furtherance of the scheme, Gustafsson sent crudely made samples of the purported Escobar Inc. products to online technology reviewers and social media influencers to attempt to increase the public’s demand for them. For example, Gustafsson sent Samsung Galaxy Fold Phones wrapped in gold foil and disguised as Escobar Inc. phones to online technology reviewers to attempt to induce victims who watched the online reviews into buying the products that never would be delivered.

Also, rather than sending paying customers the actual products, Gustafsson mailed them a “Certificate of Ownership,” a book, or other Escobar Inc. promotional materials so there was a record of mailing from the company to the customer. When a paying customer attempted to obtain a refund when the product was never delivered, Gustafsson fraudulently referred the payment processor to the proof of mailing for the Certificate of Ownership or other material as proof that the product itself was shipped and that the customer had received it so the refund requests would be denied.

Gustafsson also caused bank accounts to be opened under his name and entities he controlled to be used as funnel accounts – bank accounts into which he deposited and withdrew proceeds derived from his criminal activities. The purpose was to conceal and disguise the nature, location, source, ownership, and control of the proceeds. The bank accounts were located in the United States, Sweden, and the United Arab Emirates.

United States District Judge Fernando L. Aenlle-Rocha scheduled a December 5 sentencing hearing, at which time Gustafsson will face a statutory maximum sentence of 20 years in federal prison for each fraud-related count and up to 10 years in federal prison for each money laundering-related count.

As part of his plea agreement, Gustafsson agreed to pay up to $1.3 million in restitution to victims, as well as to forfeiture to funds that were proceeds of the fraud schemes, including money currently held in a bank account in Sweden.

IRS Criminal Investigation, the FBI, and the Federal Deposit Insurance Corporation-Office of Inspector General are investigating this matter, with assistance from the Department of Justice’s Office of International Affairs, the United States Marshals Service, Eurojust, Spanish authorities, and French judicial authorities.

Assistant United States Attorney Joshua O. Mausner of the Violent and Organized Crime Section is prosecuting this case.

MIL Security OSI –

July 23, 2025
MIL-OSI Security: Swedish Man Who Licensed Rights to Late Colombian Drug Lord Pablo Escobar Pleads Guilty to Fraud, Money Laundering Charges

Source: US FBI

LOS ANGELES – A Swedish national who licensed the rights of the late Colombian narco-terrorist Pablo Escobar pleaded guilty today to six federal criminal charges for defrauding investors by marketing and selling products – including flamethrowers and cellphones – that he never delivered.

Olof Kyros Gustafsson, 32, a.k.a. “El Silencio,” pleaded guilty to one count of conspiracy to commit wire fraud and mail fraud, one count of wire fraud, one count of mail fraud, one count of conspiracy to commit money laundering, one count of concealment money laundering, and one count of international concealment money laundering.

Gustafsson has been in federal custody since March 28, when he was extradited to the United States from Spain, where he was arrested in December 2023.

According to his plea agreement, Gustafsson was the CEO of Escobar Inc., a corporation registered in Puerto Rico that held successor-in-interest rights to the persona and legacy of Pablo Escobar, the deceased Colombian narco-terrorist and late head of the Medellín Cartel. Escobar Inc. used Pablo Escobar’s likeness and persona to market and sell purported consumer products to the public.

From July 2019 to November 2023, Gustafsson identified existing products in the marketplace that were being manufactured and sold to the public. He then used the Escobar persona to market and advertise similar and competing products purportedly being sold by Escobar Inc., advertising them at a price substantially lower than existing counterparts being sold by other companies.

Gustafsson then purportedly sold the products – including an Escobar Flamethrower, an Escobar Fold Phone, an Escobar Gold 11 Pro Phone, and Escobar Cash (marketed as a “physical cryptocurrency”) – to customers, receiving payments via PayPal, Stripe, Coinbase, among other payment processors, as well as bank and wire transfers.

Despite receiving customer payments, Gustafsson did not deliver the Escobar Inc. products to paying customers because the products did not exist.

In furtherance of the scheme, Gustafsson sent crudely made samples of the purported Escobar Inc. products to online technology reviewers and social media influencers to attempt to increase the public’s demand for them. For example, Gustafsson sent Samsung Galaxy Fold Phones wrapped in gold foil and disguised as Escobar Inc. phones to online technology reviewers to attempt to induce victims who watched the online reviews into buying the products that never would be delivered.

Also, rather than sending paying customers the actual products, Gustafsson mailed them a “Certificate of Ownership,” a book, or other Escobar Inc. promotional materials so there was a record of mailing from the company to the customer. When a paying customer attempted to obtain a refund when the product was never delivered, Gustafsson fraudulently referred the payment processor to the proof of mailing for the Certificate of Ownership or other material as proof that the product itself was shipped and that the customer had received it so the refund requests would be denied.

Gustafsson also caused bank accounts to be opened under his name and entities he controlled to be used as funnel accounts – bank accounts into which he deposited and withdrew proceeds derived from his criminal activities. The purpose was to conceal and disguise the nature, location, source, ownership, and control of the proceeds. The bank accounts were located in the United States, Sweden, and the United Arab Emirates.

United States District Judge Fernando L. Aenlle-Rocha scheduled a December 5 sentencing hearing, at which time Gustafsson will face a statutory maximum sentence of 20 years in federal prison for each fraud-related count and up to 10 years in federal prison for each money laundering-related count.

As part of his plea agreement, Gustafsson agreed to pay up to $1.3 million in restitution to victims, as well as to forfeiture to funds that were proceeds of the fraud schemes, including money currently held in a bank account in Sweden.

IRS Criminal Investigation, the FBI, and the Federal Deposit Insurance Corporation-Office of Inspector General are investigating this matter, with assistance from the Department of Justice’s Office of International Affairs, the United States Marshals Service, Eurojust, Spanish authorities, and French judicial authorities.

Assistant United States Attorney Joshua O. Mausner of the Violent and Organized Crime Section is prosecuting this case.

MIL Security OSI –

July 23, 2025
MIL-Evening Report: Gaza not a religious issue – it’s a massive violation of international law, say accord critics

Asia Pacific Report

Groups that have declined to join the government-sponsored “harmony accord” signed yesterday by some Muslim and Jewish groups, say that the proposed new council is “misaligned” with its aims.

The signed accord was presented at Government House in Auckland.

About 70 people attended, including representatives of the New Zealand Jewish Council, His Highness the Aga Khan Council for Australia and New Zealand and the Jewish Community Security Group, reports RNZ News.

The initiative originated with government recognition that the consequences of Israel’s actions in Gaza are impacting on Jewish and Muslim communities in Aotearoa, as well as the wider community.

While agreeing with that statement of purpose, other Muslim and Jewish groups have chosen to decline the invitation, said some of the disagreeing groups in a joint statement.

They believe that the council, as formulated, is misaligned with its aims.

“Gaza is not a religious issue, and this has never been a conflict between our faiths,” Dr Abdul Monem, a co-founder of ICONZ said.

‘Horrifying humanitarian consequences’
“In Gaza we see a massive violation of international law with horrifying humanitarian consequences.

“We place Israel’s annihilating campaign against Gaza, the complicity of states and economies at the centre of our understanding — not religion.

“The first action to address the suffering in Gaza and ameliorate its effects here in Aotearoa must be government action. Our government needs to comply with international courts and act on this humanitarian calamity.

“That does not require a new council.”

The impetus for this initiative clearly linked international events with their local impacts, but the document does not mention Gaza among the council’s priorities, said the statement.

“Signatories are not required to acknowledge universal human rights, nor the courts which have ruled so decisively and created obligations for the New Zealand government. Social distress is disconnected from its immediate cause.”

The council was open to parties which did not recognise the role of international humanitarian law in Palestine, nor the full human and political rights of their fellow New Zealanders.

‘Overlooks humanitarian law’
Marilyn Garson, co-founder of Alternative Jewish Voices said: “It has broad implications to overlook our rights and international humanitarian law.

“As currently formulated, the council includes no direct Palestinian representation. That’s not good enough.

“How can there be credible discussion of Aotearoa’s ethnic safety — let alone advocacy for international action — without Palestinians?

“Law, human rights and the dignity of every person’s life are not opinions. They are human entitlements and global agreements to which Aotearoa has bound itself.

“No person in Aotearoa should have to enter a room — especially a council created under government auspices — knowing that their fundamental rights will not be upheld. No one should have to begin by asking for that which is theirs.”

The groups outside this new council said they wished to live in a harmonious society, but for them it was unclear why a new council of Jews and Muslims should represent the path to harmony.

“Advocacy that comes from faith can be a powerful force. We already work with numerous interfaith community initiatives, some formed at government initiative and waiting to really find their purpose,” said Dr Muhammad Sajjad Naqvi, president of ICONZ.

Addressing local threats
“Those existing channels include more of the parties needed to address local threats, including Christian nationalism like that of Destiny Church.

“Perhaps government should resource those rather than starting something new.”

The groups who declined to join the council said they had “warm and enduring relationships” with FIANZ and Dayenu, which would take seats at this council table.

“All of the groups share common goals, but not this path,” the statement said.

ICONZ is a national umbrella organisation for New Zealand Shia Muslims for a unified voice. It was established by Muslims who have been born in New Zealand or born to migrants who chose New Zealand to be their home.

Alternative Jewish Voices is a collective of Aotearoa Jews working for Jewish pluralism and anti-racism. It supports the work of Palestinians who seek liberation grounded in law and our equal human rights.

MIL OSI Analysis – EveningReport.nz –

July 23, 2025
MIL-OSI Security: Men charged in connection to Grindr targeted burglaries across London

Source: United Kingdom London Metropolitan Police

Met Police detectives investigating a series of burglaries across London where victims were allegedly targeted on the social dating app Grindr have charged four men.

The group is alleged to have carried out 35 burglaries and 20 related frauds between October 2024 and March this year relating to 22 victims.

Rahmat Khan Mohammadi, 22 (28.10.02), of Weald Lane in Harrow, was arrested on Thursday, 3 April and charged on Saturday, 5 April with one count of theft, 17 counts of burglary and 12 fraud offences.

He appeared at Willesden Magistrates’ Court on Saturday, 5 April where he was remanded in custody to appear at Isleworth Crown Court on Friday, 25 July.

Mohammed Bilal Hotak, 21 (01.01.04), of Richmond Road in Hackney, was arrested on Thursday, 24 April and charged the following day on Friday, 25 April.

He appeared alongside Mohammadi at Isleworth Crown Court on Friday, 23 May charged with one count of theft, 14 burglaries and nine fraud offences.

He was also remanded in custody to appear at Isleworth Crown Court on Friday, 25 July.

Mozamel Rahman, 29 (01.03.97), of Sefton Avenue, Harrow, was arrested on Monday, 7 April and charged with three counts of burglary and two fraud offences on Thursday, 26 June.

He appeared at Willesden Magistrates’ Court on Friday, 11 July where he was bailed to attend the same court on Friday, 8 August.

Ibrahim Yaqobie, 28 (15.02.98), of Masons Avenue in Harrow, was arrested on Wednesday, 9 April and charged on Wednesday, 9 July with the same offences as Rahman.

He has been bailed to appear at Willesden Magistrates Court on Friday, 8 August.

A trial date for both Mohammadi and Hotak has been set for Monday, 13 October at Isleworth Crown Court.

MIL Security OSI –

July 23, 2025
MIL-OSI Africa: Food and Agriculture Organization (FAO), Southern African Development Community (SADC) Parliamentarians join forces to advance the Right to Food and agrifood systems transformation

Source: APO

Amid growing food insecurity and malnutrition across Southern Africa, parliamentarians are stepping up to drive legislative solutions. From 22 to 24 July 2025, parliamentarians from across the region – are gathering in Johannesburg, South Africa, for a high-level meeting and training organized by the SADC Parliamentary Forum (SADC PF) and the Food and Agriculture Organization of the United Nations (FAO). The aim is to enhance legislative capacity, foster collaboration, and operationalize the newly formed SADC Parliamentary Alliance on Agrifood Systems, Food Security and Nutrition.

This initiative comes at a pivotal time, as the region contends with overlapping shocks, from climate extremes to economic pressures, that continue to disrupt agrifood systems and widen inequality. It also builds momentum in the lead-up to the Third Global Parliamentary Summit against Hunger and Malnutrition, to be hosted in 2026 at the Pan-African Parliament headquarters in South Africa.

The event also commemorates the 20th anniversary of the Right to Food Guidelines, reaffirming the importance of national legal frameworks in securing the fundamental right to adequate food for all. In a region where undernutrition and hunger remain persistent, the meeting offers an opportunity to align parliamentary action with regional and global frameworks such as the African Union’s Agenda 2063, the Comprehensive Africa Agriculture Development Programme (CAADP), and SDG 2 – Zero Hunger.

The Alliance is envisioned as a platform to foster cross-border cooperation, enabling parliamentarians to share good practices, advocate for sustainable food systems, and shape policy dialogue at national, regional, and global levels.

FAO’s technical role in strengthening legal foundations

As the lead technical agency, FAO is supporting this process by providing legal expertise, delivering targeted training, and promoting the domestication of the Pan-African Parliament Model Law on Food Security and Nutrition.

As part of a global initiative funded by the Federal Ministry of Agriculture, Food and Regional Identity of Germany, FAO is equipping parliamentarians to legislate, monitor, and advance the right to food across diverse national contexts. Beyond the training, FAO’s support includes technical assistance to align national laws with the Model Law’s provisions—ensuring countries have the legal tools needed to address food insecurity through inclusive and rights-based approaches. This is part of FAO’s broader commitment to strengthening governance mechanisms and embedding food systems transformation within sustainable development priorities.

Building on the establishment of the Alliance in December 2024, supported by FAO and the Spanish cooperation agency (AECID), the adoption of the Alliance’s first work plan and the establishment of its governance structures mark the beginning of a long-term process.

Realizing the right to food requires sustained political will, robust legal frameworks, and active parliamentary engagement to protect biodiversity, support traditional food systems, and ensure that no one is left behind.

As the countdown to the 2026 Global Parliamentary Summit begins, FAO remains committed to supporting SADC parliamentarians in translating commitments into concrete, lasting impact. The road to Zero Hunger will require solid laws, inclusive institutions, and continued partnerships rooted in the shared vision of a food-secure future for all.

Distributed by APO Group on behalf of Food and Agriculture Organization of the United Nations (FAO): Regional Office for Africa.

Media files

.

MIL OSI Africa –

July 23, 2025
MIL-OSI Security: Illinois Tax Preparer Sentenced for Role in $3.6M Covid-19 Fraud Scheme

Source: United States Department of Justice Criminal Division

An Illinois man was sentenced yesterday to 42 months in prison for his role in a scheme to fraudulently obtain over $3.6 million in small business loans under the Coronavirus Aid, Relief, and Economic Security Act Paycheck Protection Program (PPP) and COVID19 Economic Injury Disaster Loan (EIDL) program implemented by the Small Business Administration (SBA).

According to court documents, Farooq Khan, 31, of Chicago, owned and operated Hannan Tax Services (Hannan Tax), a tax preparation company located in Chicago. From approximately May 2020 through October 2021, through Hannan Tax, Khan prepared and facilitated the submission of at least 30 fraudulent applications for loans through the PPP and EIDL program. At the time Kahn prepared and submitted the applications, he knew that the companies for which he sought the loans were non-operational and did not qualify. He also knowingly falsified the information contained in the applications, including the number of employees and tax records attributed to the defunct companies. Khan caused approximately $3.6 million to be fraudulently distributed by the SBA and PPP lenders. He also attempted to obtain at least an additional $588,900 in loans through other EIDL applications that were never funded for nonexistent companies. He personally obtained approximately $1.2 million of the fraudulent loan proceeds.

Khan pleaded guilty to one count of wire fraud on Feb. 19. At sentencing, he was also ordered to pay $3,645,104 in restitution.

Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department’s Criminal Division, Special Agent in Charge Douglas S. DePodesta of the FBI Chicago Field Office, and Special Agent-in-Charge Matthew J. Scarpino of Immigration and Customs Enforcement Homeland Security Investigations (ICE-HSI) Chicago made the announcement.

The FBI Chicago Field Office and ICE-HSI are investigating the case.

Trial Attorney Claire Sobczak Pacelli of the Criminal Division’s Fraud Section is prosecuting the case.

Anyone with information about allegations of attempted fraud involving COVID-19 can report it by calling the Justice Department’s National Center for Disaster Fraud (NCDF) Hotline at 8667205721 or via the NCDF Web Complaint Form at www.justice.gov/disaster-fraud/ncdf-disaster-complaint-form.

MIL Security OSI –

July 23, 2025
MIL-OSI Security: Stanislaus County Mother-Son Duo Sentenced to Prison for Inmate Unemployment Insurance Claims Conspiracy

Source: US FBI

Jaime Ornelas, 27, formerly of Modesto, was sentenced today by U.S. District Judge Dena Coggins to three years and one month in prison and ordered to pay $150,000 in restitution for conspiracy to commit mail fraud arising from fraudulently submitted unemployment insurance benefits, Acting U.S. Attorney Kimberly A. Sanchez announced.

On June 6, 2025, Jaime Ornelas’s mother and co-defendant Misty Ornelas, 48, of Turlock, was sentenced to 18 months in prison.

According to court documents, beginning in June 2020, Jaime Ornelas and Misty Ornelas operated a scheme to submit fraudulent unemployment insurance benefit claims to the California Employment Development Department (EDD). Jaime Ornelas, who was then-incarcerated at the High Desert State Prison in Lassen County, provided Misty Ornelas personally identifiable information of fellow inmates. Misty Ornelas then used that information to submit fraudulent unemployment insurance benefit applications to EDD. The submitted applications misrepresented the eligibility of the inmates, including that they had last worked within the prior few months and had become unemployed because of the COVID-19 pandemic. The fraudulent claims were worth more than $150,000.

This case was the product of an investigation by Federal Bureau of Investigation and EDD. Assistant U.S. Attorneys Chan Hee Chu and Denise N. Yasinow prosecuted the case.

This case is part of the California COVID-19 Fraud Enforcement Strike Force, which is one of the interagency COVID-19 fraud strike forces established by the United States Department of Justice. The California Strike Force combines law enforcement and prosecutorial resources in the Eastern and Central Districts of California, and focuses on large-scale, multistate, and egregious pandemic relief fraud. The strike force uses prosecutor-led, and data analyst-driven, teams to identify and bring to justice those who stole pandemic relief money.

MIL Security OSI –

July 23, 2025
MIL-OSI Security: Stanislaus County Mother-Son Duo Sentenced to Prison for Inmate Unemployment Insurance Claims Conspiracy

Source: US FBI

Jaime Ornelas, 27, formerly of Modesto, was sentenced today by U.S. District Judge Dena Coggins to three years and one month in prison and ordered to pay $150,000 in restitution for conspiracy to commit mail fraud arising from fraudulently submitted unemployment insurance benefits, Acting U.S. Attorney Kimberly A. Sanchez announced.

On June 6, 2025, Jaime Ornelas’s mother and co-defendant Misty Ornelas, 48, of Turlock, was sentenced to 18 months in prison.

According to court documents, beginning in June 2020, Jaime Ornelas and Misty Ornelas operated a scheme to submit fraudulent unemployment insurance benefit claims to the California Employment Development Department (EDD). Jaime Ornelas, who was then-incarcerated at the High Desert State Prison in Lassen County, provided Misty Ornelas personally identifiable information of fellow inmates. Misty Ornelas then used that information to submit fraudulent unemployment insurance benefit applications to EDD. The submitted applications misrepresented the eligibility of the inmates, including that they had last worked within the prior few months and had become unemployed because of the COVID-19 pandemic. The fraudulent claims were worth more than $150,000.

This case was the product of an investigation by Federal Bureau of Investigation and EDD. Assistant U.S. Attorneys Chan Hee Chu and Denise N. Yasinow prosecuted the case.

This case is part of the California COVID-19 Fraud Enforcement Strike Force, which is one of the interagency COVID-19 fraud strike forces established by the United States Department of Justice. The California Strike Force combines law enforcement and prosecutorial resources in the Eastern and Central Districts of California, and focuses on large-scale, multistate, and egregious pandemic relief fraud. The strike force uses prosecutor-led, and data analyst-driven, teams to identify and bring to justice those who stole pandemic relief money.

MIL Security OSI –

July 23, 2025
MIL-OSI USA: Illinois Tax Preparer Sentenced for Role in $3.6M Covid-19 Fraud Scheme

Source: US State of North Dakota

An Illinois man was sentenced yesterday to 42 months in prison for his role in a scheme to fraudulently obtain over $3.6 million in small business loans under the Coronavirus Aid, Relief, and Economic Security Act Paycheck Protection Program (PPP) and COVID19 Economic Injury Disaster Loan (EIDL) program implemented by the Small Business Administration (SBA).

According to court documents, Farooq Khan, 31, of Chicago, owned and operated Hannan Tax Services (Hannan Tax), a tax preparation company located in Chicago. From approximately May 2020 through October 2021, through Hannan Tax, Khan prepared and facilitated the submission of at least 30 fraudulent applications for loans through the PPP and EIDL program. At the time Kahn prepared and submitted the applications, he knew that the companies for which he sought the loans were non-operational and did not qualify. He also knowingly falsified the information contained in the applications, including the number of employees and tax records attributed to the defunct companies. Khan caused approximately $3.6 million to be fraudulently distributed by the SBA and PPP lenders. He also attempted to obtain at least an additional $588,900 in loans through other EIDL applications that were never funded for nonexistent companies. He personally obtained approximately $1.2 million of the fraudulent loan proceeds.

Khan pleaded guilty to one count of wire fraud on Feb. 19. At sentencing, he was also ordered to pay $3,645,104 in restitution.

Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department’s Criminal Division, Special Agent in Charge Douglas S. DePodesta of the FBI Chicago Field Office, and Special Agent-in-Charge Matthew J. Scarpino of Immigration and Customs Enforcement Homeland Security Investigations (ICE-HSI) Chicago made the announcement.

The FBI Chicago Field Office and ICE-HSI are investigating the case.

Trial Attorney Claire Sobczak Pacelli of the Criminal Division’s Fraud Section is prosecuting the case.

Anyone with information about allegations of attempted fraud involving COVID-19 can report it by calling the Justice Department’s National Center for Disaster Fraud (NCDF) Hotline at 8667205721 or via the NCDF Web Complaint Form at www.justice.gov/disaster-fraud/ncdf-disaster-complaint-form.

MIL OSI USA News –

July 23, 2025
MIL-OSI Security: Hermandad de Pistoleros Latinos gang member sentenced to 100 months for heroin trafficking

Source: United States Bureau of Alcohol Tobacco Firearms and Explosives (ATF)

LAREDO, Texas – A 33-year-old Laredo man has been sentenced for possession with the intent to distribute 100 grams or more of heroin, announced U.S. Attorney Nicholas J. Ganjei.

Raul Garcia Jr. aka Rule pleaded guilty Aug. 6. 2024.

U.S. District Judge Keith P. Ellison has now ordered Garcia to serve 100 months in federal prison to be immediately followed by four years of supervised release. At the hearing, the court heard about Garcia’s numerous prior convictions and contacts with law enforcement. In handing down the sentence, the court noted this was a serious crime.

The investigation began in January 2024 when law enforcement learned Garcia may have been selling fentanyl in the Laredo area. Over the next three months, authorities discovered Garcia was selling narcotics out of his home.

A search warrant in March of that year resulted in the discovery of heroin packaged for street sale. A month later, law enforcement obtained a second search warrant and again found heroin. Similar to previously found drugs, the heroin was also packaged for street sale.

The searches also revealed methamphetamine, crack cocaine, fentanyl, marijuana, money and stolen firearm.

At the time of his plea, Garcia admitted to possessing the drugs located and seized throughout the investigation.

He will remain in custody pending transfer to a Federal Bureau of Prisons facility to be determined in the near future.

The Drug Enforcement Administration, Bureau of Alcohol, Tobacco, Firearms and Explosives and the Laredo Police Department’s Narcotics Division conducted the investigation with assistance from Immigration and Customs Enforcement – Homeland Security Investigations and Border Patrol. Assistant U.S. Attorneys Steven Chamberlin and Leslie Cortez prosecuted the case.

This case is being prosecuted as part of an Organized Crime Drug Enforcement Task Forces (OCDETF) investigation. OCDETF is the largest anti-crime task force in the country. OCDETF identifies, disrupts and dismantles the highest-level criminal organizations that threaten the United States using a prosecutor-led, intelligence-driven, multi-agency approach. Additional information about the OCDETF Program can be found on the Department of Justice’s OCDETF webpage.

MIL Security OSI –

July 23, 2025
MIL-OSI Security: Spree of Violent Robberies Nets Previously Convicted Killer an Additional 42 Months in Federal Prison

Source: US FBI

WASHINGTON – Glenn Dolford, 32, of the District of Columbia, was sentenced today in U.S. District Court to 42 months in federal prison for his role in a spree of Hobbs Act offenses that included the violent robberies in June 2020 of a Maryland pharmacy and a Maryland phone store, announced U.S. Attorney Jeanine Ferris Pirro.

Dolford pleaded guilty on February 28, 2025, before U.S. District Court Judge Amy Berman Jackson to two counts of interference with interstate commerce by threat or violence. In addition to the prison term, Judge Berman Jackson ordered three years of supervised release.

Joining in the announcement was FBI Assistant Director in Charge Steven J. Jensen of the Washington Field Office.

Dolford was previously convicted in 2023 of second-degree murder while armed, aggravated assault while armed, and assault with a deadly weapon for killing one man and shooting two others on Super Bowl Sunday in February 2020. For those crimes he was arrested in June 2020 and sentenced in June 2023 to more than 22 years in prison.

According to court documents, on June 8, 2020, Dolford and three co-conspirators traveled from the District to a CVS Pharmacy in Nottingham, Maryland. As one subject stayed in their car, Dolford and two others entered the store. As a store employee was attempting to run away from the subjects, Dolford threw him to the floor, punched him in the head, and held him down with his foot on the employee’s back.

Dolford’s two co-conspirators demanded narcotics and ordered another employee to empty the safe and hand over his phone and wallet. Dolford and the co-conspirators fled in a silver VW Jetta with $1,000 worth of hydrocodone and the one employee’s personal items.

On June 9, 2020, Dolford and two co-conspirators traveled from the District to a T-Mobile store in College Park. Dolford forced the store employees to the back of the store as another conspirator said “give me all the phones or I’ll kill you.” Dolford and his co-conspirators fled the store in a silver VW Jetta with phones valued at about $20,000.

Investigators determined Dolford rented the silver Jetta on May 28, 2020, from Enterprise Rent-a-Car. In June 2023, Dolford was indicted in U.S. District Court on Conspiracy and Hobbs Act robbery charges for his involvement in the June 8 and 9 robberies.

Co-defendant Floyd Neal, 32, of Washington, D.C., was sentenced on July 17, 2024, to more than 157 months in prison for his role in a rash of 2021 gunpoint robberies of pharmacies in Maryland and Virginia.

Co-defendant Ashawntea Henderson, 32, of Washington, D.C., was sentenced on Feb. 18, 2025, to 52 months in federal prison for participating in an early morning robbery of a drug store at the Jersey Shore. During the May 2020 robbery, he and his co-conspirators jumped the counter, overpowered the night pharmacist, stole thousands of prescription narcotics, and then – as they attempted to flee to the District – crashed into a responding police cruiser.

This case was investigated by the FBI Washington Field Office’s Violent Crimes Task Force, the Metropolitan Police Department, and the Prince George’s County Police Department. The matter is being prosecuted by Assistant U.S. Attorneys Cameron Tepfer, Kyle McWaters, Sarah Martin, and Josh Gold.

23cr190

MIL Security OSI –

July 23, 2025
MIL-OSI Security: U.S. Attorney’s Office, Law Enforcement, Community Partners to Host National Night Out Event in East St. Louis

Source: US FBI

EAST ST. LOUIS, Ill. – To strengthen relationships between residents and law enforcement, the U.S. Attorney’s Office in the Southern District of Illinois, event organizers and police officials are inviting the East St. Louis community to a free event with activities for attendees of all ages to celebrate National Night Out.

The event will be held from 5 to 7:30 p.m. on Tuesday, Aug. 5 at 8206 State St. in East St. Louis.

Community partners will give out school supplies to students, provide food to families and offer an array of activities like competitive games, police demonstrations, and a live DJ. This National Night Out is a free event for East St. Louis residents.

Ameren Illinois, ATF, Catholic Urban Programs, the City of East St. Louis, Community Development Sustainable Solutions, Community Life Line, DEA, the East St. Louis Police Department, the FBI Springfield Field Office, Illinois State Police, IRS Criminal Investigation, the U.S. Attorney’s Office and the U.S. Marshals Service are partnering to host the event.

National Night Out is an annual community-building campaign that promotes community partnerships with police and neighborhood camaraderie.

MIL Security OSI –

July 23, 2025
MIL-OSI: Leo Berwick Secures $75 Million Financing Facility from Stone Point Credit to Accelerate Strategic Growth

Source: GlobeNewswire (MIL-OSI)

NEW YORK, July 22, 2025 (GLOBE NEWSWIRE) — Leo Berwick, a premier global tax and financial advisory firm, serving preeminent infrastructure, private equity, and pension funds and their portfolio companies, announced today that it has executed a credit facility for up to $75 million from Stone Point Credit (“Stone Point”), a leading private credit investment firm, subject to the agreed upon conditions between the parties.

Since its founding in 2021, Leo Berwick has rapidly become a leader in infrastructure and energy tax and financial advice. The firm continues to grow and launch new practice areas related to valuation, cost segregation, modeling, and financial due diligence across multiple sectors and remains active in looking for opportunities to further expand its premium service offerings to its global clients.

“We are thrilled to partner with Stone Point as we enter our next phase of growth,” said Nick Kato, Managing Partner of Leo Berwick. “This financing will allow us to accelerate our strategic initiatives, expand our capabilities, and continue delivering exceptional value and service to our clients.”

The facility earmarks a portion of proceeds for strategic M&A and other growth initiatives, which are core parts of Leo Berwick’s strategic roadmap.

“Our aspiration,” continued Kato, “is to offer clients a better alternative to the Big 4, including greater technology enablement, global capabilities, and unmatched sector expertise, while cultivating an agile, commercial, and solution-focused culture to create meaningful value for our clients.”

Scott Bronner, Head of Credit at Stone Point, added, “We are very excited to support the Leo Berwick team as they look to build out their M&A strategy to complement their strong history of organic growth.”

Perella Weinberg served as financial advisor and Polsinelli served as legal advisor to Leo Berwick. Cahill Gordon & Reindel LLP served as legal advisor to Stone Point.

ABOUT LEO BERWICK

Leo Berwick is a commercially focused tax and financial advisory firm supporting the needs of the world’s largest infrastructure funds, infrastructure and energy developers, pension funds, sovereign wealth funds, private equity firms and their portfolio companies, publicly-listed corporations and private strategic investors across all sectors, with deep expertise in infrastructure and energy. The team is made up of over 100 M&A advisory leaders and specialists from the Big 4 and Big Law. Leo Berwick is known for maximizing value and minimizing risk by fostering successful long-term partnerships with clients. For more information, please visit https://www.leoberwick.com.

ABOUT STONE POINT CREDIT

Stone Point Credit is the credit-investing platform established by Stone Point Capital, with more than $10 billion of assets under management. Stone Point Credit manages a range of private and liquid credit strategies, with a focus on investments in the financial services, business services, software and technology, and healthcare services sectors. For more information, please visit www.stonepoint.com/credit.

LEO BERWICK MEDIA CONTACT

Heather Godsmark, Chief Clients and Markets Officer
info@leoberwick.com

STONE POINT MEDIA CONTACT

Stone Point Credit Investor Relations
spcreditir@stonepoint.com

The MIL Network –

July 23, 2025
MIL-OSI Australia: City of Wanneroo adopts 2025/26 budget

Source: South Australia Police

The City of Wanneroo has adopted its 2025/26 budget, prioritising a range of services and facilities to keep our community connected, safe and sustainable.

Council adopted a 3.5 per cent rate increase across all rating categories, and a 3 per cent increase for residential ratepayers which amounts to less than $1 per week for most homeowners.

Mayor Linda Aitken said the $353.4 million budget included a $132.6 million capital works program and investment in a range of community services and facilities to benefit all residents.

“We are committed to providing the programs, services, facilities and infrastructure our community needs and expects, while remaining mindful of the cost-of-living challenges people are facing,” she said.

“As one of Australia’s fastest-growing local government areas, we have a duty to ensure value for money for our ratepayers. Half of this year’s budget is funded from sources beyond rates, thanks to strong partnerships and a strategic focus on alternative revenue streams.”

“The City looks forward to delivering on this budget and continuing to build a thriving, inclusive and sustainable City for the generations to come.”

2025/26 capital works program highlights

Community recreation and facilities

Over the next 12 months, the City will spend $60.9 million on upgrades to existing sporting facilities and the construction of new facilities to ensure local families and sporting clubs can stay healthy, active and connected.

This includes $48.9 million to progress the construction of the Alkimos Aquatic and Recreation Centre.

A $1.3 million investment will progress the design of a new sports hub for the Wanneroo Recreation Centre, a further $470,000 will progress a new amenities building at Abbeville Park in Mindarie, and $230,000 for an extension to the existing Wanneroo Showgrounds Clubrooms.

Construction of the highly anticipated Dordaak Kepup library and youth innovation hub is scheduled for completion, with the $18 million Landsdale facility set to open its doors in December 2025.

$1.6 million will support upgrades to Gumblossom Community Centre in Quinns Rocks, Yanchep Community Centre, Carramar Community and Butler Community Centre.

An additional $1 million will support the Girrawheen Hub Redevelopment project.

Waste management

We’ve allocated $4.4 million to support more sustainable and efficient waste management processes. Funding will progress the development of a recycling centre in Neerabup and waste transfer stations in Neerabup and Wangara.

Community safety

We’re investing $3.7 million to community safety measures this year, including $1.6 million to upgrade the Two Rocks Bush Fire Brigade.

We’ll also spend $1.6 million to commence detailed design for the Wanneroo Emergency Services Precinct, to ensure the City is better prepared for bushfires and other emergencies.

Parks, playgrounds and pathways

We’re committing $6.7 million towards park and playground upgrades, to ensure the community can enjoy our City’s natural environment. This work will include replacing playground equipment, shade structures, picnic shelters, barbecues and drink fountains.

A $515,000 investment will provide new play spaces at Rotary Park, and $320,000 will complete the construction of new toilet facilities at Amery Park in Hocking.

We’ve allocated $6.7 million to new and upgraded pathways and trails across the City, including new shared paths in Alexander Heights and from Butler to Alkimos Station.

A further $815,000 will provide pathway lighting at Kingsbridge, Chesterfield, Brampton, Lighthouse and Delamere parks.

Local roads

With a focus on creating a safe and connected City, we’ve allocated $18.2 million this year to road upgrades and traffic treatments.

This includes $4.8 million for Flynn Drive upgrades between Mather Drive and Old Yanchep Road.

We’re also spending $1.3 million on upgrades to the intersection of Marangaroo Drive and Girrawheen Avenue, and $750,000 on the construction of a dual carriageway between Marmion Avenue to Spinnaker Boulevard on Yanchep Beach Road.

In additional to the budget, the City is launching a new online payment portal this August, providing residents with a more flexible and user-friendly way to manage their rates.

The portal offers a variety of automated payment options, such as weekly, fortnightly or monthly direct debit payments, depending on what suits your budget.

For more information on the City’s 2025/26 budget and or the online payment portal, visit wanneroo.wa.gov.au/budget.

Please note, some figures have been rounded to nearest decimal whole number.

MIL OSI News –

July 23, 2025
MIL-OSI NGOs: Iran: Deliberate Israeli attack on Tehran’s Evin prison must be investigated as a war crime

Source: Amnesty International –

The Israeli military’s deliberate air strikes on Evin prison in Tehran on 23 June 2025 constitute a serious violation of international humanitarian law and must be criminally investigated as war crimes, Amnesty International said today, following an in-depth investigation.

Verified video footage, satellite imagery and interviews with eyewitnesses, prisoners’ families and human rights defenders indicate that the Israeli military carried out multiple air strikes on Evin prison, killing and injuring scores of civilians and causing extensive damage and destruction in at least six locations across the prison complex. The attack took place during the working day, at a time when many parts of the prison were packed with civilians. Hours later, the Israeli military confirmed it had attacked the prison and senior Israeli officials boasted about it on social media. According to the Iranian authorities, at least 80 civilians – 79 men and women and a five-year-old boy – were killed.

Under international humanitarian law, a prison or place of detention is presumed a civilian object and there is no credible evidence in this case that Evin prison constituted a lawful military objective.

The evidence establishes reasonable grounds to believe that the Israeli military brazenly and deliberately attacked civilian buildings.

Erika Guevara Rosas, Senior Director for Research, Advocacy, Policy and Campaigns.

“The evidence establishes reasonable grounds to believe that the Israeli military brazenly and deliberately attacked civilian buildings. Directing attacks at civilian objects is strictly prohibited under international humanitarian law. Carrying out such attacks knowingly and deliberately constitutes a war crime,” said Erika Guevara Rosas, Senior Director for Research, Advocacy, Policy and Campaigns.

It is believed that Evin prison held around 1,500-2,000 prisoners at the time of the attack, including arbitrarily detained human rights defenders, protesters, political dissidents, members of persecuted religious minorities, and dual and foreign nationals frequently held for diplomatic leverage. At any given time, there were also hundreds of other civilians in the prison complex. The attack took place during prison visitation hours.

“The Israeli forces should have known that any air strikes against Evin prison could result in significant civilian harm. Prosecution authorities around the world must ensure that all those responsible for this deadly attack are brought to justice, including through use of the principle of universal jurisdiction. The Iranian authorities must also grant the International Criminal Court jurisdiction over all Rome Statute crimes committed on or perpetrated from its territory, said Erika Guevara Rosas.

An overview of Evin prison, with the exterior walled perimeter marked in orange. The six yellow circles highlight areas with the most significant destruction, indicating these were the locations where the munitions landed. The blasts and resulting damage extended beyond the six areas.

A map of Evin prison indicating building names or functions based on Amnesty International’s interviews with former prisoners.

Scores of civilians killed and injured

Between 11am to 12pm Tehran time on 23 June 2025, Israeli air strikes hit multiple locations over 500 metres apart inside Evin prison, destroying or damaging numerous buildings and other structures within the prison complex, as well as nearby residential buildings outside the complex.

Evin prison is located in a populated area with residential buildings to its east and south. A nearby resident described the scene following the attack to Amnesty International:

“I suddenly heard a terrible sound. I looked out of the window and realised that smoke and dust were rising from Evin prison. Both the sound of the explosion and the appearance of the dust and smoke were horrific… I had thought our home would be safe [as] we are near a prison… I couldn’t believe it.”

The authorities have so far named 57 civilians who were killed in the attack including five female social workers, 13 young men performing mandatory national service as prison guards or administrators, and 36 other prison staff – 30 men and six women – and the child of one of the social workers. After drawing public criticism for failing to disclose the identities of prisoners, their relatives and nearby residents killed, the authorities published a report on 14 July 2025 revealing two names: a nearby resident – Mehrangiz Imanpour – and a woman volunteering to help raise funds for debt prisoners – Hasti Mohammadi. Amnesty International had already verified the name of Mehrangiz Imanpour, as well as the names of one prisoner, Masoud Behbahani, a prisoner’s relative, Leila Jafarzadeh, and a passerby Aliasghar Pazouki, who were also killed.

Israeli officials’ self-incriminating admissions

Within hours of the attack, senior Israeli officials boasted about it on social media, framing it as a “targeted strike” against a “symbol of oppression for the Iranian people.”

Israel’s Defence Minister, Israel Katz, said on X that Israeli forces were attacking with “unprecedented force regime targets and government repression bodies in the heart of Tehran including…Evin prison.”

Minutes later, Foreign Affairs Minister Gideon Sa’ar posted on X: “We warned Iran time and again: stop targeting civilians! They continued, including this morning. Our response: [Long live freedom…].” Alongside this post was a video purporting to show CCTV footage of the prison gate being blown up. Analysis of the video by Amnesty International indicates the footage was digitally manipulated likely using an old photograph of the prison gate. The video was first posted on Persian-language Telegram channels, but Amnesty International could not trace its original source.

Later the same day, the Israeli military confirmed in a statement that they had carried out “a targeted strike” on “the notorious Evin Prison”. The statement appeared to justify the attack by saying that “enemies of the regime” were held and tortured there and alleging that “intelligence operations against the State of Israel, including counter espionage” were carried out in the prison. However, the interrogation of detainees accused of spying for Israel or the presence of intelligence officials within the prison compound would not render the penal facility itself a legitimate military objective under international humanitarian law.

Entrance gate and prosecution office in the south

Before and after false-colour, near infrared satellite imagery from 10 April 2025 and 30 June 2025 reveals the destruction in four distinct locations in the south and central parts of Evin prison where munitions likely landed (shown with yellow circles) and signs of burning (visible in near-infrared in dark black hues) in many areas, likely from vehicles that caught fire and spread to buildings in the area.

In the south of the prison, the main entrance gate, along with the adjoining wall and the visitor information building to the east of the gate were destroyed. The building to the west of the gate and the adjoining Shahid Moghaddas prosecution office were extensively damaged. Further inside the southern part of the prison, the car park and a building next to the Quarantine section were damaged.

An informed source told Amnesty International that a woman named Leila Jafarzadeh, 35, was killed while visiting the prosecution office to post bail to secure the release of her imprisoned husband.

The destruction of the entrance gate and its surroundings was captured in a verified video showing rescue workers carrying at least one injured person on a stretcher amid scenes of destruction and extensive rubble on the ground.

Footage published by state media and verified by Amnesty International also shows structural damage to the prosecution office’s walls and building framework, indicating that the force of the blast penetrated deep into the building.

Satellite imagery from 30 June 2025 reveals a location (shown with a yellow circle) where munitions likely landed. Ground images (right) geolocated to the north and south areas of the southern entrance gate show major destruction.

Administrative building and quarantine section housing prisoners

Deeper inside the southern area of the prison, the administrative building and a smaller adjoining building which, according to a former prisoner, contained an office of the prison’s security force called the Protection Cohort, were significantly impacted, while several nearby structures were destroyed.

Satellite imagery from 30 June 2025 shows significant damage to part of the roof on the west side of the Protection Cohort building. Satellite imagery further shows that to the east of the building, an internal gate, perimeter wall and two small structures – likely guard posts – were all destroyed in the strike.

The two identified locations are consistent with the analysis of video footage and information received from two former prisoners of conscience Atena Daemi and Hossein Razagh.

Verified videos also depict destroyed windows, collapsed walls and extensive rubble on both the western and eastern sides of the administrative building. The first floor appears to be largely obliterated, with missing structural walls visible in multiple sections.

An image published by state media and verified by Amnesty International shows what appears to be a crater inside the west side of the administrative building showing the first floor collapsed downward.

According to a state media report on 6 July 2025, at least nine women, one man and a child were killed in the administrative building. Shargh Daily and Hammihan, two prominent newspapers in Iran, named three of the victims in reports published on 25 June and 1 July 2025, respectively. They included social worker Zahra Ebadi, 52, who was killed along with her five-year-old son, Mehrad Kheiri; and an administrative staff member, Hamid Ranjbari, 40.

Satellite imagery (left) from 30 June 2025 reveals two locations (shown with yellow circles) where munitions likely landed. Ground images (right) show extensive damage to the administrative building.

Analysis of a verified video footage also shows that the quarantine section housing newly admitted prisoners, located near the administrative building, also sustained damage.

Medical clinic, kitchen and sections housing prisoners in the central part

In the central part of the prison, the medical clinic, central kitchen, section 4 housing male prisoners, section 209 which consists of solitary confinement cells where female and male prisoners are detained by the Minister of Intelligence, and the women’s section were extensively damaged.

Satellite imagery shows significant damage to structures adjacent to the medical clinic, while verified videos reveal damage to the clinic from the blast and burning cars.

A verified video shows the outside of the medical clinic covered in black soot and black smoke billowing from the windows. Another video shows significant destruction inside, with shattered windows, beds and medical equipment overturned and extensive rubble.

Satellite imagery (left) from 30 June 2025 reveals two locations (shown with yellow circles) where munitions likely landed. Geolocated photos and videos (right) show that the vehicle entrance gate collapsed. The clinic’s interior was significantly damaged, with walls and windows blown out, while the exterior shows severe fire damage and smoke.

The verified video evidence supports accounts from human rights defenders Narges Mohammadi and Sepideh Gholian, both based in Iran, who told Amnesty International that multiple eyewitnesses in Evin prison described to them extensive damage to the medical clinic. Narges Mohammadi shared that male prisoners in section 4, which is opposite the medical clinic, informed her the prison’s ambulance was destroyed, an account supported by video showing nearby vehicles reduced to wreckage. She also said the prisoners told her they witnessed an individual with extensive burns on their body walking out of the medical clinic and collapsing on the ground.

Two prisoners – Abolfazl Ghodiani and Mehdi Mahmoudian – who survived the Evin prison attack and were transferred to Greater Tehran Penitentiary wrote in a letter from inside prison published online on 1 July 2025:

“Evin prison shook with several consecutive explosions. Two or three blasts occurred near Section 4 and when prisoners exited the section’s door, they saw the medical clinic burning… Prisoners recovered the bodies of around 15-20 people, including medical clinic personnel, prisoners, warehouse staff, guards and agents from beneath the rubble.”

Saeedeh Makarem, a doctor volunteering in Evin prison who was injured, including with burns, described in a series of posts on Instagram in July 2025 how prisoners helped her:

“They dragged me to the corner of the wall. I was half-conscious. They brought me water and a blanket, put a splint in my leg, wiped the blood from my face… They could have left, but they didn’t… They saved me.”

Political dissident Hossein Razagh also told Amnesty International that section 4 prisoners described to him how prisoners were thrown against the walls due to the force of the blast and sustained head and face injuries.

These testimonies are corroborated by a verified video showing extensive damage to the front parts of sections 4 and 209. External doors and windows of sections 4 and 209 appear to have been shattered, with parts of the roof structure collapsed and large piles of rubble visible in the road.Multiple vehicles are destroyed and burned out, with black smoke damage on the surrounding building walls, indicating some of the fire may have originated from the cars. Satellite imagery from 30 June 2025 shows the burned buildings and black scorch marks from the cars The blast also appears to have affected the roof of the prison kitchen and damaged its windows.

According to Amnesty International’s research, the blast also affected section 209 staff offices, trapping some agents and guards under the rubble. Authorities have provided no information about the fate and whereabouts of prisoners held in solitary confinement in section 209, raising concerns about possible deaths or injuries.

Image showing the road with Section 209 on one side (left) and the vehicle entrance gate on the opposite side (right).

Amnesty International confirmed through an informed source the name of a prisoner in section 4, Masoud Behbahani, aged 71, who was killed. He suffered a heart attack when the blast threw him onto a chair and several prisoners fell on him. According to the source, instead of transferring him to a hospital, authorities transferred him to Greater Tehran Penitentiary where he died two days later after a second heart attack.

Amnesty International also analysed an image taken from inside the Women’s section showing visible damage to the ceiling and electrical infrastructure.

Entrance gate, judicial complex, visitation building and sections housing prisoners in the North

Before and after false-colour, near infrared imagery from 10 April 2025 and 27 June 2025 reveals the destruction in two distinct locations where munitions likely landed in the northern part of Evin prison (shown with yellow circles): the internal security walls and road in front of sections 240 and 241 and the north entrance gate in front of the visitation building and Shaheed Kachouyee judicial complex.

In the northern part of the prison, as visible in satellite imagery and verified videos, the entrance gate and adjacent wall were destroyed; the front part of the building containing the Shahid Kachouyee judicial complex and visitation building were extensively damaged; and two internal walls near sections 240 and 241 housing prisoners were destroyed.

Verified video and photographs also show blast-related damage to nearby high-rise residential buildings and vehicles outside the northern area of Evin prison. One video captures dozens of distressed people in Ahmadpour Street, at least one of whom appears to be injured.

An informed source described to Amnesty International how a nearby resident, Mehrangiz Imanpour, a 61-year-old painter who lived in Ahmadpour Street, was killed on her way home.

Shargh Daily reported that another passerby, Ali Asghar Pazouki, 69, was killed in front of the judicial complex and visitation building.

State media published videos and photographs which show blast damage in this area.

Satellite imagery (left) from 30 June 2025 reveals a location (shown with a yellow circle) where munitions likely landed. Geolocated images and videos (right) show extensive damage to the exterior and interior of the visitation building with windows shattered and parts of the roof and facade collapsed.

Satellite imagery analysed by Amnesty International indicates that a road and two security walls deeper within the northern part of the prison, near a building containing sections 240 and 241, were also destroyed. These sections are known to contain hundreds of solitary confinement cells, but no images showing the condition of the building have emerged and the authorities have not released any information about the fate of prisoners held there.

Amnesty International received accounts from prisoners’ families indicating that section 8, near sections 240 and 241, was damaged. Human rights lawyer Nasrin Sotoudeh told Amnesty International that her arbitrarily imprisoned husband, human rights defender, Reza Khandan, and other prisoners, were injured when rubble was propelled into the courtyard.

Political dissident Mohammad Nourizad, who was in section 8, called his family while the air strikes were ongoing. A recording of his call was published online on 24 June:

“They are dropping bombs on us. Some people are injured, the windows have broken, and everyone has scattered… They just hit again. I don’t know, it seems intentional… but bombing a prison is incompatible with any logic or code of conduct…They [prison authorities] closed the doors on us and we have no news.”

International law and standards

Under international humanitarian law, direct attacks on civilians and civilian objects are prohibited. Attacks may only be directed at combatants and military objectives. Military objectives are limited to those objects which by their nature, location, purpose or use make an effective contribution to military action and whose partial or total destruction, capture or neutralization, in the circumstances ruling at the time, offers a definite military advantage.

Attacking forces have an obligation to do everything feasible to protect civilians including by distinguishing between military targets and civilian objects; verifying whether their intended target is a military objective and canceling an attack if there is doubt; choosing means and methods of attack that will avoid, or in any event, minimize civilian harm; and providing effective advance warning to civilians unless circumstances do not permit. Even when targeting a legitimate military objective, an attack must not be carried out which may cause civilian harm that would be disproportionate in relation to the concrete and direct military advantage anticipated. If distinguishing between civilian objects and military targets is not feasible, the attack must not proceed.

States responsible for violations of international humanitarian law are required to make full reparations for the loss or injury caused. The UN Basic Principles and Guidelines on the Right to a Remedy and Reparation for Victims of Gross Violations of International Human Rights Law and Serious Violations of International Humanitarian Law enshrine the duty of states to provide effective remedies, including reparation to victims, including restitution, compensation, rehabilitation, satisfaction and guarantees of non-repetition.

Methodology

Amnesty International’s Evidence Lab analyzed satellite images from before and after the strikes and verified 22 videos and 59 photographs, which show extensive damage and destruction to six areas in the south, central, and northern parts of Evin prison complex.

Additionally, Amnesty International reviewed statements by Israeli and Iranian authorities and interviewed 23 people inside and outside Iran, including seven prisoners’ relatives; a nearby resident who witnessed the attack; two sources with information about two victims killed; two journalists; and 11 former prisoners including dissidents and human rights defenders who received information from prisoners, prisoners’ families, prison staff and emergency services attending the site. The organization also obtained from a source the recordings of four telephone calls between four prisoners and their families hours after the attack.

Amnesty International sent questions regarding the attack to the Israeli Minister of Defence on 3 July. At the time of publication, no response had been received.

Background

During the escalation of hostilities between Israel and Iran, at least 1,100 people were killed in Iran, including 132 women and 45 children, according to Iran’s Foundation for Martyrs and Veterans Affairs. At least 29 people, including women and children, were killed in Israel, according to the Israeli Health Ministry.

As part of Amnesty International’s ongoing investigations into violations of international humanitarian law and other human rights violations in the context of the escalation of hostilities between Israel and Iran, the organization will also publish findings relating to attacks by the Iranian authorities against Israel.

MIL OSI NGO –

July 22, 2025
MIL-OSI NGOs: Iran: Deliberate Israeli attack on Tehran’s Evin prison must be investigated as a war crime – new evidence

Source: Amnesty International –

Video footage, satellite imagery, and eyewitness accounts reveal extensive civilian casualties and destruction

According to Iranian authorities, at least 80 civilians – 79 men and women and a five-year-old boy – were killed

Israeli military quickly claimed responsibility for the attack – senior officials boasted about it online

‘The evidence establishes reasonable grounds to believe that the Israeli military brazenly and deliberately attacked civilian buildings’ – Erika Guevara Rosas

The Israeli military’s deliberate air strikes on Evin prison in Tehran on 23 June constitute a serious violation of international humanitarian law and must be criminally investigated as war crimes, Amnesty International said today following a detailed investigation.

Verified video footage, satellite imagery, and interviews with eyewitnesses, prisoners’ families and human rights defenders indicate that the Israeli military carried out multiple air strikes on Evin prison, killing and injuring scores of civilians and causing extensive damage and destruction in at least six locations across the prison complex.

The attack occurred during the working day and prison visiting hours, when many parts of Evin prison were packed with civilians. At the time, the prison reportedly held between 1,500 and 2,000 detainees, including arbitrarily detained human rights defenders, protesters, political dissidents, persecuted religious minorities, and dual or foreign nationals often used as diplomatic leverage. Hundreds of civilians were also present within the complex. Hours after the strike, the Israeli military confirmed the attack, with senior officials publicly boasting about it on social media. According to Iranian authorities, at least 80 civilians – 79 men and women and a five-year-old boy – were killed.

Under international humanitarian law, a prison or place of detention is presumed a civilian object and there is no credible evidence in this case that Evin prison constituted a lawful military objective.

Erika Guevara Rosas, Amnesty International’s Senior Director for Research, Advocacy, Policy and Campaigns, said:

“The evidence establishes reasonable grounds to believe that the Israeli military brazenly and deliberately attacked civilian buildings. Directing attacks at civilian objects is strictly prohibited under international humanitarian law. Carrying out such attacks knowingly and deliberately constitutes a war crime.

“The Israeli forces should have known that any air strikes against Evin prison could result in significant civilian harm. Prosecution authorities around the world must ensure that all those responsible for this deadly attack are brought to justice, including through use of the principle of universal jurisdiction. The Iranian authorities must also grant the International Criminal Court jurisdiction over all Rome Statute crimes committed on or perpetrated from its territory.”

Scores of civilians killed and injured

Between 11am to 12pm Tehran time on 23 June, Israeli air strikes hit multiple locations over 500 metres apart inside Evin prison, destroying or damaging numerous buildings and other structures within the prison complex, as well as nearby residential buildings outside it.

An overview of Evin prison, with the exterior walled perimeter marked in orange. The six yellow circles highlight areas with the most significant destruction, indicating these were the locations where the munitions landed. The blasts and resulting damage extended beyond the six areas.

A map of Evin prison indicating building names or functions based on Amnesty’s interviews with former prisoners.

Evin prison is located in a populated area with residential buildings to its east and south. A nearby resident described the scene following the attack to Amnesty:

“I suddenly heard a terrible sound. I looked out of the window and realised that smoke and dust were rising from Evin prison. Both the sound of the explosion and the appearance of the dust and smoke were horrific… I had thought our home would be safe [as] we are near a prison… I couldn’t believe it.”

The authorities have so far named 57 civilians who were killed in the attack including five female social workers, 13 young men performing mandatory national service as prison guards or administrators, and 36 other prison staff – 30 men and six women – and the child of one of the social workers. After drawing public criticism for failing to disclose the identities of prisoners, their relatives and nearby residents who were killed, the authorities published a report on 14 July revealing two names: a nearby resident – Mehrangiz Imanpour – and a woman volunteering to help raise funds for debt prisoners – Hasti Mohammadi.

Amnesty had already verified the name of Mehrangiz Imanpour, as well as the names of one prisoner, Masoud Behbahani, a prisoner’s relative, Leila Jafarzadeh, and a passerby Aliasghar Pazouki, who were also killed.

Israeli officials’ self-incriminating admissions

Within hours of the attack, senior Israeli officials boasted about it on social media, framing it as a “targeted strike” against a “symbol of oppression for the Iranian people.”

Israel’s Defence Minister, Israel Katz, said on X that Israeli forces were attacking with “unprecedented force regime targets and government repression bodies in the heart of Tehran including…Evin prison”.

Minutes later, Foreign Affairs Minister Gideon Sa’ar posted on X: “We warned Iran time and again: stop targeting civilians! They continued, including this morning. Our response: [Long live freedom…].” Alongside this post was a video purporting to show CCTV footage of the prison gate being blown up. Analysis of the video by Amnesty indicates the footage was digitally manipulated likely using an old photograph of the prison gate. The video was first posted on Persian-language Telegram channels, but Amnesty could not trace its original source.

Later the same day, the Israeli military confirmed in a statement that they had carried out “a targeted strike” on “the notorious Evin prison”. The statement appeared to justify the attack by saying that “enemies of the regime” were held and tortured there and alleging that “intelligence operations against the State of Israel, including counter espionage” were carried out in the prison. However, the interrogation of detainees accused of spying for Israel or the presence of intelligence officials within the prison compound would not render the penal facility itself a legitimate military objective under international humanitarian law.

Entrance gate and prosecution office in the south

In the south of the prison, the main entrance gate, along with the adjoining wall and the visitor information building to the east of the gate were destroyed. The building to the west of the gate and the adjoining Shahid Moghaddas prosecution office were extensively damaged. Further inside the southern part of the prison, the car park and a building next to the quarantine section were damaged.

Before and after: false-colour, near infrared satellite imagery from 10 April and 30 June reveal the destruction in four distinct locations in the south and central parts of Evin prison where munitions likely landed (shown with yellow circles) and signs of burning (visible in near-infrared in dark black hues) in many areas, likely from vehicles that caught fire and spread to buildings in the area.

An informed source told Amnesty that a woman named Leila Jafarzadeh, 35, was killed while visiting the prosecution office to post bail in order to secure the release of her imprisoned husband.

The destruction of the entrance gate and its surroundings was captured in a verified video showing rescue workers carrying at least one injured person on a stretcher amid scenes of destruction and extensive rubble on the ground.

Footage published by state media and verified by Amnesty also shows structural damage to the prosecution office’s walls and building framework, indicating that the force of the blast penetrated deep into the building.

Satellite imagery from 30 June reveals a location (shown with a yellow circle) where munitions likely landed. Ground images (right) geolocated to the north and south areas of the southern entrance gate show major destruction.

Administrative building and quarantine section housing prisoners

Deeper inside the southern area of the prison, the administrative building and a smaller adjoining building which, according to a former prisoner, contained an office of the prison’s security force called the Protection Cohort, were significantly impacted, while several nearby structures were destroyed.

Satellite imagery from 30 June shows significant damage to part of the roof on the west side of the Protection Cohort building. Satellite imagery further shows that to the east of the building, an internal gate, perimeter wall and two small structures – likely guard posts – were all destroyed in the strike.

The two identified locations are consistent with the analysis of video footage and information received from two former prisoners of conscience Atena Daemi and Hossein Razagh.

Verified videos also depict destroyed windows, collapsed walls and extensive rubble on both the western and eastern sides of the administrative building. The first floor appears to be largely obliterated, with missing structural walls visible in multiple sections.

An image published by state media and verified by Amnesty shows what appears to be a crater inside the west side of the administrative building showing the first floor collapsed downward.

According to a state media report on 6 July, at least nine women, one man and a child were killed in the administrative building. Shargh Daily and Hammihan, two prominent newspapers in Iran, named three of the victims in reports published on 25 June and 1 July, respectively. They included social worker Zahra Ebadi, 52, who was killed along with her five-year-old son, Mehrad Kheiri; and an administrative staff member, Hamid Ranjbari, 40.

Satellite imagery (left) from 30 June reveals two locations (shown with yellow circles) where munitions likely landed. Ground images (right) show extensive damage to the administrative building.

Analysis of a verified video footage also shows that the quarantine section housing newly admitted prisoners, located near the administrative building, also sustained damage.

Medical clinic, kitchen and sections housing prisoners in the central part

In the central part of the prison, the medical clinic, central kitchen, section 4 housing male prisoners, section 209 which consists of solitary confinement cells where female and male prisoners are detained by the Minister of Intelligence, and the women’s section were extensively damaged.

Satellite imagery shows significant damage to structures adjacent to the medical clinic, while verified videos reveal damage to the clinic from the blast and burning cars.

A verified video shows the outside of the medical clinic covered in black soot and black smoke billowing from the windows. Another video shows significant destruction inside, with shattered windows, beds and medical equipment overturned and extensive rubble.

Satellite imagery (left) from 30 June reveals two locations (shown with yellow circles) where munitions likely landed. Geolocated photos and videos (right) show that the vehicle entrance gate collapsed. The clinic’s interior was significantly damaged, with walls and windows blown out, while the exterior shows severe fire damage and smoke.

The verified video evidence supports accounts from human rights defenders Narges Mohammadi and Sepideh Gholian, both based in Iran, who told Amnesty that multiple eyewitnesses in Evin prison described to them extensive damage to the medical clinic.

Narges Mohammadi said that male prisoners in section 4, which is opposite the medical clinic, informed her the prison’s ambulance was destroyed, an account supported by video showing nearby vehicles reduced to wreckage. She also said the prisoners told her they witnessed an individual with extensive burns on their body walking out of the medical clinic and collapsing on the ground.

Two prisoners – Abolfazl Ghodiani and Mehdi Mahmoudian – who survived the Evin prison attack and were transferred to Greater Tehran Penitentiary wrote in a letter from inside prison, which was published online on 1 July:

“Evin prison shook with several consecutive explosions. Two or three blasts occurred near Section 4 and when prisoners exited the section’s door, they saw the medical clinic burning… Prisoners recovered the bodies of around 15-20 people, including medical clinic personnel, prisoners, warehouse staff, guards and agents from beneath the rubble.”

Saeedeh Makarem, a doctor volunteering in Evin prison who was injured, including with burns, described in a series of posts on Instagram in July how prisoners helped her:

“They dragged me to the corner of the wall. I was half-conscious. They brought me water and a blanket, put a splint in my leg, wiped the blood from my face… They could have left, but they didn’t… They saved me.”

Political dissident Hossein Razagh also told Amnesty that section 4 prisoners described to him how prisoners were thrown against the walls due to the force of the blast and sustained head and face injuries.

These testimonies are corroborated by a verified video showing extensive damage to the front parts of sections 4 and 209. External doors and windows of sections 4 and 209 appear to have been shattered, with parts of the roof structure collapsed and large piles of rubble visible in the road. Multiple vehicles are destroyed and burned out, with black smoke damage on the surrounding building walls, indicating some of the fire may have originated from the cars. Satellite imagery from 30 June shows the burned buildings and black scorch marks from the cars. The blast also appears to have affected the roof of the prison kitchen and damaged its windows.

According to Amnesty’s research, the blast also affected section 209 staff offices, trapping some agents and guards under the rubble. Authorities have provided no information about the fate and whereabouts of prisoners held in solitary confinement in section 209, raising concerns about possible deaths or injuries.

Image showing the road with Section 209 on one side (left) and the vehicle entrance gate on the opposite side (right).

Amnesty confirmed through an informed source the name of a prisoner in section 4, Masoud Behbahani, aged 71, who was killed. He suffered a heart attack when the blast threw him onto a chair and several prisoners fell on him. According to the source, instead of transferring him to a hospital, authorities transferred him to Greater Tehran Penitentiary where he died two days later after a second heart attack.

Amnesty also analysed an image taken from inside the women’s section showing visible damage to the ceiling and electrical infrastructure.

Entrance gate, judicial complex, visitors’ building and sections housing prisoners in the north

In the northern part of the prison, as visible in satellite imagery and verified videos, the entrance gate and adjacent wall were destroyed; the front part of the building containing the Shahid Kachouyee judicial complex and visitors’ building were extensively damaged; and two internal walls near sections 240 and 241 housing prisoners were destroyed.

Verified video and photographs also show blast-related damage to nearby high-rise residential buildings and vehicles outside the northern area of Evin prison. One video shows dozens of distressed people in Ahmadpour Street, at least one of whom appears to be injured.

Before and after false-colour, near infrared imagery from 10 April and 27 June reveals the destruction in two distinct locations where munitions likely landed in the northern part of Evin prison (shown with yellow circles): the internal security walls and road in front of sections 240 and 241 and the north entrance gate in front of the visitation building and Shaheed Kachouyee judicial complex.

An informed source described to Amnesty how a nearby resident, Mehrangiz Imanpour, a 61-year-old painter who lived in Ahmadpour Street, was killed on her way home.

Shargh Daily reported that another passerby, Ali Asghar Pazouki, 69, was killed in front of the judicial complex and visitors’ building. State media published videos and photographs which show blast damage in this area.

Satellite imagery (left) from 30 June reveals a location (shown with a yellow circle) where munitions likely landed. Geolocated images and videos (right) show extensive damage to the exterior and interior of the visitors’ building with windows shattered and parts of the roof and facade collapsed.

Satellite imagery analysed by Amnesty indicates that a road and two security walls deeper within the northern part of the prison, near a building containing sections 240 and 241, were also destroyed. These sections are known to contain hundreds of solitary confinement cells, but no images showing the condition of the building have emerged and the authorities have not released any information about the fate of prisoners held there.

Amnesty received accounts from prisoners’ families indicating that section 8, near sections 240 and 241, was damaged. Human rights lawyer Nasrin Sotoudeh told Amnesty that her arbitrarily imprisoned husband, human rights defender, Reza Khandan, and other prisoners, were injured when rubble was propelled into the courtyard.

Political dissident Mohammad Nourizad, who was in section 8, called his family while the air strikes were ongoing. A recording of his call was published online on 24 June:

“They are dropping bombs on us. Some people are injured, the windows have broken, and everyone has scattered… They just hit again. I don’t know, it seems intentional… but bombing a prison is incompatible with any logic or code of conduct…They [prison authorities] closed the doors on us and we have no news.”

International law and standards

Under international humanitarian law, direct attacks on civilians and civilian objects are prohibited. Attacks may only be directed at combatants and military objectives. Military objectives are limited to those objects which by their nature, location, purpose or use make an effective contribution to military action and whose partial or total destruction, capture or neutralisation, in the circumstances ruling at the time, offers a definite military advantage.

Attacking forces have an obligation to do everything feasible to protect civilians including by distinguishing between military targets and civilian objects; verifying whether their intended target is a military objective and cancelling an attack if there is doubt; choosing means and methods of attack that will avoid, or in any event, minimise civilian harm; and providing effective advance warning to civilians unless circumstances do not permit.

Even when targeting a legitimate military objective, an attack must not be carried out which may cause civilian harm that would be disproportionate in relation to the concrete and direct military advantage anticipated. If distinguishing between civilian objects and military targets is not feasible, the attack must not proceed.

Governments responsible for violations of international humanitarian law are required to make full reparations for the loss or injury caused. The UN Basic Principles and Guidelines on the Right to a Remedy and Reparation for Victims of Gross Violations of International Human Rights Law and Serious Violations of International Humanitarian Law enshrine the duty of states to provide effective remedies, including reparation to victims, including restitution, compensation, rehabilitation, satisfaction and guarantees of non-repetition.

Evidence gathered

Amnesty’s Evidence Lab analysed satellite images from before and after the strikes and verified 22 videos and 59 photographs, which show extensive damage and destruction to six areas in the south, central, and northern parts of Evin prison complex.

Additionally, Amnesty reviewed statements by Israeli and Iranian authorities and interviewed 23 people inside and outside Iran, including seven prisoners’ relatives; a nearby resident who witnessed the attack; two sources with information about two victims killed; two journalists; and 11 former prisoners including dissidents and human rights defenders who received information from prisoners, prisoners’ families, prison staff and emergency services attending the site. Amnesty also obtained from a source the recordings of four telephone calls between four prisoners and their families hours after the attack.

Amnesty sent questions regarding the attack to the Israeli Minister of Defence on 3 July. At the time of publication, no response had been received.

As part of Amnesty’s ongoing investigations into violations of international humanitarian law and other human rights violations in the context of the escalation of hostilities between Israel and Iran, Amnesty will also publish findings relating to attacks by the Iranian authorities against Israel.

Urgent action

Take action to support hundreds of displaced prisoners from Tehran’s Evin Prison, who are currently being held in cruel and inhuman conditions. See Amnesty’s Urgent Action for how to help.

MIL OSI NGO –

July 22, 2025
MIL-OSI Asia-Pac: Hong Kong Customs detects money laundering case involving about $1.15 billion

Source: Hong Kong Government special administrative region

Hong Kong Customs detects money laundering case involving about $1.15 billion
Acting upon intelligence, Customs officers earlier targeted a 37-year-old local man and a 50-year-old non-local man and initiated a financial investigation. It was revealed that the duo smuggled cash out of Hong Kong, and conducted stablecoin and fiat currency transactions with a doubtful fund source at a frequent and fast pace, which was highly incommensurate with their background and financial status. They were suspected of participating in money laundering activities.

Following in-depth investigations, Customs officers this morning raided four residential premises and two companies and seized a batch of items suspected to be connected with the case, including mobile phones, tablets and bank cards. The two men, who claimed to be self-employed and unemployed respectively, were arrested for “dealing with property known or reasonably believed to represent proceeds of an indictable offence” (commonly known as money laundering) under the Organized and Serious Crimes Ordinance (OSCO).

An investigation is ongoing. The two arrested persons have been released on bail pending further investigation. The likelihood of further arrests is not ruled out.

Under OSCO, a person commits an offence if he or she deals with any property knowing or having reasonable grounds to believe that such property in whole or in part directly or indirectly represents any person’s proceeds of an indictable offence. The maximum penalty upon conviction is a fine of $5 million and imprisonment for 14 years while the crime proceeds are also subject to confiscation.

Members of the public may report any suspected money laundering activities to Customs’ 24-hour hotline 182 8080 or its dedicated crime-reporting email account (crimereport@customs.gov.hkIssued at HKT 18:40

NNNN

CategoriesMIL-OSI

MIL OSI Asia Pacific News –

July 22, 2025
MIL-OSI Africa: Bogus lawyer sentenced to prison

Source: Government of South Africa

Tuesday, July 22, 2025

A bogus lawyer has been sentenced to six years of direct imprisonment after his conviction on multiple charges, including three counts of fraud, one count of theft, two counts of forgery, and two counts of uttering.

According to the National Prosecuting Authority (NPA), Johannes Tebogo Motse posed as a legal practitioner – “unlawfully representing unsuspecting clients in various courts during 2022”.

“He forged critical legal documents, including a right of appearance certificate, a fidelity fund certificate and an admission certificate to deceive his victims.

“One of the complainants paid Motse R15 000 to prosecute an appeal. After receiving no legal service, the client reported the matter to the police. Investigations revealed that Motse was not registered with the Legal Practice Council of South Africa,” the NPA said.

He pleaded guilty to all charges and was sentenced in the Specialised Commercial Crime Court sitting in Rustenburg.
“In aggravation of sentence, State Advocate Matshidiso Ramakgaphola highlighted the prevalence of such crimes in the court’s jurisdiction and emphasised that the offences were premeditated and meticulously executed.

“The charges of fraud, forgery, and uttering were taken together for sentencing, and he received six years of direct imprisonment. On the charge of theft, he was sentenced to two years’ imprisonment, wholly suspended for five years on condition that he repays the complainant R15 000 by 31 August 2025.

“He was also declared unfit to possess a firearm under Section 103 of the Firearms Control Act 60 of 2000,” the NPA said.

Director of Public Prosecutions in the North West, Dr Rachel Makhari, said: “These sentences underscore the NPA’s commitment to combating bogus legal practitioners and protecting the integrity of the legal profession and the public”. – SAnews.gov.za

Share this post:

MIL OSI Africa –

July 22, 2025
MIL-OSI Africa: Breakthrough arrests in DJ Sumbody murder case

Source: Government of South Africa

Tuesday, July 22, 2025

Four men have been arrested in connection with the murder of Oupa John Sefoka, popularly known as DJ Sumbody.

Sefoka was killed in a shooting in November 2022.

The National Commissioner of the South Africa Police Service (SAPS), General Fannie Masemola, has welcomed the latest breakthrough by the SAPS Political Killings Task Team working closely with Gauteng Organised Crime Detectives.

Gauteng organised crime detectives worked on the case and later roped in the SAPS Political Killings Task Team.

“The arrests were all effected in Gauteng on Monday afternoon and three of the suspects are believed to be hitmen and one is believed to have ordered the hit on the DJ.

“The weapon allegedly used in the commission of the crime was seized and has since been linked to other murders,” said the police in a statement.

All four suspects, aged between 45 and 60, are in police custody and are expected to appear in court soon. They are facing charges including murder and conspiracy to commit murder.

Masemola said this was a significant breakthrough that would hopefully provide closure to families involved.

“Well done to the teams that have been piecing together evidence since November 2022. This is a culmination of hard work and dedication to justice. This is one of those complex cases that our teams needed to take their time in ensuring a thorough investigation so that we could ultimately bring a strong case before court,” he said. – SAnews.gov.za

Share this post:

MIL OSI Africa –

July 22, 2025
MIL-OSI Africa: Joint Meeting of Police and Justice Committees Adopts Report on Ad Hoc Committee to Consider Mkhwanazi Allegations

Source: APO – Report:

.

A joint meeting between the Portfolio Committee on Police and the Portfolio Committee on Justice and Constitutional Development today officially adopted its report recommending to the National Assembly (NA) that an Ad Hoc Committee should be established to consider allegations made by the South African Police Service KwaZulu-Natal Provincial Commissioner, Lieutenant General Nhlanhla Mkwanazi.

The report reflects the committees’ considered view that an Ad Hoc Committee represents the most effective Parliamentary mechanism to fully investigate and deliberate on the matters raised. The committees recommended the establishment of an Ad Hoc Committee in accordance with NA Rule 253, indicating that the scope of such a committee is task specific and time bound, contrary to the general oversight function of portfolio committees which, in contrast, is ongoing and often requires juggling competing priorities. The report also emphasised the need for the NA to ensure an expeditious process.

Without being prescriptive, the committees propose that the NA takes into account, should it resolve to establish an Ad Hoc Committee as recommended, the need for the process to be concluded within 90 days of the committee being established, provided that the timeframe may be amended or extended if necessary.

Given the gravity of the allegations and their potential implications for the rule of law, governance, and accountability within the criminal justice sector, the committees have resolved that a focused, multi-party Ad Hoc Committee will ensure a transparent, thorough and fair process. The committees further noted that actual composition of such a committee, as well as its terms of reference, does not reside with the joint meeting.

The meeting has reiterated Parliament’s constitutional responsibility to exercise oversight over state institutions and to uphold the principles of justice, integrity and accountability. The committees also reaffirmed their commitment to ensuring that this matter is handled with the seriousness it deserves and in line with the Constitution and the rules of Parliament.

The report adopted today will be submitted to the NA for consideration.

– on behalf of The Presidency of the Republic of South Africa.

MIL OSI Africa –

July 22, 2025

Category: Justice

New Forensic Science Regulator appointed for England and Wales

Share this page

Updates to this page

Summary

Patterns and trends

Future plans

2025/26 capital works program highlights

Scores of civilians killed and injured

Israeli officials’ self-incriminating admissions

Entrance gate and prosecution office in the south

Administrative building and quarantine section housing prisoners

Medical clinic, kitchen and sections housing prisoners in the central part

Entrance gate, judicial complex, visitation building and sections housing prisoners in the North

International law and standards

Methodology

Background

An overview of Evin prison, with the exterior walled perimeter marked in orange. The six yellow circles highlight areas with the most significant destruction, indicating these were the locations where the munitions landed. The blasts and resulting damage extended beyond the six areas.

A map of Evin prison indicating building names or functions based on Amnesty’s interviews with former prisoners.

Satellite imagery from 30 June reveals a location (shown with a yellow circle) where munitions likely landed. Ground images (right) geolocated to the north and south areas of the southern entrance gate show major destruction.

Satellite imagery (left) from 30 June reveals two locations (shown with yellow circles) where munitions likely landed. Ground images (right) show extensive damage to the administrative building.

Image showing the road with Section 209 on one side (left) and the vehicle entrance gate on the opposite side (right).

Satellite imagery (left) from 30 June reveals a location (shown with a yellow circle) where munitions likely landed. Geolocated images and videos (right) show extensive damage to the exterior and interior of the visitors’ building with windows shattered and parts of the roof and facade collapsed.