NewzIntel.com

Category: Security

  • MIL-OSI Video: DOJ/FTC Host Listening Session on Lowering Americans’ Drug Prices Through Competition

    Source: United States Department of Justice (video statements)

    DOJ/FTC Host Listening Sessions on Lowering Americans’ Drug Prices Through Competition: Anticompetitive Conduct by Pharmaceutical Companies Impeding Generic or Biosimilar Competition

    https://www.youtube.com/watch?v=vqdA4j0P5bA

    MIL OSI Video –

  • MIL-OSI USA: Elkton man convicted of child exploitation gets 30-year prison sentence following ICE Baltimore investigation

    Source: US Immigration and Customs Enforcement

    BALTIMORE — An investigation conducted by U.S. Immigration and Customs Enforcement led to the sentencing of Mark Rice, 38, to 30 years in prison followed by lifetime supervised release, for producing and distributing child sexual abuse material.

    “This sentencing is a powerful reminder that those who exploit and abuse children will be relentlessly pursued and held accountable,” said ICE Homeland Security Investigations Baltimore Special Agent in Charge Michael McCarthy. “There is no place in society for predators who create and distribute child sexual abuse material. These crimes shatter lives, and HSI will never waver in our mission to bring justice to victims by targeting those who commit these horrific acts. We will continue to work with our partners to ensure the strongest possible consequences under the law.”

    Rice previously pled guilty to one count of producing child sexual abuse material, one count of distributing child sexual abuse material and one count of possessing child sexual abuse material. These charges stem from Rice sexually abusing two minors in his care while using social media to distribute and solicit child sexual abuse material.

    According to his plea agreement, Rice used his position of authority to sexually abuse a minor — beginning when she was less than 3 years old — as he created photographic evidence of the abuse. He also exploited a second minor through surreptitious photography. Rice actively participated in online communities dedicated to trading child sexual abuse material. He used platforms such as Reddit, Telegram and Kik to distribute images of his victims and obtain material depicting other children.

    In April 2023, the National Center for Missing and Exploited Children received a CyberTip from Reddit regarding the transmission of child sexual abuse material. Authorities traced the tip to an IP address associated with Rice’s Elkton residence.

    During a Maryland State Police interview, Rice denied the accusation but was observed deleting photos from his phone. When Rice showed officers his phone, investigators spotted child sexual abuse material in a thumbnail image. Through a deeper search, authorities uncovered additional material in his recently deleted folder.

    Then, HSI Baltimore special agents discovered more than 600 child sexual abuse material images across Rice’s devices. Investigators also found that Rice used a public Reddit community to connect with people that he traded child sexual abuse material with using encrypted messaging platforms.

    McCarthy, U.S. Attorney for the District of Maryland Kelly O. Hayes and Maryland State Police Superintendent Roland L. Butler Jr. announced the indictment.

    Members of the public with information about criminal activity should contact the ICE Tip Line at 866-DHS-2-ICE (866-347-2423).

    Learn more about HSI Baltimore’s mission to increase public safety in our Maryland communities on X at @HSIBaltimore.

    MIL OSI USA News –

  • MIL-OSI Economics: Jasper Sleet: North Korean remote IT workers’ evolving tactics to infiltrate organizations

    Source: Microsoft

    Headline: Jasper Sleet: North Korean remote IT workers’ evolving tactics to infiltrate organizations

    Since 2024, Microsoft Threat Intelligence has observed remote information technology (IT) workers deployed by North Korea leveraging AI to improve the scale and sophistication of their operations, steal data, and generate revenue for the Democratic People’s Republic of Korea (DPRK). Among the changes noted in the North Korean remote IT worker tactics, techniques, and procedures (TTPs) include the use of AI tools to replace images in stolen employment and identity documents and enhance North Korean IT worker photos to make them appear more professional. We’ve also observed that they’ve been utilizing voice-changing software.

    North Korea has deployed thousands of remote IT workers to assume jobs in software and web development as part of a revenue generation scheme for the North Korean government. These highly skilled workers are most often located in North Korea, China, and Russia, and use tools such as virtual private networks (VPNs) and remote monitoring and management (RMM) tools together with witting accomplices to conceal their locations and identities.

    Historically, North Korea’s fraudulent remote worker scheme has focused on targeting United States (US) companies in the technology, critical manufacturing, and transportation sectors. However, we’ve observed North Korean remote workers evolving to broaden their scope to target various industries globally that offer technology-related roles. Since 2020, the US government and cybersecurity community have identified thousands of North Korean workers infiltrating companies across various industries.

    Organizations can protect themselves from this threat by implementing stricter pre-employment vetting measures and creating policies to block unapproved IT management tools. For example, when evaluating potential employees, employers and recruiters should ensure that the candidates’ social media and professional accounts are unique and verify their contact information and digital footprint. Organizations should also be particularly cautious with staffing company employees, check for consistency in resumes, and use video calls to confirm a worker’s identity.

    Microsoft Threat Intelligence tracks North Korean IT remote worker activity as Jasper Sleet (formerly known as Storm-0287). We also track several other North Korean activity clusters that pursue fraudulent employment using similar techniques and tools, including Storm-1877 and Moonstone Sleet. To disrupt this activity and protect our customers, we’ve suspended 3,000 known Microsoft consumer accounts (Outlook/Hotmail) created by North Korean IT workers. We have also implemented several detections to alert our customers of this activity through Microsoft Entra ID Protection and Microsoft Defender XDR as noted at the end of this blog. As with any observed nation-state threat actor activity, Microsoft has directly notified targeted or compromised customers, providing them with important information needed to secure their environments. As we continue to observe more attempts by threat actors to leverage AI, not only do we report on them, but we also have principles in place to take action against them.

    This blog provides additional information on the North Korean remote IT worker operations we published previously, including Jasper Sleet’s usual TTPs to secure employment, such as using fraudulent identities and facilitators. We also provide recent observations regarding their use of AI tools. Finally, we share detailed guidance on how to investigate, monitor, and remediate possible North Korean remote IT worker activity, as well as detections and hunting capabilities to surface this threat.

    From North Korea to the world: The remote IT workforce

    Since at least early 2020, Microsoft has tracked a global operation conducted by North Korea in which skilled IT workers apply for remote job opportunities to generate revenue and support state interests. These workers present themselves as foreign (non-North Korean) or domestic-based teleworkers and use a variety of fraudulent means to bypass employment verification controls.

    North Korea’s fraudulent remote worker scheme has since evolved, establishing itself as a well-developed operation that has allowed North Korean remote workers to infiltrate technology-related roles across various industries. In some cases, victim organizations have even reported that remote IT workers were some of their most talented employees. Historically, this operation has focused on applying for IT, software development, and administrator positions in the technology sector. Such positions provide North Korean threat actors access to highly sensitive information to conduct information theft and extortion, among other operations.

    North Korean IT workers are a multifaceted threat because not only do they generate revenue for the North Korean regime, which violates international sanctions, they also use their access to steal sensitive intellectual property, source code, or trade secrets. In some cases, these North Korean workers even extort their employer into paying them in exchange for not publicly disclosing the company’s data.

    Between 2020 and 2022, the US government found that over 300 US companies in multiple industries, including several Fortune 500 companies, had unknowingly employed these workers, indicating the magnitude of this threat. The workers also attempted to gain access to information at two government agencies. Since then, the cybersecurity community has continued to detect thousands of North Korean workers. On January 3, 2025, the Justice Department released an indictment identifying two North Korean nationals and three facilitators responsible for conducting fraudulent work between 2018 and 2024. The indicted individuals generated a revenue of at least US$866,255 from only ten of the at least 64 infiltrated US companies.

    North Korean threat actors are evolving across the threat landscape to incorporate more sophisticated tactics and tools to conduct malicious employment-related activity, including the use of custom and AI-enabled software.

    Tactics and techniques

    The tactics and techniques employed by North Korean remote IT workers involve a sophisticated ecosystem of crafting fake personas, performing remote work, and securing payments. North Korean IT workers apply for remote roles, in various sectors, at organizations across the globe.

    They create, rent, or procure stolen identities that match the geo-location of their target organizations (for example, they would establish a US-based identity to apply for roles at US-based companies), create email accounts and social media profiles, and establish legitimacy through fake portfolios and profiles on developer platforms like GitHub and LinkedIn. Additionally, they leverage AI tools to enhance their operations, including image creation and voice-changing software. Facilitators play a crucial role in validating fraudulent identities and managing logistics, such as forwarding company hardware and creating accounts on freelance job websites. To evade detection, these workers use VPNs, virtual private servers (VPSs), and proxy services as well as RMM tools to connect to a device housed at a facilitator’s laptop farm located in the country of the job.

    Figure 1. The North Korean IT worker ecosystem

    Crafting fake personas and profiles

    The North Korean remote IT worker fraud scheme begins with the procurement of identities for the workers. These identities, which can be stolen or “rented” from witting individuals, include names, national identification numbers, and dates of birth. The workers might also leverage services that generate fraudulent identities, complete with seemingly legitimate documentation, to fabricate their personas. They then create email accounts and social media pages they use to apply for jobs, often indirectly through staffing or contracting companies. They also apply for freelance opportunities through freelancer sites as an additional avenue for revenue generation. Notably, they often use the same names/profiles repeatedly rather than creating unique personas for each successful infiltration.

    Additionally, the North Korean IT workers have used fake profiles on LinkedIn to communicate with recruiters and apply for jobs.

    Figure 2. An example of a North Korean IT worker LinkedIn profile that has since been taken down.

    The workers tailor their fake resumes and profiles to match the requirements for specific remote IT positions, thus increasing their chances of getting selected. Over time, we’ve observed these fake resumes and employee documents noticeably improving in quality, now appearing more polished and lacking grammatical errors facilitated by AI.

    After creating their fake personas, the North Korean IT workers then attempt to establish legitimacy by creating digital footprints for these fake personas. They typically leverage communication, networking, and developer platforms, (for example, GitHub) to showcase their supposed portfolio of previous work samples:

    Figure 3. Example profile used by a North Korean IT worker that has since been taken down.

    Using AI to improve operations

    Microsoft Threat intelligence has observed North Korean remote IT workers leveraging AI to improve the quantity and quality of their operations. For example, in October 2024, we found a public repository containing actual and AI-enhanced images of suspected North Korean IT workers:

    Figure 4. Photos of potential North Korean IT workers

    The repository also contained the resumes and email accounts used by the said workers, along with the following tools and resources they can use to secure employment and to do their work:

    • VPS and VPN accounts, along with specific VPS IP addresses
    • Playbooks on conducting identity theft and creating and bidding jobs on freelancer websites
    • Wallet information and suspected payments made to facilitators
    • LinkedIn, GitHub, Upwork, TeamViewer, Telegram, and Skype accounts
    • Tracking sheet of work performed, and payments received by the IT workers

    Image creation

    Based on our review of the repository mentioned previously, North Korean IT workers appear to conduct identity theft and then use AI tools like Faceswap to move their pictures over to the stolen employment and identity documents. The attackers also use these AI tools to take pictures of the workers and move them to more professional looking settings. The workers then use these AI-generated pictures on one or more resumes or profiles when applying for jobs.

    Figure 5. Use of AI apps to modify photos used for North Korean IT workers’ resumes and profiles
    Figure 6. Examples of resumes for North Korean IT workers. These two resumes use different versions of the same photo.

    Communications

    Microsoft Threat Intelligence has observed that North Korean IT workers are also experimenting with other AI technologies such as voice-changing software. While we haven’t observed threat actors using combined AI voice and video products as a tactic first hand, we do recognize that combining these technologies could allow future threat actor campaigns to trick interviewers into thinking they aren’t communicating with a North Korean IT worker. If successful, this tactic could allow the North Korean IT workers to do interviews directly and no longer rely on facilitators standing in for them on interviews or selling them account access.

    Facilitators for initial access

    North Korean Remote IT workers require assistance from a witting facilitator to help find jobs, pass the employment verification process, and once hired, successfully work remotely. We’ve observed Jasper Sleet advertising job opportunities for facilitator roles under the guise of partnering with a remote job candidate to help secure an IT role in a competitive market:

    Figure 7. Example of a job opportunity for a facilitator role

    The IT workers may have the facilitators assist in creating accounts on remote and freelance job websites. They might also ask the facilitator to perform the following tasks as their relationship builds:

    • Create a bank account for the North Korean IT worker, or lend their (the facilitator’s) own account to the worker
    • Purchase mobile phone numbers or SIM cards

    During the employment verification process, the witting accomplice helps the North Korean IT workers validate the latter’s fraudulent identities using online background check service providers. The documents submitted by the workers include fake or stolen drivers’ licenses, social security cards, passports, and permanent resident identification cards. Workers train using interview scripts, which include a justification for why the employee must work remotely.

    Once hired, the remote workers direct company laptops and hardware to be sent to the address of the accomplice. The accomplice then either runs a laptop farm that provides the laptops with an internet connection at the geo-location of the role or forwards the items internationally. For hardware that remain in the country of the role, the accomplice signs into the computers and installs software that enables the workers to connect remotely. Remote IT workers might also access devices remotely using IP-based KVM devices, like PiKVM or TinyPilot.

    Defense evasion and persistence

    To conceal their physical location as well as maintain persistence and blend into the target organization’s environment, the workers typically use VPNs (particularly Astrill VPN), VPSs, proxy services, and RMM tools. Microsoft Threat Intelligence has observed the persistent use of JumpConnect, TinyPilot, Rust Desk, TeamViewer, AnyViewer, and Anydesk. When an in-person presence or face-to-face meeting is required, for example to confirm banking information or attend a meeting, the workers have been known to pay accomplices to stand in for them. When possible, however, the workers eliminate all face-to-face contact, offering fraudulent excuses for why they are not on camera during video teleconferencing calls or speaking.

    Attribution

    Microsoft Threat Intelligence uses the name Jasper Sleet (formerly known as Storm-0287) to represent activity associated with North Korean’s remote IT worker program. These workers are primarily focused on revenue generation, use remote access tools, and likely fall under a particular leadership structure in North Korea. We also track several other North Korean activity clusters that pursue fraudulent employment using similar techniques and tools, including Storm-1877 and Moonstone Sleet.

    How Microsoft disrupts North Korean remote IT worker operations with machine learning

    Microsoft has successfully scaled analyst tradecraft to accelerate the identification and disruption of North Korean IT workers in customer environments by developing a custom machine learning solution. This has been achieved by leveraging Microsoft’s existing threat intelligence and weak signals generated by monitoring for many of the red flags listed in this blog, among others. For example, this solution uses impossible time travel risk detections, most commonly between a Western nation and China or Russia. The machine learning workflow uses these features to surface suspect accounts most likely to be North Korean IT workers for assessment by Microsoft Threat Intelligence analysts.

    Once Microsoft Threat Intelligence reviews and confirms that an account is indeed associated with a North Korean IT worker, customers are then notified with a Microsoft Entra ID Protection risk detection warning of a risky sign-in based on Microsoft’s threat intelligence. Microsoft Defender XDR customers also receive the alert Sign-in activity by a suspected North Korean entity in the Microsoft Defender portal.

    Defending against North Korean remote IT worker infiltration

    Defending against the threats from North Korean remote IT workers involves a threefold strategy:

    • Ensuring a proper vetting approach is in place for freelance workers and vendors
    • Monitoring for anomalous user activity
    • Responding to suspected Jasper Sleet signals in close coordination with your insider risk team

    Investigate

    How can you identify a North Korean remote IT worker in the hiring process?

    To protect your organization against a potential North Korean insider threat, it is important for your organization to prioritize a process for verifying employees to identify potential risks. The following can be used to assess potential employees:

    • Confirm the potential employee has a digital footprint and look for signs of authenticity. This includes a real phone number (not VoIP), a residential address, and social media accounts. Ensure the potential employee’s social media/professional accounts are not highly similar to the accounts of other individuals. In addition, check that the contact phone number listed on the potential employee’s account is unique and not also used by other accounts.
    • Scrutinize resumes and background checks for consistency of names, addresses, and dates. Consider contacting references by phone or video-teleconference rather than email only.
    • Exercise greater scrutiny for employees of staffing companies, since this is the easiest avenue for North Korean workers to infiltrate target companies.
    • Search whether a potential employee is employed at multiple companies using the same persona.
    • Ensure the potential employee is seen on camera during multiple video telecommunication sessions. If the potential employee reports video and/or microphone issues that prohibit participation, this should be considered a red flag.
    • During video verification, request individuals to physically hold driver’s licenses, passports, or identity documents up to camera.
    • Keep records, including recordings of video interviews, of all interactions with potential employees.
    • Require notarized proof of identity.

    Monitor

    How can your organization prevent falling victim to the North Korean remote IT worker technique?

    To prevent the risks associated with North Korean insider threats, it’s vital to monitor for activity typically associated with this fraudulent scheme.

    Monitor for identifiable characteristics of North Korean remote workers

    Microsoft has identified the following characteristics of a North Korean remote worker. Note that not all the criteria are necessarily required, and further, a positive identification of a remote worker doesn’t guarantee that the worker is North Korean.

    • The employee lists a Chinese phone number on social media accounts that is used by other accounts.
    • The worker’s work-issued laptop authenticates from an IP address of a known North Korean IT worker laptop farm, or from foreign—most commonly Chinese or Russian—IP addresses even though the worker is supposed to have a different work location.
    • The worker is employed at multiple companies using the same persona. Employees of staffing companies require heightened scrutiny, given this is the easiest way for North Korean workers to infiltrate target companies.
    • Once a laptop is issued to the worker, RMM software is immediately downloaded onto it and used in combination with a VPN.
    • The worker has never been seen on camera during a video telecommunication session or is only seen a few times. The worker may also report video and/or microphone issues that prohibit participation from the start.
    • The worker’s online activity doesn’t align with routine co-worker hours, with limited engagement across approved communication platforms.

    Monitor for activity associated with Jasper Sleet access

    • If RMM tools are used in your environment, enforce security settings where possible, to implement MFA:
      • If an unapproved installation is discovered, reset passwords for accounts used to install the RMM services. If a system-level account was used to install the software, further investigation may be warranted.
    • Monitor for impossible travel—for example, a supposedly US-based employee signing in from China or Russia.
    • Monitor for use of public VPNs such as Astrill. For example, IP addresses associated with VPNs known to be used by Jasper Sleet can be added to Sentinel watchlists. Or, Microsoft Defender for Identity can integrate with your VPN solution to provide more information about user activity, such as extra detection for abnormal VPN connections.
    • Monitor for signals of insider threats in your environment. Microsoft Purview Insider Risk Management can help identify potentially malicious or inadvertent insider risks.
    • Monitor for consistent user activity outside of typical working hours.

    Remediate

    What are the next steps if you positively identify a North Korean remote IT worker employed at your company?

    Because Jasper Sleet activity follows legitimate job offers and authorized access, Microsoft recommends approaching confirmed or suspected Jasper Sleet intrusions with an insider risk approach using your organization’s insider risk response plan or incident response provider like Microsoft Incident Response. Some steps might include:

    • Restrict response efforts to a small, trusted insider risk working group, trained in operational security (OPSEC) to avoid tipping off subjects and potential collaborators.
    • Rapidly evaluate the subject’s proximity to critical assets, such as:
      • Leadership or sensitive teams
      • Direct reports or vendor staff the subject has influence over
      • Suppliers or vendors
      • People/non-people accounts, production/pre-production environments, shared accounts, security groups, third-party accounts, security groups, distribution groups, data clusters, and more
    • Conduct preliminary link analysis to:
      • Detect relationships with potential collaborators, supporters, or other potential aliases operated by the same actor
      • Identify shared indicators (for example, shared IP addresses, behavioral overlap)
      • Avoid premature action that might alert other Jasper Sleet operators
    • Conduct a risk-based prioritization of efforts, informed by:
      • Placement and access to critical assets (not necessarily where you identified them)
      • Stakeholder insight from potentially impacted business units
      • Business impact considerations of containment (which might support additional collection/analysis) or mitigation (for example, eviction)
    • Conduct open-source intelligence (OSINT) collection and analysis to:
      • Determine if the identity associated with the threat actor is associated with a real person. For example, North Korean IT workers have leveraged stolen identities of real US persons to facilitate their fraud. Conduct OSINT on all available personally identifiable information (PII) provided by the actor (name, date of birth, SSN, home of record, phone number, emergency contact, and others) and determine if these items are linked to additional North Korean actors, and/or real persons’ identities.
      • Gather all known external accounts operated by the alias/persona (for example, LinkedIn, GitHub, freelance working sites, bug bounty programs).
      • Perform analysis on account images using open-source tools such as FaceForensics++ to determine prevalence of AI-generated content. Detection opportunities within video and imagery include: 
        • Temporal consistency issues: Rapid movements cause noticeable artifacts in video deepfakes as the tracking system struggles to maintain accurate landmark positioning. 
        • Occlusion handling: When objects pass over the AI-generated content such as the face, deepfake systems tend to fail at properly reconstructing the partially obscured face.
        • Lighting adaptation: Changes in lighting conditions might reveal inconsistencies in the rendering of the face
        • Audio-visual synchronization: Slight delays between lip movements and speech are detectable under careful observation
          • Exaggerated facial expressions. 
          • Duplicative or improperly placed appendages.
          • Pixelation or tearing at edges of face, eyes, ears, and glasses.
    • Engage counterintelligence or insider risk/threat teams to:
      • Understand tradecraft and likely next steps
      • Gain national-level threat context, if applicable
    • Make incremental, risk-based investigative and response decisions with the support of your insider threat working group and your insider threat stakeholder group; one providing tactical feedback and the other providing risk tolerance feedback.
    • Preserve evidence and document findings.
    • Share lessons learned and increase awareness.
    • Educate employees on the risks associated with insider threats and provide regular security training for employees to recognize and respond to threats, including a section on the unique threat posed by North Korean IT workers.

    After an insider risk response to Jasper Sleet, it might be necessary to also conduct a thorough forensic investigation of all systems that the employee had access to for indicators of persistence, such as RMM tools or system/resource modifications.

    For additional resources, refer to CISA’s Insider Threat Mitigation Guide. If you suspect your organization is being targeted by nation-state cyber activity, report it to the appropriate national authority. For US-based organizations, the Federal Bureau of Investigation (FBI) recommends reporting North Korean remote IT worker activity to the Internet Crime Complaint Center (IC3).

    Microsoft Defender XDR detections

    Microsoft Defender XDR customers can refer to the list of applicable detections below. Microsoft Defender XDR coordinates detection, prevention, investigation, and response across endpoints, identities, email, apps to provide integrated protection against attacks like the threat discussed in this blog.

    Customers with provisioned access can also use Microsoft Security Copilot in Microsoft Defender to investigate and respond to incidents, hunt for threats, and protect their organization with relevant threat intelligence.

    Microsoft Defender XDR

    Alerts with the following titles in the security center can indicate threat activity on your network:

    • Sign-in activity by a suspected North Korean entity

    Microsoft Defender for Endpoint

    Alerts with the following titles in the security center can indicate Jasper Sleet RMM activity on your network. These alerts, however, can be triggered by unrelated threat activity.

    • Suspicious usage of remote management software
    • Suspicious connection to remote access software

    Microsoft Defender for Identity

    Alerts with the following titles in the security center can indicate atypical identity access on your network. These alerts, however, can be triggered by unrelated threat activity.

    • Atypical travel
    • Suspicious behavior: Impossible travel activity

    Microsoft EntraID Protection

    Microsoft Entra ID Protection risk detections inform Entra ID user risk events and can indicate associated threat activity, including unusual user activity consistent with known patterns identified by Microsoft Threat Intelligence research. Note, however, that these alerts can be also triggered by unrelated threat activity.

    • Microsoft Entra threat intelligence (sign-in): (RiskEventType: investigationsThreatIntelligence)

    Microsoft Defender for Cloud Apps

    Alerts with the following titles in the security center can indicate atypical identity access on your network. These alerts, however, can be triggered by unrelated threat activity.

    • Impossible travel activity

    Microsoft Security Copilot

    Security Copilot customers can use the standalone experience to create their own prompts or run the following pre-built promptbooks to automate incident response or investigation tasks related to this threat:

    • Incident investigation
    • Microsoft User analysis
    • Threat actor profile

    Note that some promptbooks require access to plugins for Microsoft products such as Microsoft Defender XDR or Microsoft Sentinel.

    Hunting queries

    Microsoft Defender XDR

    Because organizations might have legitimate and frequent uses for RMM software, we recommend using the Microsoft Defender XDR advanced hunting queries available on GitHub to locate RMM software that hasn’t been endorsed by your organization for further investigation. In some cases, these results might include benign activity from legitimate users. Regardless of use case, all newly installed RMM instances should be scrutinized and investigated.

    If any queries have high fidelity for discovering unsanctioned RMM instances in your environment, and don’t detect benign activity, you can create a custom detection rule from the advanced hunting query in the Microsoft Defender portal. 

    Microsoft Sentinel

    The alert Insider Risk Sensitive Data Access Outside Organizational Geo-locationjoins Azure Information Protection logs (InformationProtectionLogs_CL) with Microsoft Entra ID sign-in logs (SigninLogs) to provide a correlation of sensitive data access by geo-location. Results include:

    • User principal name
    • Label name
    • Activity
    • City
    • State
    • Country/Region
    • Time generated

    The recommended configuration is to include (or exclude) sign-in geo-locations (city, state, country and/or region) for trusted organizational locations. There is an option for configuration of correlations against Microsoft Sentinel watchlists. Accessing sensitive data from a new or unauthorized geo-location warrants further review.

    References

    Acknowledgments

    For more information on North Korean remote IT worker operations, we recommend reviewing DTEX’s in-depth analysis in the report Exposing DPRK’s Cyber Syndicate and IT Workforce.

    Learn more

    Meet the experts behind Microsoft Threat Intelligence, Incident Response, and the Microsoft Security Response Center at our VIP Mixer at Black Hat 2025. Discover how our end-to-end platform can help you strengthen resilience and elevate your security posture.

    For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog. 

    To get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter), and Bluesky. 

    To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast. 

    MIL OSI Economics –

  • MIL-OSI USA: The Justice Department Files Lawsuit Against Sanctuary City Policies In Los Angeles, California

    Source: US State of North Dakota

    Today, the Department of Justice filed a lawsuit against the City of Los Angeles, California, Los Angeles Mayor Karen Bass, and the Los Angeles City Council over policies that Los Angeles enacted shortly after President Donald J. Trump’s reelection to interfere with the federal government’s enforcement of its immigration laws.

    Not only are Los Angeles’s “sanctuary city” policies illegal under federal law, but, as alleged in the complaint, Los Angeles’s refusal to cooperate with federal immigration authorities contributed to the recent lawlessness, rioting, looting, and vandalism that was so severe that it required the federal government to deploy the California National Guard and the United States Marines to quell the chaos.

    “Sanctuary policies were the driving cause of the violence, chaos, and attacks on law enforcement that Americans recently witnessed in Los Angeles,” said Attorney General Pamela Bondi. “Jurisdictions like Los Angeles that flout federal law by prioritizing illegal aliens over American citizens are undermining law enforcement at every level – it ends under President Trump.”

    “Today’s lawsuit holds the City of Los Angeles accountable for deliberately obstructing the enforcement of federal immigration law,” said U.S. Attorney Bill Essayli for the Central District of California. “The United States Constitution’s Supremacy Clause prohibits the City from picking and choosing which federal laws will be enforced and which will not. By assisting removable aliens in evading federal law enforcement, the City’s unlawful and discriminatory ordinance has contributed to a lawless and unsafe environment that this lawsuit will help end.”

    On her first day in office, Attorney General Bondi instructed the Department’s Civil Division to identify state and local laws, policies, and practices that facilitate violations of federal immigration laws or impede lawful federal immigration operations, and, where appropriate, to take legal action to challenge such laws, policies, and practices. Today’s lawsuit is the latest in a series of lawsuits brought by the Civil Division targeting illegal sanctuary city policies across the country, including in New York and New Jersey.

    MIL OSI USA News –

  • MIL-OSI USA: Justice Department Announces Coordinated, Nationwide Actions to Combat North Korean Remote Information Technology Workers’ Illicit Revenue Generation Schemes

    Source: US State of North Dakota

    Law Enforcement Actions Across 16 States Result in Charges, Arrest, and Seizures of 29 Financial Accounts, 21 Fraudulent Websites, and Approximately 200 Computers

    The Justice Department announced today coordinated actions against the Democratic People’s Republic of North Korea (DPRK) government’s schemes to fund its regime through remote information technology (IT) work for U.S. companies. These actions include two indictments, an arrest, searches of 29 known or suspected “laptop farms” across 16 states, and the seizure of 29 financial accounts used to launder illicit funds and 21 fraudulent websites.

    According to court documents, the schemes involve North Korean individuals fraudulently obtaining employment with U.S. companies as remote IT workers, using stolen and fake identities. The North Korean actors were assisted by individuals in the United States, China, United Arab Emirates, and Taiwan, and successfully obtained employment with more than 100 U.S. companies.

    As alleged in court documents, certain U.S.-based individuals enabled one of the schemes by creating front companies and fraudulent websites to promote the bona fides of the remote IT workers, and hosted laptop farms where the remote North Korean IT workers could remote access into U.S. victim company-provided laptop computers. Once employed, the North Korean IT workers received regular salary payments, and they gained access to, and in some cases stole, sensitive employer information such as export controlled U.S. military technology and virtual currency. In another scheme, North Korean IT workers used false or fraudulently obtained identities to gain employment with an Atlanta, Georgia-based blockchain research and development company and stole virtual currency worth approximately over $900,000.

    “These schemes target and steal from U.S. companies and are designed to evade sanctions and fund the North Korean regime’s illicit programs, including its weapons programs,” said Assistant Attorney General John A. Eisenberg of the Department’s National Security Division. “The Justice Department, along with our law enforcement, private sector, and international partners, will persistently pursue and dismantle these cyber-enabled revenue generation networks.”

    “North Korean IT workers defraud American companies and steal the identities of private citizens, all in support of the North Korean regime,” said Assistant Director Brett Leatherman of FBI’s Cyber Division. “That is why the FBI and our partners continue to work together to disrupt infrastructure, seize revenue, indict overseas IT workers, and arrest their enablers in the United States. Let the actions announced today serve as a warning: if you host laptop farms for the benefit of North Korean actors, law enforcement will be waiting for you.”

    “North Korea remains intent on funding its weapons programs by defrauding U.S. companies and exploiting American victims of identity theft, but the FBI is equally intent on disrupting this massive campaign and bringing its perpetrators to justice,” said Assistant Director Roman Rozhavsky of the FBI Counterintelligence Division. “North Korean IT workers posing as U.S. citizens fraudulently obtained employment with American businesses so they could funnel hundreds of millions of dollars to North Korea’s authoritarian regime. The FBI will do everything in our power to defend the homeland and protect Americans from being victimized by the North Korean government, and we ask all U.S. companies that employ remote workers to remain vigilant to this sophisticated threat.”

    Zhenxing Wang, et al. Indictment, Seizure Warrants, and Arrest – District of Massachusetts

    Today, the United States Attorney’s Office for the District of Massachusetts and the National Security Division announced the arrest of U.S. national Zhenxing “Danny” Wang of New Jersey pursuant to a five-count indictment. The indictment describes a multi-year fraud scheme by Wang and his co-conspirators to obtain remote IT work with U.S. companies that generated more than $5 million in revenue. The indictment also charges Chinese nationals Jing Bin Huang (靖斌 黄), Baoyu Zhou (周宝玉), Tong Yuze (佟雨泽), Yongzhe Xu (徐勇哲 andيونجزهي أكسو), Ziyou Yuan (زيو) and Zhenbang Zhou (周震邦), and Taiwanese nationals Mengting Liu (劉 孟婷) and Enchia Liu (刘恩) for their roles in the scheme. 

    “The threat posed by DPRK operatives is both real and immediate. Thousands of North Korean cyber operatives have been trained and deployed by the regime to blend into the global digital workforce and systematically target U.S. companies,” said U.S. Attorney Leah B. Foley for the District of Massachusetts. “We will continue to work relentlessly to protect U.S. businesses and ensure they are not inadvertently fueling the DPRK’s unlawful and dangerous ambitions.”

    According to the indictment, from approximately 2021 until October 2024, the defendants and other co-conspirators compromised the identities of more than 80 U.S. persons to obtain remote jobs at more than 100 U.S. companies, including many Fortune 500 companies, and caused U.S. victim companies to incur legal fees, computer network remediation costs, and other damages and losses of at least $3 million. Overseas IT workers were assisted by Kejia Wang, Zhenxing Wang, and at least four other identified U.S. facilitators. Kejia Wang, for example, communicated with overseas co-conspirators and IT workers, and traveled to Shenyang and Dandong, China, including in 2023, to meet with them about the scheme. To deceive U.S. companies into believing the IT workers were located in the United States, Kejia Wang, Zhenxing Wang, and the other U.S. facilitators received and/or hosted laptops belonging to U.S. companies at their residences, and enabled overseas IT workers to access the laptops remotely by, among other things, connecting the laptops to hardware devices designed to allow for remote access (referred to as keyboard-video-mouse or “KVM” switches).

    Kejia Wang and Zhenxing Wang also created shell companies with corresponding websites and financial accounts, including Hopana Tech LLC, Tony WKJ LLC, and Independent Lab LLC, to make it appear as though the overseas IT workers were affiliated with legitimate U.S. businesses. Kejia Wang and Zhenxing Wang established these and other financial accounts to receive money from victimized U.S. companies, much of which was subsequently transferred to overseas co‑conspirators. In exchange for their services, Kejia Wang, Zhenxing Wang, and the four other U.S. facilitators received a total of at least $696,000 from the IT workers.

    IT workers employed under this scheme also gained access to sensitive employer data and source code, including International Traffic in Arms Regulations (ITAR) data from a California-based defense contractor that develops artificial intelligence-powered equipment and technologies. Specifically, between on or about Jan. 19, 2024, and on or about April 2, 2024, an overseas co-conspirator remotely accessed without authorization the company’s laptop and computer files  containing technical data and other information. The stolen data included information marked as being controlled under the ITAR.

    Simultaneously with today’s announcement, the FBI and Defense Criminal Investigative Service (DCIS) seized 17 web domains used in furtherance of the charged scheme and further seized 29 financial accounts, holding tens of thousands of dollars in funds, used to launder revenue for the North Korean regime through the remote IT work scheme.

    Previously, in October 2024, as part of this investigation, federal law enforcement executed searches at eight locations across three states that resulted in the recovery of more than 70 laptops and remote access devices, such as KVMs. Simultaneously with that action, the FBI seized four web domains associated with Kejia Wang’s and Zhenxing Wang’s shell companies used to facilitate North Korean IT work.

    The FBI Las Vegas Field Office, DCIS San Diego Resident Agency, and Homeland Security Investigations San Diego Field Office are investigating the case.

    Assistant U.S. Attorney Jason Casey for the District of Massachusetts and Trial Attorney Gregory J. Nicosia, Jr. of the National Security Division’s National Security Cyber Section are prosecuting the case, with significant assistance from Legal Assistants Daniel Boucher and Margaret Coppes. Valuable assistance was also provided by Mark A. Murphy of the National Security Division’s Counterintelligence and Export Control Section and the U.S. Attorneys’ Offices for the District of New Jersey, Eastern District of New York, and Southern District of California.

    Kim Kwang Jin et al. Indictment – Northern District of Georgia

    Today, the Northern District of Georgia unsealed a five-count wire fraud and money laundering indictment charging four North Korean nationals, Kim Kwang Jin (김관진), Kang Tae Bok (강태복), Jong Pong Ju (정봉주) and Chang Nam Il (창남일), with a scheme to steal virtual currency from two companies, valued at over $900,000 at the time of the thefts, and to launder proceeds of those thefts. The defendants remain at large and wanted by the FBI.

    “The defendants used fake and stolen personal identities to conceal their North Korean nationality, pose as remote IT workers, and exploit their victims’ trust to steal hundreds of thousands of dollars,” said U.S. Attorney Theodore S. Hertzberg for the Northern District of Georgia. “This indictment highlights the unique threat North Korea poses to companies that hire remote IT workers and underscores our resolve to prosecute any actor, in the United States or abroad, who steals from Georgia businesses.”

    According to the indictment, the defendants traveled to the United Arab Emirates on North Korean travel documents and worked as a co-located team. In approximately December 2020 and May 2021, respectively, Kim Kwang Jin (using victim P.S.’s stolen identity) and Jong Pong Ju (using the alias “Bryan Cho”) were hired by a blockchain research and development company headquartered in Atlanta, Georgia, and a virtual token company based in Serbia. Both defendants concealed their North Korean identities from their employers by providing false identification documents containing a mix of stolen and fraudulent identity information. Neither company would have hired Kim Kwang Jin and Jong Pong Ju had they known that they were North Korean citizens. Later, on a recommendation from Jong Pong Ju, the Serbian company hired “Peter Xiao,” who in fact was Chang Nam Il.

    After gaining their employers’ trust, Kim Kwang Jin and Jong Pong Ju were assigned projects that provided them access to their employers’ virtual currency assets. In February 2022, Jong Pong Ju used that access to steal virtual currency worth approximately $175,000 at the time of the theft, sending it to a virtual currency address he controlled. In March 2022, Kim Kwang Jin stole virtual currency worth approximately $740,000 at the time of theft by modifying the source code of two of his employer’s smart contracts, then sending it to a virtual currency address he controlled.

    To launder the funds after the thefts, Kim Kwang Jin and Jong Pong Ju “mixed” the stolen funds using the virtual currency mixer Tornado Cash and then transferred the funds to virtual currency exchange accounts controlled by defendants Kang Tae Bok and Chang Nam Il but held in the name of aliases. These accounts were opened using fraudulent Malaysian identification documents.

    The FBI Atlanta Field Office is investigating the case.

    Assistant U.S. Attorneys Samir Kaushal and Alex Sistla for the Northern District of Georgia and Trial Attorney Jacques Singer-Emery of the National Security Division’s National Security Cyber Section are prosecuting the case.

    21 Searches of Known or Suspected U.S.-based Laptop Farms – Multi-District

    Between June 10 and June 17, 2025, the FBI executed searches of 21 premises across 14 states hosting known and suspected laptop farms. These actions, coordinated by the FBI Denver Field Office, related to investigations of North Korean remote IT worker schemes being conducted by the U.S. Attorneys’ Offices of the District of Colorado, Eastern District of Missouri, and Northern District of Texas. In total, the FBI seized approximately 137 laptops.

    Valuable assistance was provided by the U.S. Attorney’s Offices for the District of Connecticut, the Eastern District of Michigan, the Eastern District of Wisconsin, the Middle District of Florida, the Northern District of Georgia, the Northern District of Illinois, the Northern District of Indiana, the District of Oregon, the Southern District of Florida, the Southern District of Ohio, the Western District of New York, and the Western District of Pennsylvania.

    ***

    The Department’s actions to combat these schemes are the latest in a series of law enforcement actions under a joint National Security Division and FBI Cyber and Counterintelligence Divisions effort, the DPRK RevGen: Domestic Enabler Initiative. This effort prioritizes targeting and disrupting the DPRK’s illicit revenue generation schemes and its U.S.-based enablers. The Department previously announced other actions pursuant to the initiative, including in January 2025 and prior, as well as the filing of a civil forfeiture complaint in early June 2025 for over $7.74 million tied to an illegal employment scheme.

    As the FBI has described in Public Service Announcements published in May 2024 and January 2025, North Korean remote IT workers posing as legitimate remote IT workers have committed data extortion and exfiltrated the proprietary and sensitive data from U.S. companies. DPRK IT worker schemes typically involve the use of stolen identities, alias emails, social media, online cross-border payment platforms, and online job site accounts, as well as false websites, proxy computers, and witting and unwitting third parties located in the U.S. and elsewhere.

    Other public advisories about the threats, red flag indicators, and potential mitigation measures for these schemes include a May 2022 advisory released by the FBI, Department of the Treasury, and Department of State; a July 2023 advisory from the Office of the Director of National Intelligence; and guidance issued in October 2023 by the United States and the Republic of Korea (South Korea). As described the May 2022 advisory, North Korean IT workers have been known individually to earn up to $300,000 annually, generating hundreds of millions of dollars collectively each year, on behalf of designated entities, such as the North Korean Ministry of Defense and others directly involved in the DPRK’s weapons programs.

    The U.S. Department of State has offered potential rewards for up to $5 million in support of international efforts to disrupt the DPRK’s illicit financial activities, including for cybercrimes, money laundering, and sanctions evasion.

    The details in the above-described court documents are merely allegations. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

    MIL OSI USA News –

  • MIL-OSI USA: Department of Justice Announces the Opening of Nominations to Honor the Honorable: The Attorney General’s Award for Distinguished Service in Policing

    Source: US State of North Dakota

    WASHINGTON – United States Attorney General Pamela Bondi announced today that the Department of Justice is now accepting nominations to Honor the Honorable: The Attorney General’s Award for Distinguished Service in Policing. This award represents the Department of Justice’s reaffirmed commitment to uplifting the valor and exceptional contributions to policing of our great nation’s law enforcement personnel. It is the mission of the Department of Justice to recognize individuals in law enforcement who exhibit remarkable courage, innovation, and outstanding performance in making America safe again.

    The Attorney General’s Honor the Honorable Award recognizes individual or teams of rank-and-file officers from state, local, Tribal or territorial law enforcement agencies for exceptional efforts in policing. The awarded officers, deputies and troopers will have demonstrated exceptional service in one of three areas: criminal investigations, field operations or exemplary community involvement. Within each category, an award will be given to law enforcement agencies serving small, medium and large jurisdictions. Those agency sizes are defined as:

    • Small: agencies serving populations of fewer than 50,000;
    • Medium: agencies serving populations of 50,000 to 250,000;
    • Large: agencies serving populations of more than 250,000.

    By acknowledging and rewarding these efforts, the Department strives to advance and reaffirm its dedication to policing and to promote proactive law enforcement methods that support public safety within our nation’s communities. Through this Award, the Attorney General recognizes that the nation’s law enforcement agencies, officers, deputies and troopers continue to work tirelessly to make American communities safe places to live and work again.

    The deadline for nominations is July 14, 2025, at 8:00 p.m. EDT. More information and the application for nominees can be found at: https://www.justice.gov/ag/policing-award

    MIL OSI USA News –

  • MIL-OSI Australia: Snake in enclosure found on Bundaberg footpath

    Source: Tasmania Police

    Issued: 1 Jul 2025

    Wildlife rangers are asking for public assistance to find the owner of a snake and enclosure that was found on a footpath in the Bundaberg suburb of Avenell Heights.

    A man walking his dog made the unusual discovery and took snake and enclosure home before calling a local snake catcher.

    After retrieving the snake and the enclosure, the snake catcher handed it in to the Department of the Environment, Tourism, Science and Innovation.

    Senior Wildlife Ranger Amanda Yates said the snake is an albino Darwin carpet python, and it was most likely captive-bred and raised.

    The snake, an albino Darwin carpet python, was found in an enclosure on the footpath.

    “We are trying to determine why the snake and the enclosure were on the footpath,” Ms Yates said.

    “These snakes are not native to Queensland, but they are popular among the reptile trade due to their striking features.

    “The snake appears healthy and we’re appealing for public information so we can find the owner.

    “We hoping to return the snake to its owner, and anyone with information is encouraged to contact the

    department.”

    Anyone with information can call DETSI on 1300 130 372.

    In Queensland, people need a permit to keep native animals as pets. Information about wildlife permits can be found here.

    Media contact:                 DETSI Media Unit on (07) 3339 5831 or media@detsi.qld.gov.au

    MIL OSI News –

  • MIL-OSI USA: Durable Medical Equipment Owner Sentenced to 12 Years for $61 Million Medicare Fraud Scheme

    Source: US State of North Dakota

    A Florida man was sentenced today to 12 years in prison and three years of supervised release for conspiring to defraud Medicare with false reimbursement claims for durable medical equipment (DME). He was also ordered to pay $21,195,540.18 in restitution and forfeiture in the amount of $2,514,040.

    According to court documents, Peter Roussonicolos, 64, of Port Saint Lucie, Florida, owned and operated five DME suppliers as a silent partner. Roussonicolos hid his involvement in the companies from Medicare because he had one or more felony convictions, making him ineligible to enroll with the government program. To further conceal his involvement, he recruited and paid co-conspirators to serve as nominee owners of the DME suppliers and caused others to falsify Medicare enrollment forms, bank records, and other documents to conceal the true ownership and control of the DME suppliers. He also knew that a co-conspirator paid kickbacks and bribes to patient recruiters in exchange for beneficiary referrals. As part of the scheme, the DME companies submitted approximately $61.5 million in false and fraudulent claims to Medicare for medically unnecessary DME that was ineligible for reimbursement and were paid approximately $26.7 million of these claims.

    “Through lies and deceit, the defendant and his co-conspirators orchestrated a $61 million fraud on Medicare,” said Matthew R. Galeotti, Head of the Justice Department’s Criminal Division. “The defendant’s fraud drained critical government resources that could have been used to help vulnerable Americans. Today’s sentencing demonstrates the Department’s steadfast commitment to protecting taxpayer dollars and ensuring accountability for those who seek to defraud our health care programs.”

    “Today’s sentence underscores HHS-OIG’s firm commitment to thoroughly investigating individuals who engage in illegal kickback schemes to prescribe medically unnecessary durable medical equipment for their own personal financial gain,” said Deputy Inspector General for Investigations Christian J. Schrank with the U.S. Department of Health and Human Services Office of Inspector General (HHS-OIG). “We remain steadfast in our mission to protect the integrity of Medicare and other federal healthcare programs as well as the people served by those programs.”

    “This defendant and his co-conspirators orchestrated an elaborate scheme to steal millions from Medicare through kickbacks and sham billing,” said Assistant Director Jose A. Perez of the FBI Criminal Investigative Division. “Today’s sentencing demonstrates that those who exploit our healthcare system for personal gain will be held accountable. The FBI is committed to working with our partners to protect taxpayer dollars and ensure the integrity of healthcare programs.”

    In November 2024, Roussonicolos pleaded guilty to conspiracy to commit health care fraud and wire fraud.

    The FBI and HHS-OIG investigated the case.

    Trial Attorney Jennifer Burns and Assistant Chiefs Jamie de Boer and Emily Gurskis of the Criminal Division’s Fraud Section prosecuted the case. Trial Attorneys Joanna Bowman and Lindita Ciko Torza of the Special Matters Unit assisted in the prosecution.

    The Fraud Section leads the Criminal Division’s efforts to combat health care fraud through the Health Care Fraud Strike Force Program. Since March 2007, this program, currently comprised of 9 strike forces operating in 27 federal districts, has charged more than 5,800 defendants who collectively have billed federal health care programs and private insurers more than $30 billion. In addition, the Centers for Medicare & Medicaid Services, working in conjunction with the Office of the Inspector General for the Department of Health and Human Services, are taking steps to hold providers accountable for their involvement in health care fraud schemes. More information can be found at www. justice. gov/criminal-fraud/health-care-fraud-unit.

    MIL OSI USA News –

  • MIL-OSI Australia: Mary River crocodile update

    Source: Tasmania Police

    Issued: 1 Jul 2025

    Wildlife rangers have humanely euthanised a three-metre estuarine (saltwater) crocodile on the banks of the Mary River at Dundathu, near Maryborough in the Wide Bay region due to the ongoing public safety risk.

    The crocodile was reported to Department of the Environment, Tourism, Science and Innovation by a member of the public on 24 June 2025.

    The department thanks the person for submitting the crocodile sighting report.

    Crocodile sightings can be reported by using the QWildlife app, completing an online crocodile sighting report on the DETSI website, or by calling 1300 130 372. The department investigates every crocodile sighting report received.

    MIL OSI News –

  • MIL-OSI USA: Canadian Man Arrested and Detained for Role in Deadly Alien Smuggling Conspiracy at the U.S.’s Northern Border

    Source: US State of North Dakota

    Note: View the indictment here and detention letter here.

    WASHINGTON — A dual Canadian American citizen was arrested on Sunday, June 15, for his role in a deadly human smuggling conspiracy that left a family of four, including two children under the age of three, dead in the St. Lawrence River. Oakes was arrested as he attempted to enter the United States via the Massena, New York, Port of Entry.

    Timothy Oakes, 34, from the Akwesasne Mohawk Indian Reservation (AMIR), Canada, was previously arraigned on numerous human smuggling offenses in the Northern District of New York District Court and had his detention hearing earlier today and will remain detained. Oakes was indicted on April 9 for conspiring with others to engage in alien smuggling, four counts of alien smuggling for profit, and four counts of alien smuggling resulting in death. United States based co-conspirators Dakota Montour, 31, and Kawisiiostha Celecia Sharrow, 43, both of Akwesasne-Mohawk, New York, and Janet Terrance, 45, of Hogansburg, New York, entered guilty pleas on Jan. 23, Oct. 8, 2024, and March 6, respectively.

    “As alleged, Oakes and his co-conspirators profited from a human smuggling operation with a singular, cold-hearted aim: making money by bringing illegal aliens into the United States, regardless of the danger to human life involved,” said Matthew R. Galeotti, Head of the Justice Department’s Criminal Division. “Their greed resulted in the deaths of a mother, a father, and two small children, as well as one of the defendants’ own brothers. The Criminal Division will continue to disrupt and dismantle these organizations and bring justice to smugglers whose actions result in senseless deaths.”

    “This case shows the terrible perils of illegally crossing the border,” said U.S. Attorney John A. Sarcone III for the Northern District of New York. “Four family members died because a smuggling network put them in harm’s way. My office is proud to partner with Joint Task Force Alpha to continue to combat dangerous human smuggling and trafficking organizations that operate on our northern border.”

    “Oakes’ arrest comes as part of our nearly two-year long investigation into a transnational criminal organization responsible for the large-scale smuggling of aliens from Canada into the United States,” said U.S. Immigration and Customs Enforcement Homeland Security Investigations (ICE HSI) Buffalo Special Agent in Charge Erin Keegan. “ICE HSI leverages its full range of authorities to combat and dismantle the heinous networks of greedy criminals who illicitly sell dangerous, sometimes fatal, passage through our nation’s northern border. We are extremely grateful for a multitude of law enforcement agency partners on the Border Enforcement Security Taskforce who join us in this fight to bring smugglers to justice.”

    “Two toddler aged children and their parents were the tragic victims of an alien smuggling attempt gone horribly wrong,” said Chief Patrol Agent Robert Garcia of the U.S. Border Patrol’s Swanton Sector. “Their deaths were a direct result of callous smugglers who exploited the vulnerable. Due to unrelenting perseverance and investigative efforts by multiple law enforcement agencies, those responsible will be held accountable. Our pursuit of justice persists until justice is served.”

    According to court documents, Oakes was a key facilitator in a human smuggling organization (HSO) that smuggled aliens from Canada into northern New York. Oakes, working with the HSO, routinely smuggled aliens into the United States by piloting boats across the St. Lawrence River. Additionally, Oakes used his home as a staging area for aliens before the HSO smuggled them into the United States. Oakes earned approximately $1,000 for every alien whom he smuggled across the St. Lawrence River into the United States.

    In March 2023, Oakes housed a Romanian family of four, together with other aliens, for about 24 hours. He then transported the family and a boat to a public boat launch. His brother, Casey Oakes, attempted to use the boat to smuggle the Romanian family into the United States, but the boat capsized, killing all four members of the family, as well as Casey Oakes.    

    Terrance, Montour, and Sharrow admitted in their plea agreements that in late March 2023, they were employed to illegally transport a Romanian family of four — a mother, father, one-year-old boy, and two-year-old girl — from Canada into New York. Specifically, Montour admitted that he was aware of the dangerous weather conditions on the day of the tragedy — high winds, freezing temperatures, and limited visibility — yet another co-conspirator still loaded the family of four into the small boat to attempt to cross the St. Lawrence River.

    HSI Massena engaged in an extensive years-long investigation of the case, with assistance from the U.S. Border Patrol, U.S. Customs and Border Protection (CBP), HSI’s Human Smuggling Unit in Washington, D.C., CBP’s National Targeting Center International Interdiction Task Force, New York State Police, Canada Border Services Agency, Akwesasne Mohawk Police Service, St. Regis Mohawk Tribal Police Department, Ontario Provincial Police, Sûreté du Québec, St. Lawrence County Sheriff’s Department, Royal Canadian Mounted Police, and the Cornwall Police Service. The Justice Department’s Office of International Affairs provided significant support with foreign legal assistance requests.

    The defendant’s vehicle with light blue boat in tow on March 29, 2023, at 9:29 p.m., consistent with the boat found in the river during recovery efforts.

    The investigation is a result of the coordinated efforts of Joint Task Force Alpha (JTFA). JTFA, a partnership with the Department of Homeland Security (DHS), has been elevated and expanded by the Attorney General with a mandate to target cartels and other transnational criminal organizations and eliminate human smuggling and trafficking networks operating within the Americas that impact public safety and the security of our borders. JTFA currently comprises detailees from U.S. Attorneys’ Offices along the border, including the Northern District of New York. Dedicated support is provided by numerous components of the Justice Department’s Criminal Division, led by the Human Rights and Special Prosecutions Section (HRSP) and supported by the Money Laundering and Asset Recovery Section, the Office of Enforcement Operations and the Office of International Affairs, among others. JTFA also relies on substantial law enforcement investment from DHS, FBI, and the Drug Enforcement Administration, and other partners. To date, JTFA’s work has resulted in more than 380 domestic and international arrests of leaders, organizers, and significant facilitators of alien smuggling; more than 340 U.S. convictions; more than 290 significant jail sentences imposed; and forfeitures of substantial assets.

    The investigation is being conducted under the Extraterritorial Criminal Travel Strike Force (ECT) program, a joint partnership between the Justice Department’s Criminal Division and HSI. The ECT program focuses on human smuggling networks that may present particular national security or public safety risks, or present grave humanitarian concerns. ECT has dedicated investigative, intelligence and prosecutorial resources. ECT coordinates and receives assistance from other U.S. government agencies and foreign law enforcement authorities.

    Trial Attorney Jenna E. Reed of the Criminal Division’s HRSP and Assistant U.S. Attorney Jeffrey Stitt for the Northern District of New York are prosecuting the case.

    This case is part of Operation Take Back America, a nationwide initiative that marshals the full resources of the Department of Justice to repel the invasion of illegal immigration, achieve the total elimination of cartels and transnational criminal organizations and protect our communities from the perpetrators of violent crime. Operation Take Back America streamlines efforts and resources from the Department’s Organized Crime Drug Enforcement Task Forces and Project Safe Neighborhoods.

    MIL OSI USA News –

  • MIL-OSI USA: Ten Members and Associates of Violent Car-Theft Ring Indicted on Racketeering, Carjacking, Robbery, and Firearm Charges

    Source: US State of California

    A superseding indictment was unsealed today charging Montez Moore, 20, Duane Benson, 20, Aniya Sheperd, 20, Brandon Irons, 19, Allen Brown, 23, Markaveon Jackson, 19, Raynell Moore, 22, Lavatrice McCully-Collins, 24, Peontay Roddy, 21, and Noah Hornburg, 23 — all of St. Louis, Missouri — with crimes including racketeering conspiracy, carjacking, robbery, and firearm charges related to their participation in “the Strikers,” a violent, interstate stolen car ring.

    According to court documents, between September 2023 and March 2024, the Strikers engaged in car dealership burglaries, illegal interstate vehicle sales and thefts, shootings, carjacking, robbery, and other criminal acts throughout Missouri and Illinois.

    “As alleged, the Strikers enterprise stole approximately 50 vehicles and inflicted nearly $3 million in losses while carrying out a violent crime spree across Missouri and Illinois,” said Matthew R. Galeotti, Head of the Justice Department’s Criminal Division. “Their reckless actions endangered communities and dealt a serious blow to local businesses. This kind of brazen, lawless conduct will not be tolerated, and the Justice Department is committed to working with our federal, state, and local partners to protect the public and hold those responsible fully accountable.”

    “Thanks to the Justice Department’s Violent Crime Initiative, we were able to expand an existing indictment to hold more members of the Strikers responsible for a litany of violent crimes,” said Acting U.S. Attorney Matthew T. Drake for the Eastern District of Missouri. “As we said when we announced St. Louis’ inclusion in the VCI last year, we are targeting and dismantling the criminal organizations that are disproportionately driving violent crime in St. Louis.”

    “This was a violent, organized crime operation that spanned across state lines, left a trail of stolen vehicles and cost millions of dollars in losses,” said Assistant Director Jose A. Perez of the FBI Criminal Investigative Division. “This case demonstrates the power of the RICO statute to dismantle interstate criminal enterprises and reflects the FBI’s unwavering commitment to pursuing those who use violence and intimidation to profit from crime.”

    In a single burglary, defendants and others burglarized a dealership in Cape Girardeau, Missouri and stole seven high-end vehicles worth approximately $855,000.

    To hide their identities during the burglaries, the defendants would wear gloves, dark clothing, and masks. In one incident, defendants Hornburg, Moore, and Irons led police on a high-speed chase, driving on a public street reaching speeds over 110 mph. In another incident, after police seized one of the stolen cars, defendants Shepard, Benson, and others broke into the police impound lot and stole the car back.     

    After stealing the vehicles, the defendants allegedly concealed their stolen nature or location by attaching stolen out-of-state dealer plates and covering or removing vehicle identification numbers. The stolen vehicles would then be used in other crimes or sold through social media advertising. The Strikers would often advertise a sales price at such a discount that prospective buyers should have suspected the vehicles were stolen. In one Instagram posting, defendants offered for sale a 2019 Infiniti q70 for $3000, a 2016 Mercedes Benz GLE 400 for $1500, and a 2014 BMW 528i for $2500.

    In one alleged carjacking and robbery, defendants Benson and Moore pulled up to a BP gas station in a stolen blue 2017 BMW 330i that had been taken from a dealership in Springfield, Illinois. They briefly waited for a lottery machine technician to walk out of the store and as captured on store surveillance, ambushed him at gunpoint, robbed him, and highjacked his white Silverado pickup.

    A screenshot showing a January 2024 robbery and carjacking in Cool Valley, Missouri

    If convicted, each defendant faces up to 20 years in prison for the racketeering conspiracy. Defendants Moore and Benson face up to an additional 30 years in prison if convicted of carjacking, robbery and use of a firearm in connection thereof. Defendant Aniya Shephard faces up to an additional 10 years in prison if convicted of possessing a machinegun.

    The Federal Bureau of Investigation and the St. Louis County Police Department are investigating the case.

    Trial Attorney Jared A. Hernandez of the Criminal Division’s Violent Crime and Racketeering Section and Assistant U.S. Attorney Nino Przulj for the Eastern District of Missouri are prosecuting the case.

    This case is part of the Criminal Division’s Violent Crime Initiative in St. Louis conducted in partnership with the U.S. Attorney’s Office in the Eastern District of Missouri and local, state, and federal law enforcement. The joint effort addresses violent crime by employing, where appropriate, federal laws to prosecute gang members and their associates in St. Louis.

    An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

    MIL OSI USA News –

  • MIL-OSI USA: Smuggling Leader and Top Coordinator Will Spend Remainder of Their Lives in Prison Following Their Sentencing on Third Anniversary of Deadly Tractor-Trailer Smuggling Conspiracy

    Source: US State of California

    Two convicted human smugglers were sentenced in a federal court in San Antonio today for their prominent roles in the 2022 mass casualty human smuggling conspiracy that resulted in the deaths of 47 adults and six children.

    U.S. District Judge Orlando Garcia for the Western District of Texas sentenced Orduna-Torres to life in prison and a $250,000 fine, and Gonzales-Ortega to 83 years in prison and a $250,000 fine. Both defendants were found guilty by a federal jury in March for three counts related to the transportation of aliens within the United States resulting in death, causing serious bodily injury, and placing lives in jeopardy. Following the jury’s verdict at the trial, Judge Garcia set the sentencing date, noting that it would be three years to the day from when the 53 migrants perished as a result of the defendants’ smuggling scheme.

    “These criminals will spend the rest of their lives in prison because of their cruel choice to profit off of human suffering,” said Attorney General Pamela Bondi. “Today’s sentences are a powerful message to human smugglers everywhere: we will not rest until you are behind bars.”

    “Three years to the day after these two smugglers and their co-conspirators left dozens of men, women, and children locked in a sweltering tractor-trailer to die in the Texas summer heat, they learned that they will spend the rest of their lives locked away in a federal prison,” said U.S. Attorney Justin R. Simmons for the Western District of Texas. “We recognize the justice handed down by Judge Garcia and thank our law enforcement partners for their great work that led to today’s outcome. At the same time, we reinforce the message that these criminal organizations will not place the lives of the desperate and vulnerable above their own financial enrichment. My office remains focused on prosecuting smugglers and their networks, and ultimately eradicating transnational criminal organizations.”

    “Today’s sentences are the result of a far-reaching investigation and a tireless commitment by HSI and our law enforcement partners to dismantle the deadliest human smuggling operation in U.S. history,” said Special Agent in Charge Craig Larrabee for U.S. Immigration and Customs Enforcement (ICE) Homeland Security Investigations (HSI) San Antonio. “This case serves as a stark reminder: human smuggling is not a service — it is a deadly criminal enterprise. HSI will pursue smugglers relentlessly, wherever they operate. No one, who participates in the smuggling of human beings, will escape the reach of justice.”

    According to court documents and evidence presented at trial, Felipe Orduna-Torres, also known as Cholo, Chuequito/Chuekito, and Negro, 30, was a leader and organizer, and Armando Gonzales-Ortega, also known as El Don and Don Gon, 55, was a coordinator in the human smuggling organization (HSO) which illegally brought adults and children from Guatemala, Honduras, and Mexico into the United States between December 2021 and June 2022.

    Court documents and evidence presented at the trial revealed that Orduna-Torres and Gonzales-Ortega worked in concert to transport and facilitate the transportation of the migrants, sharing routes, guides, stash houses, trucks, trailers, and transporters in order to consolidate costs, minimize risks, and maximize profit. The HSO maintained a variety of tractors and trailers for their smuggling operations, some of which were stored at a private parking lot in San Antonio.

    In the days leading up to June 27, 2022, Orduna-Torres and others exchanged the names of illegal aliens who would be smuggled in an upcoming tractor-trailer load. Gonzales-Ortega traveled to Laredo to meet the tractor-trailer, where at least 64 undocumented individuals, including eight children and one pregnant woman, were loaded for smuggling.

    Some of the defendants, including Orduna-Torres, were aware that the trailer’s reefer unit was malfunctioning and was not blowing any cool air to the migrants inside. When members of the organization met the tractor-trailer at the end of its approximately three-hour journey to San Antonio, they opened the doors to find 48 of the migrants were either already dead or had died on site, including the pregnant woman. Sixteen of the undocumented individuals were transported to hospitals — five of whom died.

    In addition to their sentences described above, the court also ordered Orduna-Torres to pay a $96,000 money judgment and ordered the forfeiture of the following assets: one 2008 Volvo semi-tractor; one 1995 Phoenix trailer; one 2015 Cadillac Escalade; one 2017 Ford F-350 Super Duty Truck; and $59,445.50.

    Five other defendants in this case have pleaded guilty for their involvement in the smuggling event. Riley Covarrubias-Ponce, also known as Rrili and Rilay, 32, is scheduled to be sentenced Nov. 6; Luis Alberto Rivera-Leal, 39, is scheduled to be sentenced on Nov. 13; Christian Martinez, 31, is scheduled to be sentenced on Nov. 20; and Homero Zamorano Jr., 48, is scheduled to be sentenced Dec. 4. Juan Francisco D’Luna Bilbao, 51, is indicted separately and is also scheduled to be sentenced Dec. 4.

    In a related case, Rigoberto Ramon Miranda-Orozco, 48, allegedly worked with the HSO to smuggle aliens into the United States on the same fatal journey orchestrated by Orduna-Torres and his co-conspirators. He made his initial appearance in San Antonio on March 17, seven months after he was arrested in Guatemala, and is currently scheduled for a jury trial Sept. 29.

    HSI investigated the case with the assistance of the FBI and the Bureau of Alcohol, Tobacco, Firearms and Explosives, and has received tremendous support from Customs and Border Protection; Border Patrol; ICE’s Enforcement and Removal Operations; the San Antonio Police Department; the Bexar County Sheriff’s Office; the San Antonio Fire Department; the Marshall Police Department; and the Palestine Police Department.

    Assistant U.S. Attorneys Eric Fuchs, Sarah Spears and Ray Gattinella for the Western District of Texas are prosecuting the case.

    These convictions are the result of the coordinated efforts of Joint Task Force Alpha (JTFA). JTFA, a partnership with the Department of Homeland Security (DHS), has been elevated and expanded by the Attorney General with a mandate to target cartels and other transnational criminal organizations to eliminate human smuggling and trafficking networks operating in Mexico, Guatemala, El Salvador, Honduras, Panama, and Colombia that impact public safety and the security of our borders. JTFA currently comprises detailees from U.S. Attorneys’ Offices along the southwest border. Dedicated support is provided by numerous components of the Justice Department’s Criminal Division, led by the Human Rights and Special Prosecutions Section and supported by the Money Laundering and Asset Recovery Section; Office of Enforcement Operations; and the Office of International Affairs, among others. JTFA also relies on substantial law enforcement investment from DHS, FBI, the Drug Enforcement Administration (DEA), and other partners. To date, JTFA’s work has resulted in more than 385 domestic and international arrests of leaders, organizers, and significant facilitators of alien smuggling; more than 345 U.S. convictions; more than 300 significant jail sentences imposed; and forfeitures of substantial assets.

    This case is part of Operation Take Back America, a nationwide initiative that marshals the full resources of the Department of Justice to repel the invasion of illegal immigration, achieve the total elimination of cartels and transnational criminal organizations, and protect our communities from the perpetrators of violent crime. Operation Take Back America streamlines efforts and resources from the Department’s Organized Crime Drug Enforcement Task Forces (OCDETFs) and Project Safe Neighborhoods (PSN).

    MIL OSI USA News –

  • MIL-OSI USA: Chicago-Area Return Preparer Pleads Guilty to Tax Offenses

    Source: US State of California

    Defendant Filed False Tax Returns for Others and Himself Causing Nearly $1M in Loss to IRS

    An Illinois man who operated a tax return preparation business pleaded guilty yesterday to preparing and filing false individual income tax returns for clients and for himself.

    The following is according to court documents and statements made in court: Byron Taylor, of Homewood, owned and operated We Are Taxes, a tax preparation business in Dolton, Illinois. Taylor claimed his business had over 25 years of experience preparing tax returns and boasted that “Everyone Gets a Check!” For many years, Taylor prepared and filed with the IRS false individual income tax returns for clients. On those returns, Taylor included false deductions including medical and dental expenses, gifts to charity, state and local real estate taxes, and unreimbursed employee expenses. Taylor also included false business losses. The false information resulted in Taylor’s clients claiming refunds that they were otherwise not entitled to receive. For tax years 2015 through 2020, Taylor prepared and filed at least 54 false tax returns for clients.

    In addition, Taylor filed or attempted to file false individual income tax returns for himself for tax years 2017 through 2021. On these returns, Taylor substantially underreported income received by We Are Taxes or failed to report the business entirely.

    Finally, Taylor filed multiple false Paycheck Protection Program (PPP) loan applications for several businesses he claimed he owned and operated. The loan applications falsely claimed, for example, that these entities had earned certain amounts of gross income and that such income had been reported to the IRS. In fact, the businesses had not received that income, and Taylor had not filed tax returns reporting these businesses to the IRS. Four of the applications were approved. After he received the PPP loans, Taylor used portions of the funds on personal expenditures, including gambling expenses.

    In total, Taylor caused a tax loss to the IRS of $914,745.

    Taylor is scheduled to be sentenced on Nov. 4. He faces a maximum penalty of three years in prison for the false return he prepared and filed on behalf of a client, and a maximum penalty of three years in prison for the false return he filed for himself. He also faces a period of supervised release, restitution, and monetary penalties. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

    Acting Deputy Assistant Attorney General Karen E. Kelly of the Justice Department’s Tax Division made the announcement.

    IRS Criminal Investigation is investigating the case.

    Assistant Chief Matthew J. Kluge and Trial Attorney Boris Bourget of the Tax Division are prosecuting the case.

    MIL OSI USA News –

  • MIL-OSI USA: Justice Department Requires Divestitures and Licensing Commitments in HPE’s Acquisition of Juniper Networks

    Source: US State of California

    WASHINGTON — Achieving a result otherwise unavailable through litigation, earlier today the Justice Department advised the court it had reached a settlement with HPE and Juniper that allows their merger to continue. This novel approach by the Justice Department reflects a commitment to solving unique challenges in mergers. Under the leadership of Attorney General Pam Bondi the laws of this country will be zealously enforced.

    “Thank you to the hardworking men and women of the Antitrust Division for their work on this case.” — Gail Slater, Assistant Attorney General for the Antitrust Divison

    “This marks another key legal victory from the Department of Justice’s Antitrust division. Our attorneys will continue fighting and winning to defend the American people and consumers.” — Department of Justice Chief of Staff Chad Mizelle

    The settlement requires HPE to divest its Instant On business and mandates that the merged firm license critical Juniper software to independent competitors. HPE must divest its global “Instant On” campus and branch WLAN business, including all assets, intellectual property, R&D personnel, and customer relationships, to a DOJ-approved buyer within 180 days. The agreement also ensures that key software assets will be available to rivals looking to compete with the merged company. The parties must hold an auction to license Juniper’s AI Ops for Mist source code—an important component in modern WLAN systems. The license will be perpetual, non-exclusive, and include optional transitional support and personnel transfers to facilitate competition.

    MIL OSI USA News –

  • MIL-OSI USA: Chicago Man Convicted of Conspiring to Provide Material Support to ISIS

    Source: US State of California

    A Chicago man was convicted today of conspiring to provide material support to the Islamic State of Iraq and al-Sham (ISIS) by using social media to encourage attacks on ISIS’s enemies and recruit new ISIS members.

    According to court documents, Ashraf Al Safoo, 41, was a leader of Khattab Media Foundation, a sophisticated online organization that swore allegiance to ISIS and created and disseminated threats and ISIS propaganda on social media and other online platforms. Al Safoo and other members of Khattab created and posted pro-ISIS videos, articles, essays, and infographics at the direction of, and in coordination with, ISIS. Much of Khattab’s propaganda promoted violent jihad on behalf of the terrorist group.

    In one posting, Al Safoo encouraged Khattab members to post pro-ISIS information “to cause confusion and spread terror within the hearts of those who disbelieved.” In another posting, Al Safoo wrote, “Work hard, brothers, edit the issue into short clips, take the pictures out of it and publish the efforts of your brothers in the pages of the apostates. Participate in the war, and spread terror, the [Islamic] State does not want you to watch it only, rather, it incites you, and if you are unable to, use it to incite others.”

    Many of Khattab’s postings included images of violence, celebrations of terrorist attacks and mass shootings in the United States, and encouragement for “lone wolf” attacks in western countries.

    Al Safoo was arrested in Chicago in 2018. After a bench trial in U.S. District Court in Chicago, U.S. District Judge John Robert Blakey found Al Safoo guilty of one count of conspiracy to provide material support to a foreign terrorist organization, one count of conspiracy to transmit threats in interstate commerce, one count of conspiracy to intentionally access a protected computer without authorization, four counts of intentionally accessing a protected computer without authorization, and four counts of providing material support to a foreign terrorist organization.

    The convictions carry a maximum penalty of 130 years in prison. Sentencing is scheduled for Oct. 9. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

    Assistant Attorney General John A. Eisenberg of the Justice Department’s National Security Division, U.S. Attorney Andrew S. Boutros for the Northern District of Illinois, and Assistant Director Donald M. Holstead of the FBI’s Counterterrorism Division made the announcement.

    The FBI Chicago Field Office is investigating the case.

    Assistant U.S. Attorneys Melody Wells, Barry Jonas, and Thomas P. Peabody for the Northern District of Illinois, and Trial Attorney Andrew J. Dixon of the National Security Division’s Counterterrorism Section are prosecuting the case.

    MIL OSI USA News –

  • MIL-OSI USA: National Health Care Fraud Takedown Results in 324 Defendants Charged in Connection with Over $14.6 Billion in Alleged Fraud

    Source: US State of California

    Largest Justice Department Health Care Fraud Takedown in History
    More than Doubles Prior Record of $6 Billion

    The Justice Department today announced the results of its 2025 National Health Care Fraud Takedown, which resulted in criminal charges against 324 defendants, including 96 doctors, nurse practitioners, pharmacists, and other licensed medical professionals, in 50 federal districts and 12 State Attorneys General’s Offices across the United States, for their alleged participation in various health care fraud schemes involving over $14.6 billion in intended loss. The Takedown involved federal and state law enforcement agencies across the country and represents an unprecedented effort to combat health care fraud schemes that exploit patients and taxpayers.

    Demonstrating the significant return on investment that results from health care fraud enforcement efforts, the government seized over $245 million in cash, luxury vehicles, cryptocurrency, and other assets as part of the coordinated enforcement efforts. As part of the whole-of-government approach to combating health care fraud announced today, the Centers for Medicare and Medicaid Services (CMS) also announced that it successfully prevented over $4 billion from being paid in response to false and fraudulent claims and that it suspended or revoked the billing privileges of 205 providers in the months leading up to the Takedown. Civil charges against 20 defendants for $14.2 million in alleged fraud, as well as civil settlements with 106 defendants totaling $34.3 million, were also announced as part of the Takedown.

    Today’s Takedown was led and coordinated by the Health Care Fraud Unit of the Department of Justice Criminal Division’s Fraud Section and its core partners from U.S. Attorneys’ Offices, the Department of Health and Human Services Office of Inspector General (HHS-OIG), the Federal Bureau of Investigation (FBI), and the Drug Enforcement Administration (DEA). The cases were investigated by agents from HHS-OIG, FBI, DEA, and other federal and state law enforcement agencies. The cases are being prosecuted by Health Care Fraud Strike Force teams from the Criminal Division’s Fraud Section, 50 U.S. Attorneys’ Offices nationwide, and 12 State Attorneys General Offices.

    “This record-setting Health Care Fraud Takedown delivers justice to criminal actors who prey upon our most vulnerable citizens and steal from hardworking American taxpayers,” said Attorney General Pamela Bondi. “Make no mistake – this administration will not tolerate criminals who line their pockets with taxpayer dollars while endangering the health and safety of our communities.”

    “As part of making healthcare accessible and affordable to all Americans, HHS will aggressively work with our law enforcement partners to eliminate the pervasive health care fraud that bedeviled this agency under the former administration and drove up costs,” said Secretary Robert F. Kennedy Jr. of the Department of Health and Human Services.

    “The Criminal Division is intensely committed to rooting out health care fraud schemes and prosecuting the criminals who perpetrate them because these schemes: (1) often result in physical patient harm through medically unnecessary treatments or failure to provide the correct treatments; (2) contribute to our nationwide opioid epidemic and exacerbate controlled substance addiction; and (3) do all of that while stealing money hardworking Americans contribute to pay for the care of their elders and other vulnerable citizens,” said Matthew R. Galeotti, Head of the Justice Department’s Criminal Division. “The Division’s Health Care Fraud Unit and U.S. Attorneys’ Offices stand united with our law enforcement partners in this fight, and we will continue to use every tool at our disposal to protect the integrity of our health care programs for the American people.”

    “The scale of today’s Takedown is unprecedented, and so is the harm we’re confronting. Individuals who attempt to steal from the federal health care system and put vulnerable patients at risk will be held accountable,” said Acting Inspector General Juliet T. Hodgkins of HHS-OIG. “Our agents at HHS-OIG work relentlessly to detect, investigate, and dismantle these fraud schemes. We are proud to stand with our law enforcement partners in protecting taxpayer dollars and safeguarding patient care.”

    “Health care fraud drains critical resources from programs intended to help people who truly need medical care,” said FBI Director Kash Patel. “Today’s announcement demonstrates our commitment to pursuing those who exploit the system for personal gain. With more than $13 billion in fraud uncovered, this is the largest takedown for this initiative to date. Together, the FBI and our law enforcement partners will continue to hold those accountable who steal from the American people and undermine our health care systems.”

    Transnational Criminal Organizations

    29 defendants were charged for their roles in transnational criminal organizations alleged to have submitted over $12 billion in fraudulent claims to America’s health insurance programs.

    For instance, a nationwide investigation known as Operation Gold Rush resulted in the largest loss amount ever charged in a health care fraud case brought by the Department. These charges were announced in the Eastern District of New York, the Northern District of Illinois, the Central District of California, the Middle District of Florida, and the District of New Jersey against 19 defendants. Twelve of these defendants have been arrested, including four defendants who were apprehended in Estonia as a result of international cooperation with Estonian law enforcement and seven defendants who were arrested at U.S. airports and the U.S. border with Mexico, cutting off their intended escape routes as they attempted to avoid capture.

    The organization allegedly used a network of foreign straw owners, including individuals sent into the United States from abroad, who, acting at the direction of others using encrypted messaging and assumed identities from overseas, strategically bought dozens of medical supply companies located across the United States. They then rapidly submitted $10.6 billion in fraudulent health care claims to Medicare for urinary catheters and other durable medical equipment by exploiting the stolen identities of over one million Americans spanning all 50 states and using their confidential medical information to submit the fraudulent claims. As alleged, the organization exploited the U.S. financial system by laundering the fraudulent proceeds and deploying a range of tactics to circumvent anti-money laundering controls to transfer funds into cryptocurrency and shell companies located abroad. The arrests announced today also include a banker who facilitated the money laundering of fraud proceeds on behalf of the organization through a U.S.-based bank.

    The Health Care Fraud Unit’s Data Analytics Team and its partners detected the anomalous billing through proactive data analytics, and HHS-OIG and CMS successfully prevented the organization from receiving all but approximately $41 million of the approximately $4.45 billion that was scheduled to be paid by Medicare. HHS and CMS intend to seek to return the $4.41 billion in escrow to the Medicare trust fund for needed medical care. The scheme nonetheless resulted in payments of approximately $900 million from Medicare supplemental insurers. To date, law enforcement has seized approximately $27.7 million in fraud proceeds as part of Operation Gold Rush.

    In another action involving foreign influence, charges were filed in the Northern District of Illinois against five defendants, including two owners and executives of Pakistani marketing organizations, in connection with a $703 million scheme in which Medicare beneficiaries’ identification numbers and other confidential health information were allegedly obtained through theft and deceptive marketing. The defendants allegedly used artificial intelligence to create fake recordings of Medicare beneficiaries purportedly consenting to receive certain products. According to court documents, the beneficiaries’ confidential information was then illegally sold to laboratories and durable medical equipment companies, which used this unlawfully obtained and fraudulently generated data to submit false claims to Medicare. Certain defendants controlled dozens of nominee-owned durable medical equipment companies and laboratories that allegedly submitted fraudulent claims for products and services the beneficiaries did not request, need, or receive. Certain defendants also allegedly conspired to conceal and launder the fraud proceeds from bank accounts they controlled in the United States to bank accounts overseas. In total, the defendants caused approximately $703 million in alleged fraudulent claims to Medicare and Medicare Advantage plans, which paid approximately $418 million on those claims. The government seized approximately $44.7 million from various bank accounts related to this case.

    Finally, a defendant based in Pakistan and the United Arab Emirates who owned a billing company allegedly orchestrated a scheme to prey upon vulnerable individuals in need of addiction treatment by conspiring with treatment center owners to fraudulently bill Arizona Medicaid approximately $650 million for substance abuse treatment services. According to court documents, some of the services billed were never provided, while other services were provided at a level that was so substandard that it failed to serve any treatment purpose. As part of the conspiracy, treatment center owners allegedly paid illegal kickbacks in exchange for the referral of patients recruited from the homeless population and Native American reservations. The defendant received at least $25 million of ill-gotten Arizona Medicaid funds as a result of the conspiracy and is charged with a money laundering offense for his alleged use of those funds to purchase a $2.9 million home located on a golf estate in Dubai.

    Fraudulent Wound Care

    Charges were filed in the District of Arizona and the District of Nevada against seven defendants, including five medical professionals, in connection with approximately $1.1 billion in fraudulent claims to Medicare and other health care benefit programs for amniotic wound allografts. As alleged, certain defendants targeted vulnerable elderly patients, many of whom were receiving hospice care, and applied medically unnecessary amniotic allografts to these patients’ wounds. Many of the allografts allegedly were applied without coordination with the patients’ treating physicians, without proper treatment for infection, to superficial wounds that did not need this treatment, and to areas that far exceeded the size of the wound. Certain defendants allegedly received millions in illegal kickbacks from the fraudulent billing scheme.

    “Today’s unprecedented enforcement action demonstrates that CMS and our federal partners are united in our mission to protect the integrity of Medicare and Medicaid by crushing waste, fraud, and abuse,” said CMS Administrator Dr. Mehmet Oz. “Every dollar we prevent from going to fraudsters is a dollar that stays in the system to serve legitimate beneficiaries. Through advanced data analytics, real-time monitoring, and swift administrative action, CMS is leading the fight to protect Medicare, Medicaid, and the trust Americans place in these vital programs. We’re not waiting for fraud to happen—we’re stopping it before it starts.”

    Prescription Opioid Trafficking

    74 defendants, including 44 licensed medical professionals, were charged across 58 cases in connection with the alleged illegal diversion of over 15 million pills of prescription opioids and other controlled substances. For example, five defendants associated with one Texas pharmacy were charged with the unlawful distribution of over 3 million opioid pills. As alleged, the defendants conspired to distribute massive quantities of oxycodone, hydrocodone, and carisoprodol, which were subsequently trafficked by street-level drug dealers, generating large profits for the defendants. This coordinated action is a continuation of the Health Care Fraud Unit’s systematic approach to stopping drug trafficking organizations and their pharmaceutical wholesale suppliers, which together have fueled an epidemic of prescription opioid abuse for nearly a decade.

    DEA also announced today that in the last six months, DEA charged 93 administrative cases seeking the revocation of pharmacies, medical practitioners, and companies authority to handle and/or prescribe controlled substances.

    “Health care fraud isn’t just theft — it’s trafficking in trust. Today’s announcement shows that when doctors become drug dealers and treatment centers become profit-driven fraud rings, DEA will act,” said Acting Administrator Robert Murphy of the DEA. “We’re targeting the entire ecosystem of fraud — from pill mills in Texas to kickback clinics exploiting Native communities. If you abuse your medical license to push poison or pad your pockets, we will hold you accountable.”

    Telemedicine and Genetic Testing Fraud

    In today’s Takedown, 49 defendants were charged in connection with the submission of over $1.17 billion in allegedly fraudulent claims to Medicare resulting from telemedicine and genetic testing fraud schemes. For example, in the Southern District of Florida, prosecutors charged an owner of telemedicine and durable medical equipment companies with a $46 million scheme in which Medicare beneficiaries were allegedly targeted through deceptive telemarketing campaigns and then fraudulent claims were submitted to Medicare for durable medical equipment and genetic tests for these beneficiaries. The Department continues to focus on eliminating health care fraud schemes that depend on telemedicine, including schemes involving fraudulent claims for genetic testing, durable medical equipment, and COVID-19 tests.

    Other Health Care Fraud Schemes

    The other cases announced today charge an additional 170 defendants with various other health care fraud schemes involving over $1.84 billion in allegedly false and fraudulent claims to Medicare, Medicaid, and private insurance companies for diagnostic testing, medical visits, and treatments that were medically unnecessary, provided in connection with kickbacks and bribes, or never provided at all. For example, in the Western District of Tennessee, prosecutors charged three defendants, including business owners and a pharmacist, with a $28.7 million scheme to defraud the Federal Employees’ Compensation Fund by allegedly billing for medications for injured United States Postal Service employees that were never prescribed by a licensed practitioner and largely were not dispensed as claimed. And in the Western District of Washington and the Northern District of California, prosecutors charged medical providers with allegedly stealing fentanyl and hydrocodone, respectively, that was meant for the providers’ patients, including child patients in need of anesthesia.

    “VA’s Integrated Veteran Care Programs provide critical community-based health care to our nation’s disabled veterans and their dependents,” said Acting Inspector General David Case of the Department of Veterans Affairs Office of Inspector General (VA-OIG). “Robust oversight of VA’s health care system is one of VA-OIG’s highest priorities. VA-OIG is committed to holding accountable those who defraud government benefits programs intended to care for our nation’s heroes.”

    Breaking Down Silos in the Fight Against Health Care Fraud

    In connection with the coordinated nationwide law enforcement operation, the Department is announcing that it is working closely with HHS-OIG, FBI, and other agencies to create a Health Care Fraud Data Fusion Center to bring together experts from the Department’s Criminal Division, Fraud Section, Health Care Fraud Unit Data Analytics Team; HHS-OIG; FBI; and other agencies to leverage cloud computing, artificial intelligence, and advanced analytics to identify emerging health care fraud schemes. The Health Care Fraud Unit’s Data Analytics Team was established in 2018 to enhance the Unit’s ability to detect, investigate, and prosecute complex health care fraud schemes. Joining forces with data analysts from HHS-OIG, FBI, and other partners will increase efficiency, detection, and rapid prosecution of emerging health care fraud schemes. It will also implement the President’s Executive Order Stopping Waste, Fraud, and Abuse by Eliminating Information Silos (Exec. Order No. 14243, 3 C.F.R. 294 (2025)) by reducing duplicative data teams, increasing operational efficiency through a whole-of-government approach, and leveraging cloud computing, artificial intelligence, and other agency resources.

    Principal Assistant Deputy Chief Jacob Foster, Assistant Deputy Chief Rebecca Yuan, Trial Attorney Miriam L. Glaser Dauermann, and Data Analyst Elizabeth Nolte, all of the Health Care Fraud Unit of the Criminal Division’s Fraud Section, led and coordinated this year’s Takedown. The cases are being prosecuted by the Health Care Fraud Unit’s National Rapid Response, Florida, Gulf Coast, Los Angeles, Midwest, New England, Northeast, and Texas Strike Forces; U.S. Attorneys’ Offices for the District of Arizona, Central District of California, Northern District of California, Southern District of California, District of Columbia, District of Connecticut, District of Delaware, Middle District of Florida, Northern District of Florida, Southern District of Florida, Middle District of Georgia, District of Idaho, Northern District of Illinois, Eastern District of Kentucky, Western District of Kentucky, Eastern District of Louisiana, Middle District of Louisiana, District of Maine, District of Massachusetts, Eastern District of Michigan, Western District of Michigan, Northern District of Mississippi, Southern District of Mississippi, District of Montana, District of Nevada, District of New Hampshire, District of New Jersey, Eastern District of New York, Northern District of New York, Southern District of New York, Western District of New York, Eastern District of North Carolina, Western District of North Carolina, District of North Dakota, Northern District of Ohio, Southern District of Ohio, Northern District of Oklahoma, Western District of Oklahoma, District of Oregon, Eastern District of Pennsylvania, District of South Carolina, Middle District of Tennessee, Western District of Tennessee, Northern District of Texas, Southern District of Texas, Western District of Texas, District of Vermont, Eastern District of Virginia, Western District of Washington, and Northern District of West Virginia; and State Attorneys General’s Offices for California, Illinois, Indiana, Louisiana, Massachusetts, Michigan, Missouri, New York, Ohio, Pennsylvania, South Carolina, and Wisconsin. The Health Care Fraud Unit’s Data Analytics Team used cutting-edge data analytics to identify and support the investigations that led to these charges.

    In addition to FBI, HHS-OIG, DEA, and CMS, HSI, VA-OIG, IRS Criminal Investigation, Defense Criminal Investigative Service, Department of Labor, United States Postal Service Office of Inspector General, Office of Personnel Management Office of Inspector General, and other federal, state, and local law enforcement agencies participated in the operation. The Medicaid Fraud Control Units of California, the District of Columbia, Florida, Georgia, Illinois, Indiana, Louisiana, Massachusetts, Michigan, Missouri, New York, North Carolina, North Dakota, Ohio, Pennsylvania, South Carolina, Texas, Virginia, and Wisconsin also participated in the investigation of many of the federal and state cases announced today.

    The Fraud Section leads the Criminal Division’s efforts to combat health care fraud through the Health Care Fraud Strike Forces. Prior to the charges announced as part of today’s nationwide Takedown and since its inception in March 2007, the Health Care Fraud Strike Force, which operates in 27 districts, charged more than 5,400 defendants who collectively billed Medicare, Medicaid, and private health insurers more than $27 billion.

    The following materials related to today’s announcement are available on the Health Care Fraud Unit’s website through these links:

    •  Graphics and Resources

    •  Case Descriptions

    •  Court Documents

    An indictment, information, or complaint is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

    MIL OSI USA News –

  • MIL-OSI Security: Pittsburgh Felon Sentenced to More Than Five Years in Prison for Possession of Firearm and Violating Conditions of Supervised Release

    Source: United States Bureau of Alcohol Tobacco Firearms and Explosives (ATF)

    PITTSBURGH, Pa. – A resident of Pittsburgh, Pennsylvania, has been sentenced in federal court to 65 months of prison on his conviction of being a felon in possession of a firearm and violating the conditions of his supervised release, Acting United States Attorney Troy Rivetti announced today.

    Senior United States District Judge David S. Cercone imposed the sentence on Raymond Young, 23, on June 27, 2025.

    According to information presented to the Court, on August 7, 2024, Glassport patrol officers stopped Young in a vehicle he was driving without a license. In preparation for towing Young’s vehicle, officers observed a firearm in the vehicle and attempted to remove Young, who then shifted the vehicle into gear and sped off, running over one officer’s feet and nearly striking another officer. Young’s vehicle came to a stop after hitting a parked vehicle. Young exited the vehicle and attempted to flee the scene on foot, but was apprehended by police.

    In the defendant’s flight path, the officers recovered a Glock pistol with an extended magazine loaded with 30 rounds of ammunition and one round in the chamber. The firearm had been reported as stolen. Young is precluded under federal law from possessing a firearm because he was previously convicted of a felony for possession of a firearm with an obliterated serial number. Young was still on federal supervised release for that offense when he was arrested by the Glassport Police on August 7, 2024.

    Assistant United States Attorney Brendan T. Conway prosecuted this case on behalf of the government.

    Acting United States Attorney Rivetti commended the Glassport Police Department and Bureau of Alcohol, Tobacco, Firearms and Explosives for the investigation leading to the successful prosecution of Young.

    This case is part of Project Safe Neighborhoods (PSN), a program bringing together all levels of law enforcement and the communities they serve to reduce violent crime and gun violence and to make our neighborhoods safer for everyone. On May 26, 2021, the Department launched a violent crime reduction strategy strengthening PSN based on these core principles: fostering trust and legitimacy in our communities, supporting community-based organizations that help prevent violence from occurring in the first place, setting focused and strategic enforcement priorities, and measuring the results.

    MIL Security OSI –

  • MIL-OSI Security: Orlando Man Indicted for Making Online Threats Against the United States Attorney for the District of New Jersey

    Source: US FBI

    Orlando, Florida – United States Attorney Gregory W. Kehoe announces the  unsealing of an indictment charging Salvatore Russotto (58, Orlando) with threatening to injure and kill the victim, the United States Attorney for the District of New Jersey, Alina Habba, and with retaliating against a federal law enforcement officer by threat. If convicted on both counts, Russotto faces a maximum penalty of 10 years in federal prison. 

    According to the indictment, on May 19, 2025, Russotto made a threat to injure and kill the victim in a series of postings from an online account belonging to him. Specifically, Russotto stated, among other things, “A slow painful death for HABBA,” “Eliminate HABBA. 86 Traitor. Death penalty for all traitors,” “I HOPE YOU DIE A PAINFUL DEATH,” a true threat of violence.

    An indictment is merely a formal charge that a defendant has committed one or more violations of federal criminal law, and every defendant is presumed innocent unless, and until, proven guilty.

    This case was investigated by the Federal Bureau of Investigation – Newark, Jersey and Tampa, Florida Field Offices – and the United States Marshals Service. It will be prosecuted by Assistant United States Attorney Kara Wick.

    MIL Security OSI –

  • MIL-OSI Security: PENSACOLA MAN INCARCERATED FOR NARCOTICS TRAFFICKING & FIREARM POSSESSION

    Source: United States Bureau of Alcohol Tobacco Firearms and Explosives (ATF)

    PENSACOLA, FLORIDA – Marcus Devon Rayford, 42, of Pensacola, Florida was sentenced to 60 months in prison after previously pleading guilty to possession with intent to distribute cocaine base and cocaine, and possessing a firearm as a convicted felon. The sentence was announced by John P. Heekin, United States Attorney for the Northern District of Florida.

    U.S. Attorney Heekin said: “I applaud the substantial efforts of our state and federal law enforcement partners to investigate, arrest, and help bring this drug trafficker to justice. These offenses are not victimless crimes; the victims are the members of our community who experience the addiction and violence that too often follows from drug traffickers flooding our streets with this poison. President Donald J. Trump and Attorney General Pam Bondi promised to Take Back America with the aggressive pursuit of drug traffickers victimizing our communities, and that is exactly what my office will continue to do.”

    In January 2024, the Bureau of Alcohol, Tobacco, Firearms, and Explosives initiated a criminal investigation into an armed drug trafficking organization in Pensacola, Florida. The investigation revealed that Marcus Rayford was a key member within the organization with law enforcement observing him distributing firearms and narcotics on numerous occasions.  In December 2024, state and federal law enforcement executed a search warrant at Marcus Rayford’s residence and located five firearms, cocaine base, cocaine, fentanyl, marijuana, and heroin. 

    These sentences were the result of a joint investigation by the Bureau of Alcohol, Tobacco, Firearms, and Explosives, the Escambia County Sherriff’s Office, Pensacola Police Department, Florida Highway Patrol, Florida Department of Law Enforcement, the Drug Enforcement Administration, U.S. Customs and Border Protection, and the Federal Bureau of Investigation.  Assistant United States Attorney Jeffrey M. Tharp prosecuted the case.

    This case is part of Operation Take Back America (https://www.justice.gov/dag/media/1393746/dl?inline) a nationwide initiative that marshals the full resources of the Department of Justice to repel the invasion of illegal immigration, achieve the total elimination of cartels and transnational criminal organizations (TCOs), and protect our communities from the perpetrators of violent crime. Operation Take Back America streamlines efforts and resources from the Department’s Organized Crime Drug Enforcement Task Forces (OCDETFs) and Project Safe Neighborhood (PSN).

    The United States Attorney’s Office for the Northern District of Florida is one of 94 offices that serve as the nation’s principal litigators under the direction of the Attorney General. To access available public court documents online, please visit the U.S. District Court for the Northern District of Florida website. For more information about the United States Attorney’s Office, Northern District of Florida, visit http://www.justice.gov/usao/fln/index.html.

    MIL Security OSI –

  • MIL-OSI Security: Foreign National Indicted in Wire Fraud Scheme

    Source: US FBI

    Orlando, Florida – United States Attorney Gregory W. Kehoe announces the return of an indictment charging Ken-ichi Larroza Hatakama (36, Philippines), with wire fraud. If convicted, Hatakama faces a maximum penalty of 20 years in federal prison. The indictment also notifies Hatakama that the United States intends to forfeit $562,569.37, which are alleged to be the proceeds of the offense.

    According to the indictment, Hatakama, a citizen and national of the Philippines, worked remotely assisting Victim Company (“VC”) with their computer coding. While working on VC’s computer coding, Hatakama embedded malicious code into VC’s computer coding, causing payments intended for VC’s partners to be rerouted to dozens of fraudulent PayPal accounts he controlled. Through this scheme, Hatakama stole over $500,000 from VC.

    An indictment is merely a formal charge that a defendant has committed one or more violations of federal criminal law, and every defendant is presumed innocent unless, and until, proven guilty.

    This case was investigated by the Federal Bureau of Investigation. It will be prosecuted by Assistant United States Attorney Noah P. Dorman.

    MIL Security OSI –

  • MIL-OSI Security: Eureka Chiropractor Sentenced to 20 Months in Prison and Ordered to Repay More than $2.3 Million for Defrauding Medicare

    Source: US FBI

    PEORIA, Ill. – Carrie Musselman, 48, of Eureka, Illinois, was sentenced on June 24, 2025, to 20 months in prison and ordered to pay more than $2.3 million dollars in restitution following her convictions on multiple charges related to her scheme to defraud Medicare and twelve other insurance companies. A jury found Musselman guilty of one count of healthcare fraud and five counts of wire fraud after a 13-day trial in February 2025.

    At the sentencing hearing before Senior U.S. District Judge Michael M. Mihm, the government presented evidence that Musselman, a chiropractor in Eureka, engaged in a multi-year fraud to steal more than $2.5 million from Medicare and other insurance companies. As part of the scheme, Musselman submitted fraudulent insurance claims which indicated that services had been performed by medical doctors when they were actually performed by mid-level providers. That resulted in automatic pay increases for Musselman to which she was not entitled.

    Musselman also made claims that falsely asserted patients had received services that were never provided. These claims included purportedly providing patients with allergy injections when no such injections were given. Instead, patients were sent home with oral drops that had not been approved by the Food and Drug Administration, were considered “experimental,” and had not been proven to be effective.

    And Musselman misrepresented services that were provided, again resulting in her receipt of payments to which she was not entitled. One of Musselman’s most highly reimbursed services, the placement of an electroacupuncture device, which she falsely billed as a surgically implanted neurostimulator, would not have qualified for any payment but for her deception.

    Also at the hearing, Judge Mihm found that Musselman had committed perjury in her testimony. In doing so, the judge noted that Musselman’s statements lacked credibility. He stated that Musselman was well aware of the fraud she was committing and that she had directed and encouraged the fraud. 

    “This case should serve as a warning to anyone who would commit fraud against health insurance,” said Acting United States Attorney Gregory M. Gilmore. “We will seek out fraud, waste, and abuse and prosecute those who engage in it. Providers who take advantage of the trust placed in them to line their own pockets abandon their ethical responsibilities and raise health insurance costs for vulnerable patients.”

    “The submission of false claims undermines the integrity of our federal healthcare system,” said Linda T. Hanley, Special Agent in Charge with the United States Department of Health and Human Services Office of Inspector General. “We remain committed to holding healthcare providers accountable for complying with Medicare regulations so that enrollees can continue to rely on the program and receive the care they deserve.”

    “Bad actors in healthcare, such as Dr. Musselman, think they can cover up fraud through clouded paperwork and technical healthcare jargon all while they commit illegal acts such as false claims, fraudulent services, and in this case, services not even rendered,” said Christopher J.S. Johnson, the Special Agent in Charge of the FBI Springfield Field Office. “This sentencing and ordered restitution are a testament to the FBI’s commitment to working these types of cases. It doesn’t matter how clouded the paperwork, or how many files there are to go through, if there is a victim, then there will be an agent investigating it.”

    The case investigation was conducted by the Department of Health and Human Services, Office of Inspector General, Office of Investigations, and the Federal Bureau of Investigation, Springfield Field Office. Assistant U.S. Attorneys Douglas F. McMeyer, Bryan D. Freres, and Grace J. Hitzeman represented the government at trial.

    MIL Security OSI –

  • MIL-OSI Security: Justice Department Requires Divestitures and Licensing Commitments in HPE’s Acquisition of Juniper Networks

    Source: United States Attorneys General

    WASHINGTON — Achieving a result otherwise unavailable through litigation, earlier today the Justice Department advised the court it had reached a settlement with HPE and Juniper that allows their merger to continue. This novel approach by the Justice Department reflects a commitment to solving unique challenges in mergers. Under the leadership of Attorney General Pam Bondi the laws of this country will be zealously enforced.

    “Thank you to the hardworking men and women of the Antitrust Division for their work on this case.” — Gail Slater, Assistant Attorney General for the Antitrust Divison

    “This marks another key legal victory from the Department of Justice’s Antitrust division. Our attorneys will continue fighting and winning to defend the American people and consumers.” — Department of Justice Chief of Staff Chad Mizelle

    The settlement requires HPE to divest its Instant On business and mandates that the merged firm license critical Juniper software to independent competitors. HPE must divest its global “Instant On” campus and branch WLAN business, including all assets, intellectual property, R&D personnel, and customer relationships, to a DOJ-approved buyer within 180 days. The agreement also ensures that key software assets will be available to rivals looking to compete with the merged company. The parties must hold an auction to license Juniper’s AI Ops for Mist source code—an important component in modern WLAN systems. The license will be perpetual, non-exclusive, and include optional transitional support and personnel transfers to facilitate competition.

    MIL Security OSI –

  • MIL-OSI Security: National Health Care Fraud Takedown Results in 324 Defendants Charged in Connection with Over $14.6 Billion in Alleged Fraud

    Source: United States Attorneys General

    Largest Justice Department Health Care Fraud Takedown in History
    More than Doubles Prior Record of $6 Billion

    The Justice Department today announced the results of its 2025 National Health Care Fraud Takedown, which resulted in criminal charges against 324 defendants, including 96 doctors, nurse practitioners, pharmacists, and other licensed medical professionals, in 50 federal districts and 12 State Attorneys General’s Offices across the United States, for their alleged participation in various health care fraud schemes involving over $14.6 billion in intended loss. The Takedown involved federal and state law enforcement agencies across the country and represents an unprecedented effort to combat health care fraud schemes that exploit patients and taxpayers.

    Demonstrating the significant return on investment that results from health care fraud enforcement efforts, the government seized over $245 million in cash, luxury vehicles, cryptocurrency, and other assets as part of the coordinated enforcement efforts. As part of the whole-of-government approach to combating health care fraud announced today, the Centers for Medicare and Medicaid Services (CMS) also announced that it successfully prevented over $4 billion from being paid in response to false and fraudulent claims and that it suspended or revoked the billing privileges of 205 providers in the months leading up to the Takedown. Civil charges against 20 defendants for $14.2 million in alleged fraud, as well as civil settlements with 106 defendants totaling $34.3 million, were also announced as part of the Takedown.

    Today’s Takedown was led and coordinated by the Health Care Fraud Unit of the Department of Justice Criminal Division’s Fraud Section and its core partners from U.S. Attorneys’ Offices, the Department of Health and Human Services Office of Inspector General (HHS-OIG), the Federal Bureau of Investigation (FBI), and the Drug Enforcement Administration (DEA). The cases were investigated by agents from HHS-OIG, FBI, DEA, and other federal and state law enforcement agencies. The cases are being prosecuted by Health Care Fraud Strike Force teams from the Criminal Division’s Fraud Section, 50 U.S. Attorneys’ Offices nationwide, and 12 State Attorneys General Offices.

    “This record-setting Health Care Fraud Takedown delivers justice to criminal actors who prey upon our most vulnerable citizens and steal from hardworking American taxpayers,” said Attorney General Pamela Bondi. “Make no mistake – this administration will not tolerate criminals who line their pockets with taxpayer dollars while endangering the health and safety of our communities.”

    “As part of making healthcare accessible and affordable to all Americans, HHS will aggressively work with our law enforcement partners to eliminate the pervasive health care fraud that bedeviled this agency under the former administration and drove up costs,” said Secretary Robert F. Kennedy Jr. of the Department of Health and Human Services.

    “The Criminal Division is intensely committed to rooting out health care fraud schemes and prosecuting the criminals who perpetrate them because these schemes: (1) often result in physical patient harm through medically unnecessary treatments or failure to provide the correct treatments; (2) contribute to our nationwide opioid epidemic and exacerbate controlled substance addiction; and (3) do all of that while stealing money hardworking Americans contribute to pay for the care of their elders and other vulnerable citizens,” said Matthew R. Galeotti, Head of the Justice Department’s Criminal Division. “The Division’s Health Care Fraud Unit and U.S. Attorneys’ Offices stand united with our law enforcement partners in this fight, and we will continue to use every tool at our disposal to protect the integrity of our health care programs for the American people.”

    “The scale of today’s Takedown is unprecedented, and so is the harm we’re confronting. Individuals who attempt to steal from the federal health care system and put vulnerable patients at risk will be held accountable,” said Acting Inspector General Juliet T. Hodgkins of HHS-OIG. “Our agents at HHS-OIG work relentlessly to detect, investigate, and dismantle these fraud schemes. We are proud to stand with our law enforcement partners in protecting taxpayer dollars and safeguarding patient care.”

    “Health care fraud drains critical resources from programs intended to help people who truly need medical care,” said FBI Director Kash Patel. “Today’s announcement demonstrates our commitment to pursuing those who exploit the system for personal gain. With more than $13 billion in fraud uncovered, this is the largest takedown for this initiative to date. Together, the FBI and our law enforcement partners will continue to hold those accountable who steal from the American people and undermine our health care systems.”

    Transnational Criminal Organizations

    29 defendants were charged for their roles in transnational criminal organizations alleged to have submitted over $12 billion in fraudulent claims to America’s health insurance programs.

    For instance, a nationwide investigation known as Operation Gold Rush resulted in the largest loss amount ever charged in a health care fraud case brought by the Department. These charges were announced in the Eastern District of New York, the Northern District of Illinois, the Central District of California, the Middle District of Florida, and the District of New Jersey against 19 defendants. Twelve of these defendants have been arrested, including four defendants who were apprehended in Estonia as a result of international cooperation with Estonian law enforcement and seven defendants who were arrested at U.S. airports and the U.S. border with Mexico, cutting off their intended escape routes as they attempted to avoid capture.

    The organization allegedly used a network of foreign straw owners, including individuals sent into the United States from abroad, who, acting at the direction of others using encrypted messaging and assumed identities from overseas, strategically bought dozens of medical supply companies located across the United States. They then rapidly submitted $10.6 billion in fraudulent health care claims to Medicare for urinary catheters and other durable medical equipment by exploiting the stolen identities of over one million Americans spanning all 50 states and using their confidential medical information to submit the fraudulent claims. As alleged, the organization exploited the U.S. financial system by laundering the fraudulent proceeds and deploying a range of tactics to circumvent anti-money laundering controls to transfer funds into cryptocurrency and shell companies located abroad. The arrests announced today also include a banker who facilitated the money laundering of fraud proceeds on behalf of the organization through a U.S.-based bank.

    The Health Care Fraud Unit’s Data Analytics Team and its partners detected the anomalous billing through proactive data analytics, and HHS-OIG and CMS successfully prevented the organization from receiving all but approximately $41 million of the approximately $4.45 billion that was scheduled to be paid by Medicare. HHS and CMS intend to seek to return the $4.41 billion in escrow to the Medicare trust fund for needed medical care. The scheme nonetheless resulted in payments of approximately $900 million from Medicare supplemental insurers. To date, law enforcement has seized approximately $27.7 million in fraud proceeds as part of Operation Gold Rush.

    In another action involving foreign influence, charges were filed in the Northern District of Illinois against five defendants, including two owners and executives of Pakistani marketing organizations, in connection with a $703 million scheme in which Medicare beneficiaries’ identification numbers and other confidential health information were allegedly obtained through theft and deceptive marketing. The defendants allegedly used artificial intelligence to create fake recordings of Medicare beneficiaries purportedly consenting to receive certain products. According to court documents, the beneficiaries’ confidential information was then illegally sold to laboratories and durable medical equipment companies, which used this unlawfully obtained and fraudulently generated data to submit false claims to Medicare. Certain defendants controlled dozens of nominee-owned durable medical equipment companies and laboratories that allegedly submitted fraudulent claims for products and services the beneficiaries did not request, need, or receive. Certain defendants also allegedly conspired to conceal and launder the fraud proceeds from bank accounts they controlled in the United States to bank accounts overseas. In total, the defendants caused approximately $703 million in alleged fraudulent claims to Medicare and Medicare Advantage plans, which paid approximately $418 million on those claims. The government seized approximately $44.7 million from various bank accounts related to this case.

    Finally, a defendant based in Pakistan and the United Arab Emirates who owned a billing company allegedly orchestrated a scheme to prey upon vulnerable individuals in need of addiction treatment by conspiring with treatment center owners to fraudulently bill Arizona Medicaid approximately $650 million for substance abuse treatment services. According to court documents, some of the services billed were never provided, while other services were provided at a level that was so substandard that it failed to serve any treatment purpose. As part of the conspiracy, treatment center owners allegedly paid illegal kickbacks in exchange for the referral of patients recruited from the homeless population and Native American reservations. The defendant received at least $25 million of ill-gotten Arizona Medicaid funds as a result of the conspiracy and is charged with a money laundering offense for his alleged use of those funds to purchase a $2.9 million home located on a golf estate in Dubai.

    Fraudulent Wound Care

    Charges were filed in the District of Arizona and the District of Nevada against seven defendants, including five medical professionals, in connection with approximately $1.1 billion in fraudulent claims to Medicare and other health care benefit programs for amniotic wound allografts. As alleged, certain defendants targeted vulnerable elderly patients, many of whom were receiving hospice care, and applied medically unnecessary amniotic allografts to these patients’ wounds. Many of the allografts allegedly were applied without coordination with the patients’ treating physicians, without proper treatment for infection, to superficial wounds that did not need this treatment, and to areas that far exceeded the size of the wound. Certain defendants allegedly received millions in illegal kickbacks from the fraudulent billing scheme.

    “Today’s unprecedented enforcement action demonstrates that CMS and our federal partners are united in our mission to protect the integrity of Medicare and Medicaid by crushing waste, fraud, and abuse,” said CMS Administrator Dr. Mehmet Oz. “Every dollar we prevent from going to fraudsters is a dollar that stays in the system to serve legitimate beneficiaries. Through advanced data analytics, real-time monitoring, and swift administrative action, CMS is leading the fight to protect Medicare, Medicaid, and the trust Americans place in these vital programs. We’re not waiting for fraud to happen—we’re stopping it before it starts.”

    Prescription Opioid Trafficking

    74 defendants, including 44 licensed medical professionals, were charged across 58 cases in connection with the alleged illegal diversion of over 15 million pills of prescription opioids and other controlled substances. For example, five defendants associated with one Texas pharmacy were charged with the unlawful distribution of over 3 million opioid pills. As alleged, the defendants conspired to distribute massive quantities of oxycodone, hydrocodone, and carisoprodol, which were subsequently trafficked by street-level drug dealers, generating large profits for the defendants. This coordinated action is a continuation of the Health Care Fraud Unit’s systematic approach to stopping drug trafficking organizations and their pharmaceutical wholesale suppliers, which together have fueled an epidemic of prescription opioid abuse for nearly a decade.

    DEA also announced today that in the last six months, DEA charged 93 administrative cases seeking the revocation of pharmacies, medical practitioners, and companies authority to handle and/or prescribe controlled substances.

    “Health care fraud isn’t just theft — it’s trafficking in trust. Today’s announcement shows that when doctors become drug dealers and treatment centers become profit-driven fraud rings, DEA will act,” said Acting Administrator Robert Murphy of the DEA. “We’re targeting the entire ecosystem of fraud — from pill mills in Texas to kickback clinics exploiting Native communities. If you abuse your medical license to push poison or pad your pockets, we will hold you accountable.”

    Telemedicine and Genetic Testing Fraud

    In today’s Takedown, 49 defendants were charged in connection with the submission of over $1.17 billion in allegedly fraudulent claims to Medicare resulting from telemedicine and genetic testing fraud schemes. For example, in the Southern District of Florida, prosecutors charged an owner of telemedicine and durable medical equipment companies with a $46 million scheme in which Medicare beneficiaries were allegedly targeted through deceptive telemarketing campaigns and then fraudulent claims were submitted to Medicare for durable medical equipment and genetic tests for these beneficiaries. The Department continues to focus on eliminating health care fraud schemes that depend on telemedicine, including schemes involving fraudulent claims for genetic testing, durable medical equipment, and COVID-19 tests.

    Other Health Care Fraud Schemes

    The other cases announced today charge an additional 170 defendants with various other health care fraud schemes involving over $1.84 billion in allegedly false and fraudulent claims to Medicare, Medicaid, and private insurance companies for diagnostic testing, medical visits, and treatments that were medically unnecessary, provided in connection with kickbacks and bribes, or never provided at all. For example, in the Western District of Tennessee, prosecutors charged three defendants, including business owners and a pharmacist, with a $28.7 million scheme to defraud the Federal Employees’ Compensation Fund by allegedly billing for medications for injured United States Postal Service employees that were never prescribed by a licensed practitioner and largely were not dispensed as claimed. And in the Western District of Washington and the Northern District of California, prosecutors charged medical providers with allegedly stealing fentanyl and hydrocodone, respectively, that was meant for the providers’ patients, including child patients in need of anesthesia.

    “VA’s Integrated Veteran Care Programs provide critical community-based health care to our nation’s disabled veterans and their dependents,” said Acting Inspector General David Case of the Department of Veterans Affairs Office of Inspector General (VA-OIG). “Robust oversight of VA’s health care system is one of VA-OIG’s highest priorities. VA-OIG is committed to holding accountable those who defraud government benefits programs intended to care for our nation’s heroes.”

    Breaking Down Silos in the Fight Against Health Care Fraud

    In connection with the coordinated nationwide law enforcement operation, the Department is announcing that it is working closely with HHS-OIG, FBI, and other agencies to create a Health Care Fraud Data Fusion Center to bring together experts from the Department’s Criminal Division, Fraud Section, Health Care Fraud Unit Data Analytics Team; HHS-OIG; FBI; and other agencies to leverage cloud computing, artificial intelligence, and advanced analytics to identify emerging health care fraud schemes. The Health Care Fraud Unit’s Data Analytics Team was established in 2018 to enhance the Unit’s ability to detect, investigate, and prosecute complex health care fraud schemes. Joining forces with data analysts from HHS-OIG, FBI, and other partners will increase efficiency, detection, and rapid prosecution of emerging health care fraud schemes. It will also implement the President’s Executive Order Stopping Waste, Fraud, and Abuse by Eliminating Information Silos (Exec. Order No. 14243, 3 C.F.R. 294 (2025)) by reducing duplicative data teams, increasing operational efficiency through a whole-of-government approach, and leveraging cloud computing, artificial intelligence, and other agency resources.

    Principal Assistant Deputy Chief Jacob Foster, Assistant Deputy Chief Rebecca Yuan, Trial Attorney Miriam L. Glaser Dauermann, and Data Analyst Elizabeth Nolte, all of the Health Care Fraud Unit of the Criminal Division’s Fraud Section, led and coordinated this year’s Takedown. The cases are being prosecuted by the Health Care Fraud Unit’s National Rapid Response, Florida, Gulf Coast, Los Angeles, Midwest, New England, Northeast, and Texas Strike Forces; U.S. Attorneys’ Offices for the District of Arizona, Central District of California, Northern District of California, Southern District of California, District of Columbia, District of Connecticut, District of Delaware, Middle District of Florida, Northern District of Florida, Southern District of Florida, Middle District of Georgia, District of Idaho, Northern District of Illinois, Eastern District of Kentucky, Western District of Kentucky, Eastern District of Louisiana, Middle District of Louisiana, District of Maine, District of Massachusetts, Eastern District of Michigan, Western District of Michigan, Northern District of Mississippi, Southern District of Mississippi, District of Montana, District of Nevada, District of New Hampshire, District of New Jersey, Eastern District of New York, Northern District of New York, Southern District of New York, Western District of New York, Eastern District of North Carolina, Western District of North Carolina, District of North Dakota, Northern District of Ohio, Southern District of Ohio, Northern District of Oklahoma, Western District of Oklahoma, District of Oregon, Eastern District of Pennsylvania, District of South Carolina, Middle District of Tennessee, Western District of Tennessee, Northern District of Texas, Southern District of Texas, Western District of Texas, District of Vermont, Eastern District of Virginia, Western District of Washington, and Northern District of West Virginia; and State Attorneys General’s Offices for California, Illinois, Indiana, Louisiana, Massachusetts, Michigan, Missouri, New York, Ohio, Pennsylvania, South Carolina, and Wisconsin. The Health Care Fraud Unit’s Data Analytics Team used cutting-edge data analytics to identify and support the investigations that led to these charges.

    In addition to FBI, HHS-OIG, DEA, and CMS, HSI, VA-OIG, IRS Criminal Investigation, Defense Criminal Investigative Service, Department of Labor, United States Postal Service Office of Inspector General, Office of Personnel Management Office of Inspector General, and other federal, state, and local law enforcement agencies participated in the operation. The Medicaid Fraud Control Units of California, the District of Columbia, Florida, Georgia, Illinois, Indiana, Louisiana, Massachusetts, Michigan, Missouri, New York, North Carolina, North Dakota, Ohio, Pennsylvania, South Carolina, Texas, Virginia, and Wisconsin also participated in the investigation of many of the federal and state cases announced today.

    The Fraud Section leads the Criminal Division’s efforts to combat health care fraud through the Health Care Fraud Strike Forces. Prior to the charges announced as part of today’s nationwide Takedown and since its inception in March 2007, the Health Care Fraud Strike Force, which operates in 27 districts, charged more than 5,400 defendants who collectively billed Medicare, Medicaid, and private health insurers more than $27 billion.

    The following materials related to today’s announcement are available on the Health Care Fraud Unit’s website through these links:

    •  Graphics and Resources

    •  Case Descriptions

    •  Court Documents

    An indictment, information, or complaint is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

    MIL Security OSI –

  • MIL-OSI Security: National Health Care Fraud Takedown Results in 324 Defendants Charged in Connection with Over $14.6 Billion in Alleged Fraud

    Source: United States Attorneys General

    Largest Justice Department Health Care Fraud Takedown in History
    More than Doubles Prior Record of $6 Billion

    The Justice Department today announced the results of its 2025 National Health Care Fraud Takedown, which resulted in criminal charges against 324 defendants, including 96 doctors, nurse practitioners, pharmacists, and other licensed medical professionals, in 50 federal districts and 12 State Attorneys General’s Offices across the United States, for their alleged participation in various health care fraud schemes involving over $14.6 billion in intended loss. The Takedown involved federal and state law enforcement agencies across the country and represents an unprecedented effort to combat health care fraud schemes that exploit patients and taxpayers.

    Demonstrating the significant return on investment that results from health care fraud enforcement efforts, the government seized over $245 million in cash, luxury vehicles, cryptocurrency, and other assets as part of the coordinated enforcement efforts. As part of the whole-of-government approach to combating health care fraud announced today, the Centers for Medicare and Medicaid Services (CMS) also announced that it successfully prevented over $4 billion from being paid in response to false and fraudulent claims and that it suspended or revoked the billing privileges of 205 providers in the months leading up to the Takedown. Civil charges against 20 defendants for $14.2 million in alleged fraud, as well as civil settlements with 106 defendants totaling $34.3 million, were also announced as part of the Takedown.

    Today’s Takedown was led and coordinated by the Health Care Fraud Unit of the Department of Justice Criminal Division’s Fraud Section and its core partners from U.S. Attorneys’ Offices, the Department of Health and Human Services Office of Inspector General (HHS-OIG), the Federal Bureau of Investigation (FBI), and the Drug Enforcement Administration (DEA). The cases were investigated by agents from HHS-OIG, FBI, DEA, and other federal and state law enforcement agencies. The cases are being prosecuted by Health Care Fraud Strike Force teams from the Criminal Division’s Fraud Section, 50 U.S. Attorneys’ Offices nationwide, and 12 State Attorneys General Offices.

    “This record-setting Health Care Fraud Takedown delivers justice to criminal actors who prey upon our most vulnerable citizens and steal from hardworking American taxpayers,” said Attorney General Pamela Bondi. “Make no mistake – this administration will not tolerate criminals who line their pockets with taxpayer dollars while endangering the health and safety of our communities.”

    “As part of making healthcare accessible and affordable to all Americans, HHS will aggressively work with our law enforcement partners to eliminate the pervasive health care fraud that bedeviled this agency under the former administration and drove up costs,” said Secretary Robert F. Kennedy Jr. of the Department of Health and Human Services.

    “The Criminal Division is intensely committed to rooting out health care fraud schemes and prosecuting the criminals who perpetrate them because these schemes: (1) often result in physical patient harm through medically unnecessary treatments or failure to provide the correct treatments; (2) contribute to our nationwide opioid epidemic and exacerbate controlled substance addiction; and (3) do all of that while stealing money hardworking Americans contribute to pay for the care of their elders and other vulnerable citizens,” said Matthew R. Galeotti, Head of the Justice Department’s Criminal Division. “The Division’s Health Care Fraud Unit and U.S. Attorneys’ Offices stand united with our law enforcement partners in this fight, and we will continue to use every tool at our disposal to protect the integrity of our health care programs for the American people.”

    “The scale of today’s Takedown is unprecedented, and so is the harm we’re confronting. Individuals who attempt to steal from the federal health care system and put vulnerable patients at risk will be held accountable,” said Acting Inspector General Juliet T. Hodgkins of HHS-OIG. “Our agents at HHS-OIG work relentlessly to detect, investigate, and dismantle these fraud schemes. We are proud to stand with our law enforcement partners in protecting taxpayer dollars and safeguarding patient care.”

    “Health care fraud drains critical resources from programs intended to help people who truly need medical care,” said FBI Director Kash Patel. “Today’s announcement demonstrates our commitment to pursuing those who exploit the system for personal gain. With more than $13 billion in fraud uncovered, this is the largest takedown for this initiative to date. Together, the FBI and our law enforcement partners will continue to hold those accountable who steal from the American people and undermine our health care systems.”

    Transnational Criminal Organizations

    29 defendants were charged for their roles in transnational criminal organizations alleged to have submitted over $12 billion in fraudulent claims to America’s health insurance programs.

    For instance, a nationwide investigation known as Operation Gold Rush resulted in the largest loss amount ever charged in a health care fraud case brought by the Department. These charges were announced in the Eastern District of New York, the Northern District of Illinois, the Central District of California, the Middle District of Florida, and the District of New Jersey against 19 defendants. Twelve of these defendants have been arrested, including four defendants who were apprehended in Estonia as a result of international cooperation with Estonian law enforcement and seven defendants who were arrested at U.S. airports and the U.S. border with Mexico, cutting off their intended escape routes as they attempted to avoid capture.

    The organization allegedly used a network of foreign straw owners, including individuals sent into the United States from abroad, who, acting at the direction of others using encrypted messaging and assumed identities from overseas, strategically bought dozens of medical supply companies located across the United States. They then rapidly submitted $10.6 billion in fraudulent health care claims to Medicare for urinary catheters and other durable medical equipment by exploiting the stolen identities of over one million Americans spanning all 50 states and using their confidential medical information to submit the fraudulent claims. As alleged, the organization exploited the U.S. financial system by laundering the fraudulent proceeds and deploying a range of tactics to circumvent anti-money laundering controls to transfer funds into cryptocurrency and shell companies located abroad. The arrests announced today also include a banker who facilitated the money laundering of fraud proceeds on behalf of the organization through a U.S.-based bank.

    The Health Care Fraud Unit’s Data Analytics Team and its partners detected the anomalous billing through proactive data analytics, and HHS-OIG and CMS successfully prevented the organization from receiving all but approximately $41 million of the approximately $4.45 billion that was scheduled to be paid by Medicare. HHS and CMS intend to seek to return the $4.41 billion in escrow to the Medicare trust fund for needed medical care. The scheme nonetheless resulted in payments of approximately $900 million from Medicare supplemental insurers. To date, law enforcement has seized approximately $27.7 million in fraud proceeds as part of Operation Gold Rush.

    In another action involving foreign influence, charges were filed in the Northern District of Illinois against five defendants, including two owners and executives of Pakistani marketing organizations, in connection with a $703 million scheme in which Medicare beneficiaries’ identification numbers and other confidential health information were allegedly obtained through theft and deceptive marketing. The defendants allegedly used artificial intelligence to create fake recordings of Medicare beneficiaries purportedly consenting to receive certain products. According to court documents, the beneficiaries’ confidential information was then illegally sold to laboratories and durable medical equipment companies, which used this unlawfully obtained and fraudulently generated data to submit false claims to Medicare. Certain defendants controlled dozens of nominee-owned durable medical equipment companies and laboratories that allegedly submitted fraudulent claims for products and services the beneficiaries did not request, need, or receive. Certain defendants also allegedly conspired to conceal and launder the fraud proceeds from bank accounts they controlled in the United States to bank accounts overseas. In total, the defendants caused approximately $703 million in alleged fraudulent claims to Medicare and Medicare Advantage plans, which paid approximately $418 million on those claims. The government seized approximately $44.7 million from various bank accounts related to this case.

    Finally, a defendant based in Pakistan and the United Arab Emirates who owned a billing company allegedly orchestrated a scheme to prey upon vulnerable individuals in need of addiction treatment by conspiring with treatment center owners to fraudulently bill Arizona Medicaid approximately $650 million for substance abuse treatment services. According to court documents, some of the services billed were never provided, while other services were provided at a level that was so substandard that it failed to serve any treatment purpose. As part of the conspiracy, treatment center owners allegedly paid illegal kickbacks in exchange for the referral of patients recruited from the homeless population and Native American reservations. The defendant received at least $25 million of ill-gotten Arizona Medicaid funds as a result of the conspiracy and is charged with a money laundering offense for his alleged use of those funds to purchase a $2.9 million home located on a golf estate in Dubai.

    Fraudulent Wound Care

    Charges were filed in the District of Arizona and the District of Nevada against seven defendants, including five medical professionals, in connection with approximately $1.1 billion in fraudulent claims to Medicare and other health care benefit programs for amniotic wound allografts. As alleged, certain defendants targeted vulnerable elderly patients, many of whom were receiving hospice care, and applied medically unnecessary amniotic allografts to these patients’ wounds. Many of the allografts allegedly were applied without coordination with the patients’ treating physicians, without proper treatment for infection, to superficial wounds that did not need this treatment, and to areas that far exceeded the size of the wound. Certain defendants allegedly received millions in illegal kickbacks from the fraudulent billing scheme.

    “Today’s unprecedented enforcement action demonstrates that CMS and our federal partners are united in our mission to protect the integrity of Medicare and Medicaid by crushing waste, fraud, and abuse,” said CMS Administrator Dr. Mehmet Oz. “Every dollar we prevent from going to fraudsters is a dollar that stays in the system to serve legitimate beneficiaries. Through advanced data analytics, real-time monitoring, and swift administrative action, CMS is leading the fight to protect Medicare, Medicaid, and the trust Americans place in these vital programs. We’re not waiting for fraud to happen—we’re stopping it before it starts.”

    Prescription Opioid Trafficking

    74 defendants, including 44 licensed medical professionals, were charged across 58 cases in connection with the alleged illegal diversion of over 15 million pills of prescription opioids and other controlled substances. For example, five defendants associated with one Texas pharmacy were charged with the unlawful distribution of over 3 million opioid pills. As alleged, the defendants conspired to distribute massive quantities of oxycodone, hydrocodone, and carisoprodol, which were subsequently trafficked by street-level drug dealers, generating large profits for the defendants. This coordinated action is a continuation of the Health Care Fraud Unit’s systematic approach to stopping drug trafficking organizations and their pharmaceutical wholesale suppliers, which together have fueled an epidemic of prescription opioid abuse for nearly a decade.

    DEA also announced today that in the last six months, DEA charged 93 administrative cases seeking the revocation of pharmacies, medical practitioners, and companies authority to handle and/or prescribe controlled substances.

    “Health care fraud isn’t just theft — it’s trafficking in trust. Today’s announcement shows that when doctors become drug dealers and treatment centers become profit-driven fraud rings, DEA will act,” said Acting Administrator Robert Murphy of the DEA. “We’re targeting the entire ecosystem of fraud — from pill mills in Texas to kickback clinics exploiting Native communities. If you abuse your medical license to push poison or pad your pockets, we will hold you accountable.”

    Telemedicine and Genetic Testing Fraud

    In today’s Takedown, 49 defendants were charged in connection with the submission of over $1.17 billion in allegedly fraudulent claims to Medicare resulting from telemedicine and genetic testing fraud schemes. For example, in the Southern District of Florida, prosecutors charged an owner of telemedicine and durable medical equipment companies with a $46 million scheme in which Medicare beneficiaries were allegedly targeted through deceptive telemarketing campaigns and then fraudulent claims were submitted to Medicare for durable medical equipment and genetic tests for these beneficiaries. The Department continues to focus on eliminating health care fraud schemes that depend on telemedicine, including schemes involving fraudulent claims for genetic testing, durable medical equipment, and COVID-19 tests.

    Other Health Care Fraud Schemes

    The other cases announced today charge an additional 170 defendants with various other health care fraud schemes involving over $1.84 billion in allegedly false and fraudulent claims to Medicare, Medicaid, and private insurance companies for diagnostic testing, medical visits, and treatments that were medically unnecessary, provided in connection with kickbacks and bribes, or never provided at all. For example, in the Western District of Tennessee, prosecutors charged three defendants, including business owners and a pharmacist, with a $28.7 million scheme to defraud the Federal Employees’ Compensation Fund by allegedly billing for medications for injured United States Postal Service employees that were never prescribed by a licensed practitioner and largely were not dispensed as claimed. And in the Western District of Washington and the Northern District of California, prosecutors charged medical providers with allegedly stealing fentanyl and hydrocodone, respectively, that was meant for the providers’ patients, including child patients in need of anesthesia.

    “VA’s Integrated Veteran Care Programs provide critical community-based health care to our nation’s disabled veterans and their dependents,” said Acting Inspector General David Case of the Department of Veterans Affairs Office of Inspector General (VA-OIG). “Robust oversight of VA’s health care system is one of VA-OIG’s highest priorities. VA-OIG is committed to holding accountable those who defraud government benefits programs intended to care for our nation’s heroes.”

    Breaking Down Silos in the Fight Against Health Care Fraud

    In connection with the coordinated nationwide law enforcement operation, the Department is announcing that it is working closely with HHS-OIG, FBI, and other agencies to create a Health Care Fraud Data Fusion Center to bring together experts from the Department’s Criminal Division, Fraud Section, Health Care Fraud Unit Data Analytics Team; HHS-OIG; FBI; and other agencies to leverage cloud computing, artificial intelligence, and advanced analytics to identify emerging health care fraud schemes. The Health Care Fraud Unit’s Data Analytics Team was established in 2018 to enhance the Unit’s ability to detect, investigate, and prosecute complex health care fraud schemes. Joining forces with data analysts from HHS-OIG, FBI, and other partners will increase efficiency, detection, and rapid prosecution of emerging health care fraud schemes. It will also implement the President’s Executive Order Stopping Waste, Fraud, and Abuse by Eliminating Information Silos (Exec. Order No. 14243, 3 C.F.R. 294 (2025)) by reducing duplicative data teams, increasing operational efficiency through a whole-of-government approach, and leveraging cloud computing, artificial intelligence, and other agency resources.

    Principal Assistant Deputy Chief Jacob Foster, Assistant Deputy Chief Rebecca Yuan, Trial Attorney Miriam L. Glaser Dauermann, and Data Analyst Elizabeth Nolte, all of the Health Care Fraud Unit of the Criminal Division’s Fraud Section, led and coordinated this year’s Takedown. The cases are being prosecuted by the Health Care Fraud Unit’s National Rapid Response, Florida, Gulf Coast, Los Angeles, Midwest, New England, Northeast, and Texas Strike Forces; U.S. Attorneys’ Offices for the District of Arizona, Central District of California, Northern District of California, Southern District of California, District of Columbia, District of Connecticut, District of Delaware, Middle District of Florida, Northern District of Florida, Southern District of Florida, Middle District of Georgia, District of Idaho, Northern District of Illinois, Eastern District of Kentucky, Western District of Kentucky, Eastern District of Louisiana, Middle District of Louisiana, District of Maine, District of Massachusetts, Eastern District of Michigan, Western District of Michigan, Northern District of Mississippi, Southern District of Mississippi, District of Montana, District of Nevada, District of New Hampshire, District of New Jersey, Eastern District of New York, Northern District of New York, Southern District of New York, Western District of New York, Eastern District of North Carolina, Western District of North Carolina, District of North Dakota, Northern District of Ohio, Southern District of Ohio, Northern District of Oklahoma, Western District of Oklahoma, District of Oregon, Eastern District of Pennsylvania, District of South Carolina, Middle District of Tennessee, Western District of Tennessee, Northern District of Texas, Southern District of Texas, Western District of Texas, District of Vermont, Eastern District of Virginia, Western District of Washington, and Northern District of West Virginia; and State Attorneys General’s Offices for California, Illinois, Indiana, Louisiana, Massachusetts, Michigan, Missouri, New York, Ohio, Pennsylvania, South Carolina, and Wisconsin. The Health Care Fraud Unit’s Data Analytics Team used cutting-edge data analytics to identify and support the investigations that led to these charges.

    In addition to FBI, HHS-OIG, DEA, and CMS, HSI, VA-OIG, IRS Criminal Investigation, Defense Criminal Investigative Service, Department of Labor, United States Postal Service Office of Inspector General, Office of Personnel Management Office of Inspector General, and other federal, state, and local law enforcement agencies participated in the operation. The Medicaid Fraud Control Units of California, the District of Columbia, Florida, Georgia, Illinois, Indiana, Louisiana, Massachusetts, Michigan, Missouri, New York, North Carolina, North Dakota, Ohio, Pennsylvania, South Carolina, Texas, Virginia, and Wisconsin also participated in the investigation of many of the federal and state cases announced today.

    The Fraud Section leads the Criminal Division’s efforts to combat health care fraud through the Health Care Fraud Strike Forces. Prior to the charges announced as part of today’s nationwide Takedown and since its inception in March 2007, the Health Care Fraud Strike Force, which operates in 27 districts, charged more than 5,400 defendants who collectively billed Medicare, Medicaid, and private health insurers more than $27 billion.

    The following materials related to today’s announcement are available on the Health Care Fraud Unit’s website through these links:

    •  Graphics and Resources

    •  Case Descriptions

    •  Court Documents

    An indictment, information, or complaint is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

    MIL Security OSI –

  • MIL-OSI Security: Head of the Criminal Division Matthew R. Galeotti Announces Results of Health Care Fraud Takedown

    Source: United States Attorneys General

    Good morning.

    Thank you all for joining us today as we announce the largest coordinated health care fraud takedown in the history of the Department of Justice.

    Today marks a decisive moment in our fight to protect American taxpayers from fraudsters and to defend the integrity of our nation’s health care system.

    We are announcing charges against 324 defendants for their alleged participation in health care fraud schemes involving approximately $14.6 billion in false claims submitted to Medicare, Medicaid, and other health care programs.

    In a takedown this large, I can’t possibly describe all of the work that went into dismantling each scheme, but there are four key points that bear emphasizing.

    First, let me be clear about what these health care fraud schemes mean for every hardworking American family: These criminals didn’t just steal someone else’s money — they stole from you.  Every fraudulent claim, every fake billing, every kickback scheme represents money taken directly from the pockets of American taxpayers, who fund these essential programs through their hard work and sacrifice. And when criminals defraud these programs, they’re not just committing theft — they’re driving up our national deficit and threatening the long-term viability of health care for seniors, disabled Americans, and our most vulnerable citizens.

    This enforcement action involves the seizure of cash, as well as luxury vehicles and properties, returning real money to American taxpayers and to our government health care programs.

    Second, we are seeing a disturbing trend of transnational criminal organizations engaging in increasingly sophisticated and complex criminal schemes that defraud the American health care system.

    As part of this takedown, we’ve identified and charged defendants operating from Russia, Eastern Europe, Pakistan, and other foreign countries who have infiltrated our health care system to steal American taxpayer dollars.

    As one example, we dismantled a scheme involving a sophisticated operation run from Russia and Eastern Europe that strategically bought dozens of medical supply companies in the United States and submitted more than 10 billion dollars in fraudulent health care claims to Medicare. To make matters worse, these perpetrators used the stolen identities of more than one million Americans, spanning all 50 states, to submit these false claims.

    But I’m pleased to report that federal agents intercepted and arrested key members of that organization at U.S. airports and at the U.S.-Mexico border, cutting off their intended escape routes.

    The days of transnational criminal organizations using American health care programs as their personal piggy banks are over.

    Third, this takedown resulted in criminal charges against 74 defendants, including medical professionals, who fueled America’s deadly opioid epidemic for personal profit. These are not isolated instances of poor judgment. These are calculated schemes designed to exploit Americans struggling with addiction while enriching the very people who were duty-bound to help them heal.

    We charged pill mill operators who prescribed unnecessary opioids.  We dismantled networks of corrupt pharmacies that existed solely to distribute drugs to addicts and dealers, feeding the addiction crisis that has devastated so many American communities.

    This is not health care; it is a staggering breach of trust.  And under my leadership, the Criminal Division will prosecute these criminals as aggressively as we would prosecute any drug dealer — because that’s exactly what they are.

    Fourth, many of the defendants charged as part of this takedown specifically targeted some of our most vulnerable citizens: elderly Americans in nursing homes, individuals with disabilities, those battling serious illnesses, and more.  For example, our prosecutors charged seven defendants, including five medical professionals, in connection with approximately $1 billion in fraudulent claims to Medicare and other health care benefit programs for performing medically unnecessary skin grafts on dying patients as they were seeking to spend their final days with dignity and grace.

    That conduct is exactly as callous and disturbing as it sounds. Patients and their families trusted these providers with their lives.  Instead of receiving care, they became victims of elaborate criminal schemes.

    Today’s takedown marks a historic day. In addition to the tireless work of our Fraud Section’s Health Care Fraud Unit, this extraordinary effort would not have been possible without the law enforcement agencies with me here today: Health and Human Services (HHS), Centers for Medicare & Medicaid Services (CMS), Federal Bureau of Investigation (FBI), Drug Enforcement Administration (DEA).

    And of course, countless other partners across the federal, state, and local law enforcement community and dozens of United States Attorneys’ Offices. Thank you to all who made today possible.

    Despite these historic achievements, we aren’t resting on our laurels. We’re making advancements to stay ahead of criminals and their illicit schemes.

    That is why, today, I am also announcing that we are working with our partners at FBI, HHS-OIG, and other federal agencies to create a Health Care Fraud Data Fusion Center to revolutionize how we detect, investigate, and prosecute health care fraud.  These efforts will be led by the Criminal Division, specifically, the Fraud Section’s Health Care Fraud Unit and comprised of data specialists from the Unit’s Data Analytics Team. The Fusion Center will break down information silos, using coordinated data analysis to enable our investigative teams to quickly identify and dismantle emerging fraud schemes.

    This takedown represents the largest health care fraud takedown in American history.

    But it’s not the end—it’s the beginning of a new era of aggressive prosecution and data-driven prevention.

    Thank you.

    I will now turn it over to Acting Inspector General Juliet T. Hodgkins, Department of Health and Human Services Office of Inspector General.

    MIL Security OSI –

  • MIL-OSI Security: Head of the Criminal Division Matthew R. Galeotti Announces Results of Health Care Fraud Takedown

    Source: United States Attorneys General

    Good morning.

    Thank you all for joining us today as we announce the largest coordinated health care fraud takedown in the history of the Department of Justice.

    Today marks a decisive moment in our fight to protect American taxpayers from fraudsters and to defend the integrity of our nation’s health care system.

    We are announcing charges against 324 defendants for their alleged participation in health care fraud schemes involving approximately $14.6 billion in false claims submitted to Medicare, Medicaid, and other health care programs.

    In a takedown this large, I can’t possibly describe all of the work that went into dismantling each scheme, but there are four key points that bear emphasizing.

    First, let me be clear about what these health care fraud schemes mean for every hardworking American family: These criminals didn’t just steal someone else’s money — they stole from you.  Every fraudulent claim, every fake billing, every kickback scheme represents money taken directly from the pockets of American taxpayers, who fund these essential programs through their hard work and sacrifice. And when criminals defraud these programs, they’re not just committing theft — they’re driving up our national deficit and threatening the long-term viability of health care for seniors, disabled Americans, and our most vulnerable citizens.

    This enforcement action involves the seizure of cash, as well as luxury vehicles and properties, returning real money to American taxpayers and to our government health care programs.

    Second, we are seeing a disturbing trend of transnational criminal organizations engaging in increasingly sophisticated and complex criminal schemes that defraud the American health care system.

    As part of this takedown, we’ve identified and charged defendants operating from Russia, Eastern Europe, Pakistan, and other foreign countries who have infiltrated our health care system to steal American taxpayer dollars.

    As one example, we dismantled a scheme involving a sophisticated operation run from Russia and Eastern Europe that strategically bought dozens of medical supply companies in the United States and submitted more than 10 billion dollars in fraudulent health care claims to Medicare. To make matters worse, these perpetrators used the stolen identities of more than one million Americans, spanning all 50 states, to submit these false claims.

    But I’m pleased to report that federal agents intercepted and arrested key members of that organization at U.S. airports and at the U.S.-Mexico border, cutting off their intended escape routes.

    The days of transnational criminal organizations using American health care programs as their personal piggy banks are over.

    Third, this takedown resulted in criminal charges against 74 defendants, including medical professionals, who fueled America’s deadly opioid epidemic for personal profit. These are not isolated instances of poor judgment. These are calculated schemes designed to exploit Americans struggling with addiction while enriching the very people who were duty-bound to help them heal.

    We charged pill mill operators who prescribed unnecessary opioids.  We dismantled networks of corrupt pharmacies that existed solely to distribute drugs to addicts and dealers, feeding the addiction crisis that has devastated so many American communities.

    This is not health care; it is a staggering breach of trust.  And under my leadership, the Criminal Division will prosecute these criminals as aggressively as we would prosecute any drug dealer — because that’s exactly what they are.

    Fourth, many of the defendants charged as part of this takedown specifically targeted some of our most vulnerable citizens: elderly Americans in nursing homes, individuals with disabilities, those battling serious illnesses, and more.  For example, our prosecutors charged seven defendants, including five medical professionals, in connection with approximately $1 billion in fraudulent claims to Medicare and other health care benefit programs for performing medically unnecessary skin grafts on dying patients as they were seeking to spend their final days with dignity and grace.

    That conduct is exactly as callous and disturbing as it sounds. Patients and their families trusted these providers with their lives.  Instead of receiving care, they became victims of elaborate criminal schemes.

    Today’s takedown marks a historic day. In addition to the tireless work of our Fraud Section’s Health Care Fraud Unit, this extraordinary effort would not have been possible without the law enforcement agencies with me here today: Health and Human Services (HHS), Centers for Medicare & Medicaid Services (CMS), Federal Bureau of Investigation (FBI), Drug Enforcement Administration (DEA).

    And of course, countless other partners across the federal, state, and local law enforcement community and dozens of United States Attorneys’ Offices. Thank you to all who made today possible.

    Despite these historic achievements, we aren’t resting on our laurels. We’re making advancements to stay ahead of criminals and their illicit schemes.

    That is why, today, I am also announcing that we are working with our partners at FBI, HHS-OIG, and other federal agencies to create a Health Care Fraud Data Fusion Center to revolutionize how we detect, investigate, and prosecute health care fraud.  These efforts will be led by the Criminal Division, specifically, the Fraud Section’s Health Care Fraud Unit and comprised of data specialists from the Unit’s Data Analytics Team. The Fusion Center will break down information silos, using coordinated data analysis to enable our investigative teams to quickly identify and dismantle emerging fraud schemes.

    This takedown represents the largest health care fraud takedown in American history.

    But it’s not the end—it’s the beginning of a new era of aggressive prosecution and data-driven prevention.

    Thank you.

    I will now turn it over to Acting Inspector General Juliet T. Hodgkins, Department of Health and Human Services Office of Inspector General.

    MIL Security OSI –

  • MIL-OSI Security: The Justice Department Files Lawsuit Against Sanctuary City Policies In Los Angeles, California

    Source: United States Attorneys General

    Today, the Department of Justice filed a lawsuit against the City of Los Angeles, California, Los Angeles Mayor Karen Bass, and the Los Angeles City Council over policies that Los Angeles enacted shortly after President Donald J. Trump’s reelection to interfere with the federal government’s enforcement of its immigration laws.

    Not only are Los Angeles’s “sanctuary city” policies illegal under federal law, but, as alleged in the complaint, Los Angeles’s refusal to cooperate with federal immigration authorities contributed to the recent lawlessness, rioting, looting, and vandalism that was so severe that it required the federal government to deploy the California National Guard and the United States Marines to quell the chaos.

    “Sanctuary policies were the driving cause of the violence, chaos, and attacks on law enforcement that Americans recently witnessed in Los Angeles,” said Attorney General Pamela Bondi. “Jurisdictions like Los Angeles that flout federal law by prioritizing illegal aliens over American citizens are undermining law enforcement at every level – it ends under President Trump.”

    “Today’s lawsuit holds the City of Los Angeles accountable for deliberately obstructing the enforcement of federal immigration law,” said U.S. Attorney Bill Essayli for the Central District of California. “The United States Constitution’s Supremacy Clause prohibits the City from picking and choosing which federal laws will be enforced and which will not. By assisting removable aliens in evading federal law enforcement, the City’s unlawful and discriminatory ordinance has contributed to a lawless and unsafe environment that this lawsuit will help end.”

    On her first day in office, Attorney General Bondi instructed the Department’s Civil Division to identify state and local laws, policies, and practices that facilitate violations of federal immigration laws or impede lawful federal immigration operations, and, where appropriate, to take legal action to challenge such laws, policies, and practices. Today’s lawsuit is the latest in a series of lawsuits brought by the Civil Division targeting illegal sanctuary city policies across the country, including in New York and New Jersey.

    MIL Security OSI –

  • MIL-OSI Security: Justice Department Announces Coordinated, Nationwide Actions to Combat North Korean Remote Information Technology Workers’ Illicit Revenue Generation Schemes

    Source: United States Attorneys General

    Law Enforcement Actions Across 16 States Result in Charges, Arrest, and Seizures of 29 Financial Accounts, 21 Fraudulent Websites, and Approximately 200 Computers

    The Justice Department announced today coordinated actions against the Democratic People’s Republic of North Korea (DPRK) government’s schemes to fund its regime through remote information technology (IT) work for U.S. companies. These actions include two indictments, an arrest, searches of 29 known or suspected “laptop farms” across 16 states, and the seizure of 29 financial accounts used to launder illicit funds and 21 fraudulent websites.

    According to court documents, the schemes involve North Korean individuals fraudulently obtaining employment with U.S. companies as remote IT workers, using stolen and fake identities. The North Korean actors were assisted by individuals in the United States, China, United Arab Emirates, and Taiwan, and successfully obtained employment with more than 100 U.S. companies.

    As alleged in court documents, certain U.S.-based individuals enabled one of the schemes by creating front companies and fraudulent websites to promote the bona fides of the remote IT workers, and hosted laptop farms where the remote North Korean IT workers could remote access into U.S. victim company-provided laptop computers. Once employed, the North Korean IT workers received regular salary payments, and they gained access to, and in some cases stole, sensitive employer information such as export controlled U.S. military technology and virtual currency. In another scheme, North Korean IT workers used false or fraudulently obtained identities to gain employment with an Atlanta, Georgia-based blockchain research and development company and stole virtual currency worth approximately over $900,000.

    “These schemes target and steal from U.S. companies and are designed to evade sanctions and fund the North Korean regime’s illicit programs, including its weapons programs,” said Assistant Attorney General John A. Eisenberg of the Department’s National Security Division. “The Justice Department, along with our law enforcement, private sector, and international partners, will persistently pursue and dismantle these cyber-enabled revenue generation networks.”

    “North Korean IT workers defraud American companies and steal the identities of private citizens, all in support of the North Korean regime,” said Assistant Director Brett Leatherman of FBI’s Cyber Division. “That is why the FBI and our partners continue to work together to disrupt infrastructure, seize revenue, indict overseas IT workers, and arrest their enablers in the United States. Let the actions announced today serve as a warning: if you host laptop farms for the benefit of North Korean actors, law enforcement will be waiting for you.”

    “North Korea remains intent on funding its weapons programs by defrauding U.S. companies and exploiting American victims of identity theft, but the FBI is equally intent on disrupting this massive campaign and bringing its perpetrators to justice,” said Assistant Director Roman Rozhavsky of the FBI Counterintelligence Division. “North Korean IT workers posing as U.S. citizens fraudulently obtained employment with American businesses so they could funnel hundreds of millions of dollars to North Korea’s authoritarian regime. The FBI will do everything in our power to defend the homeland and protect Americans from being victimized by the North Korean government, and we ask all U.S. companies that employ remote workers to remain vigilant to this sophisticated threat.”

    Zhenxing Wang, et al. Indictment, Seizure Warrants, and Arrest – District of Massachusetts

    Today, the United States Attorney’s Office for the District of Massachusetts and the National Security Division announced the arrest of U.S. national Zhenxing “Danny” Wang of New Jersey pursuant to a five-count indictment. The indictment describes a multi-year fraud scheme by Wang and his co-conspirators to obtain remote IT work with U.S. companies that generated more than $5 million in revenue. The indictment also charges Chinese nationals Jing Bin Huang (靖斌 黄), Baoyu Zhou (周宝玉), Tong Yuze (佟雨泽), Yongzhe Xu (徐勇哲 andيونجزهي أكسو), Ziyou Yuan (زيو) and Zhenbang Zhou (周震邦), and Taiwanese nationals Mengting Liu (劉 孟婷) and Enchia Liu (刘恩) for their roles in the scheme. 

    “The threat posed by DPRK operatives is both real and immediate. Thousands of North Korean cyber operatives have been trained and deployed by the regime to blend into the global digital workforce and systematically target U.S. companies,” said U.S. Attorney Leah B. Foley for the District of Massachusetts. “We will continue to work relentlessly to protect U.S. businesses and ensure they are not inadvertently fueling the DPRK’s unlawful and dangerous ambitions.”

    According to the indictment, from approximately 2021 until October 2024, the defendants and other co-conspirators compromised the identities of more than 80 U.S. persons to obtain remote jobs at more than 100 U.S. companies, including many Fortune 500 companies, and caused U.S. victim companies to incur legal fees, computer network remediation costs, and other damages and losses of at least $3 million. Overseas IT workers were assisted by Kejia Wang, Zhenxing Wang, and at least four other identified U.S. facilitators. Kejia Wang, for example, communicated with overseas co-conspirators and IT workers, and traveled to Shenyang and Dandong, China, including in 2023, to meet with them about the scheme. To deceive U.S. companies into believing the IT workers were located in the United States, Kejia Wang, Zhenxing Wang, and the other U.S. facilitators received and/or hosted laptops belonging to U.S. companies at their residences, and enabled overseas IT workers to access the laptops remotely by, among other things, connecting the laptops to hardware devices designed to allow for remote access (referred to as keyboard-video-mouse or “KVM” switches).

    Kejia Wang and Zhenxing Wang also created shell companies with corresponding websites and financial accounts, including Hopana Tech LLC, Tony WKJ LLC, and Independent Lab LLC, to make it appear as though the overseas IT workers were affiliated with legitimate U.S. businesses. Kejia Wang and Zhenxing Wang established these and other financial accounts to receive money from victimized U.S. companies, much of which was subsequently transferred to overseas co‑conspirators. In exchange for their services, Kejia Wang, Zhenxing Wang, and the four other U.S. facilitators received a total of at least $696,000 from the IT workers.

    IT workers employed under this scheme also gained access to sensitive employer data and source code, including International Traffic in Arms Regulations (ITAR) data from a California-based defense contractor that develops artificial intelligence-powered equipment and technologies. Specifically, between on or about Jan. 19, 2024, and on or about April 2, 2024, an overseas co-conspirator remotely accessed without authorization the company’s laptop and computer files  containing technical data and other information. The stolen data included information marked as being controlled under the ITAR.

    Simultaneously with today’s announcement, the FBI and Defense Criminal Investigative Service (DCIS) seized 17 web domains used in furtherance of the charged scheme and further seized 29 financial accounts, holding tens of thousands of dollars in funds, used to launder revenue for the North Korean regime through the remote IT work scheme.

    Previously, in October 2024, as part of this investigation, federal law enforcement executed searches at eight locations across three states that resulted in the recovery of more than 70 laptops and remote access devices, such as KVMs. Simultaneously with that action, the FBI seized four web domains associated with Kejia Wang’s and Zhenxing Wang’s shell companies used to facilitate North Korean IT work.

    The FBI Las Vegas Field Office, DCIS San Diego Resident Agency, and Homeland Security Investigations San Diego Field Office are investigating the case.

    Assistant U.S. Attorney Jason Casey for the District of Massachusetts and Trial Attorney Gregory J. Nicosia, Jr. of the National Security Division’s National Security Cyber Section are prosecuting the case, with significant assistance from Legal Assistants Daniel Boucher and Margaret Coppes. Valuable assistance was also provided by Mark A. Murphy of the National Security Division’s Counterintelligence and Export Control Section and the U.S. Attorneys’ Offices for the District of New Jersey, Eastern District of New York, and Southern District of California.

    Kim Kwang Jin et al. Indictment – Northern District of Georgia

    Today, the Northern District of Georgia unsealed a five-count wire fraud and money laundering indictment charging four North Korean nationals, Kim Kwang Jin (김관진), Kang Tae Bok (강태복), Jong Pong Ju (정봉주) and Chang Nam Il (창남일), with a scheme to steal virtual currency from two companies, valued at over $900,000 at the time of the thefts, and to launder proceeds of those thefts. The defendants remain at large and wanted by the FBI.

    “The defendants used fake and stolen personal identities to conceal their North Korean nationality, pose as remote IT workers, and exploit their victims’ trust to steal hundreds of thousands of dollars,” said U.S. Attorney Theodore S. Hertzberg for the Northern District of Georgia. “This indictment highlights the unique threat North Korea poses to companies that hire remote IT workers and underscores our resolve to prosecute any actor, in the United States or abroad, who steals from Georgia businesses.”

    According to the indictment, the defendants traveled to the United Arab Emirates on North Korean travel documents and worked as a co-located team. In approximately December 2020 and May 2021, respectively, Kim Kwang Jin (using victim P.S.’s stolen identity) and Jong Pong Ju (using the alias “Bryan Cho”) were hired by a blockchain research and development company headquartered in Atlanta, Georgia, and a virtual token company based in Serbia. Both defendants concealed their North Korean identities from their employers by providing false identification documents containing a mix of stolen and fraudulent identity information. Neither company would have hired Kim Kwang Jin and Jong Pong Ju had they known that they were North Korean citizens. Later, on a recommendation from Jong Pong Ju, the Serbian company hired “Peter Xiao,” who in fact was Chang Nam Il.

    After gaining their employers’ trust, Kim Kwang Jin and Jong Pong Ju were assigned projects that provided them access to their employers’ virtual currency assets. In February 2022, Jong Pong Ju used that access to steal virtual currency worth approximately $175,000 at the time of the theft, sending it to a virtual currency address he controlled. In March 2022, Kim Kwang Jin stole virtual currency worth approximately $740,000 at the time of theft by modifying the source code of two of his employer’s smart contracts, then sending it to a virtual currency address he controlled.

    To launder the funds after the thefts, Kim Kwang Jin and Jong Pong Ju “mixed” the stolen funds using the virtual currency mixer Tornado Cash and then transferred the funds to virtual currency exchange accounts controlled by defendants Kang Tae Bok and Chang Nam Il but held in the name of aliases. These accounts were opened using fraudulent Malaysian identification documents.

    The FBI Atlanta Field Office is investigating the case.

    Assistant U.S. Attorneys Samir Kaushal and Alex Sistla for the Northern District of Georgia and Trial Attorney Jacques Singer-Emery of the National Security Division’s National Security Cyber Section are prosecuting the case.

    21 Searches of Known or Suspected U.S.-based Laptop Farms – Multi-District

    Between June 10 and June 17, 2025, the FBI executed searches of 21 premises across 14 states hosting known and suspected laptop farms. These actions, coordinated by the FBI Denver Field Office, related to investigations of North Korean remote IT worker schemes being conducted by the U.S. Attorneys’ Offices of the District of Colorado, Eastern District of Missouri, and Northern District of Texas. In total, the FBI seized approximately 137 laptops.

    Valuable assistance was provided by the U.S. Attorney’s Offices for the District of Connecticut, the Eastern District of Michigan, the Eastern District of Wisconsin, the Middle District of Florida, the Northern District of Georgia, the Northern District of Illinois, the Northern District of Indiana, the District of Oregon, the Southern District of Florida, the Southern District of Ohio, the Western District of New York, and the Western District of Pennsylvania.

    ***

    The Department’s actions to combat these schemes are the latest in a series of law enforcement actions under a joint National Security Division and FBI Cyber and Counterintelligence Divisions effort, the DPRK RevGen: Domestic Enabler Initiative. This effort prioritizes targeting and disrupting the DPRK’s illicit revenue generation schemes and its U.S.-based enablers. The Department previously announced other actions pursuant to the initiative, including in January 2025 and prior, as well as the filing of a civil forfeiture complaint in early June 2025 for over $7.74 million tied to an illegal employment scheme.

    As the FBI has described in Public Service Announcements published in May 2024 and January 2025, North Korean remote IT workers posing as legitimate remote IT workers have committed data extortion and exfiltrated the proprietary and sensitive data from U.S. companies. DPRK IT worker schemes typically involve the use of stolen identities, alias emails, social media, online cross-border payment platforms, and online job site accounts, as well as false websites, proxy computers, and witting and unwitting third parties located in the U.S. and elsewhere.

    Other public advisories about the threats, red flag indicators, and potential mitigation measures for these schemes include a May 2022 advisory released by the FBI, Department of the Treasury, and Department of State; a July 2023 advisory from the Office of the Director of National Intelligence; and guidance issued in October 2023 by the United States and the Republic of Korea (South Korea). As described the May 2022 advisory, North Korean IT workers have been known individually to earn up to $300,000 annually, generating hundreds of millions of dollars collectively each year, on behalf of designated entities, such as the North Korean Ministry of Defense and others directly involved in the DPRK’s weapons programs.

    The U.S. Department of State has offered potential rewards for up to $5 million in support of international efforts to disrupt the DPRK’s illicit financial activities, including for cybercrimes, money laundering, and sanctions evasion.

    The details in the above-described court documents are merely allegations. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

    MIL Security OSI –

  • MIL-OSI Security: Department of Justice Announces the Opening of Nominations to Honor the Honorable: The Attorney General’s Award for Distinguished Service in Policing

    Source: United States Attorneys General

    WASHINGTON – United States Attorney General Pamela Bondi announced today that the Department of Justice is now accepting nominations to Honor the Honorable: The Attorney General’s Award for Distinguished Service in Policing. This award represents the Department of Justice’s reaffirmed commitment to uplifting the valor and exceptional contributions to policing of our great nation’s law enforcement personnel. It is the mission of the Department of Justice to recognize individuals in law enforcement who exhibit remarkable courage, innovation, and outstanding performance in making America safe again.

    The Attorney General’s Honor the Honorable Award recognizes individual or teams of rank-and-file officers from state, local, Tribal or territorial law enforcement agencies for exceptional efforts in policing. The awarded officers, deputies and troopers will have demonstrated exceptional service in one of three areas: criminal investigations, field operations or exemplary community involvement. Within each category, an award will be given to law enforcement agencies serving small, medium and large jurisdictions. Those agency sizes are defined as:

    • Small: agencies serving populations of fewer than 50,000;
    • Medium: agencies serving populations of 50,000 to 250,000;
    • Large: agencies serving populations of more than 250,000.

    By acknowledging and rewarding these efforts, the Department strives to advance and reaffirm its dedication to policing and to promote proactive law enforcement methods that support public safety within our nation’s communities. Through this Award, the Attorney General recognizes that the nation’s law enforcement agencies, officers, deputies and troopers continue to work tirelessly to make American communities safe places to live and work again.

    The deadline for nominations is July 14, 2025, at 8:00 p.m. EDT. More information and the application for nominees can be found at: https://www.justice.gov/ag/policing-award

    MIL Security OSI –

  • MIL-OSI Security: Canadian Man Arrested and Detained for Role in Deadly Alien Smuggling Conspiracy at the U.S.’s Northern Border

    Source: United States Attorneys General

    Note: View the indictment here and detention letter here.

    WASHINGTON — A dual Canadian American citizen was arrested on Sunday, June 15, for his role in a deadly human smuggling conspiracy that left a family of four, including two children under the age of three, dead in the St. Lawrence River. Oakes was arrested as he attempted to enter the United States via the Massena, New York, Port of Entry.

    Timothy Oakes, 34, from the Akwesasne Mohawk Indian Reservation (AMIR), Canada, was previously arraigned on numerous human smuggling offenses in the Northern District of New York District Court and had his detention hearing earlier today and will remain detained. Oakes was indicted on April 9 for conspiring with others to engage in alien smuggling, four counts of alien smuggling for profit, and four counts of alien smuggling resulting in death. United States based co-conspirators Dakota Montour, 31, and Kawisiiostha Celecia Sharrow, 43, both of Akwesasne-Mohawk, New York, and Janet Terrance, 45, of Hogansburg, New York, entered guilty pleas on Jan. 23, Oct. 8, 2024, and March 6, respectively.

    “As alleged, Oakes and his co-conspirators profited from a human smuggling operation with a singular, cold-hearted aim: making money by bringing illegal aliens into the United States, regardless of the danger to human life involved,” said Matthew R. Galeotti, Head of the Justice Department’s Criminal Division. “Their greed resulted in the deaths of a mother, a father, and two small children, as well as one of the defendants’ own brothers. The Criminal Division will continue to disrupt and dismantle these organizations and bring justice to smugglers whose actions result in senseless deaths.”

    “This case shows the terrible perils of illegally crossing the border,” said U.S. Attorney John A. Sarcone III for the Northern District of New York. “Four family members died because a smuggling network put them in harm’s way. My office is proud to partner with Joint Task Force Alpha to continue to combat dangerous human smuggling and trafficking organizations that operate on our northern border.”

    “Oakes’ arrest comes as part of our nearly two-year long investigation into a transnational criminal organization responsible for the large-scale smuggling of aliens from Canada into the United States,” said U.S. Immigration and Customs Enforcement Homeland Security Investigations (ICE HSI) Buffalo Special Agent in Charge Erin Keegan. “ICE HSI leverages its full range of authorities to combat and dismantle the heinous networks of greedy criminals who illicitly sell dangerous, sometimes fatal, passage through our nation’s northern border. We are extremely grateful for a multitude of law enforcement agency partners on the Border Enforcement Security Taskforce who join us in this fight to bring smugglers to justice.”

    “Two toddler aged children and their parents were the tragic victims of an alien smuggling attempt gone horribly wrong,” said Chief Patrol Agent Robert Garcia of the U.S. Border Patrol’s Swanton Sector. “Their deaths were a direct result of callous smugglers who exploited the vulnerable. Due to unrelenting perseverance and investigative efforts by multiple law enforcement agencies, those responsible will be held accountable. Our pursuit of justice persists until justice is served.”

    According to court documents, Oakes was a key facilitator in a human smuggling organization (HSO) that smuggled aliens from Canada into northern New York. Oakes, working with the HSO, routinely smuggled aliens into the United States by piloting boats across the St. Lawrence River. Additionally, Oakes used his home as a staging area for aliens before the HSO smuggled them into the United States. Oakes earned approximately $1,000 for every alien whom he smuggled across the St. Lawrence River into the United States.

    In March 2023, Oakes housed a Romanian family of four, together with other aliens, for about 24 hours. He then transported the family and a boat to a public boat launch. His brother, Casey Oakes, attempted to use the boat to smuggle the Romanian family into the United States, but the boat capsized, killing all four members of the family, as well as Casey Oakes.    

    Terrance, Montour, and Sharrow admitted in their plea agreements that in late March 2023, they were employed to illegally transport a Romanian family of four — a mother, father, one-year-old boy, and two-year-old girl — from Canada into New York. Specifically, Montour admitted that he was aware of the dangerous weather conditions on the day of the tragedy — high winds, freezing temperatures, and limited visibility — yet another co-conspirator still loaded the family of four into the small boat to attempt to cross the St. Lawrence River.

    HSI Massena engaged in an extensive years-long investigation of the case, with assistance from the U.S. Border Patrol, U.S. Customs and Border Protection (CBP), HSI’s Human Smuggling Unit in Washington, D.C., CBP’s National Targeting Center International Interdiction Task Force, New York State Police, Canada Border Services Agency, Akwesasne Mohawk Police Service, St. Regis Mohawk Tribal Police Department, Ontario Provincial Police, Sûreté du Québec, St. Lawrence County Sheriff’s Department, Royal Canadian Mounted Police, and the Cornwall Police Service. The Justice Department’s Office of International Affairs provided significant support with foreign legal assistance requests.

    The defendant’s vehicle with light blue boat in tow on March 29, 2023, at 9:29 p.m., consistent with the boat found in the river during recovery efforts.

    The investigation is a result of the coordinated efforts of Joint Task Force Alpha (JTFA). JTFA, a partnership with the Department of Homeland Security (DHS), has been elevated and expanded by the Attorney General with a mandate to target cartels and other transnational criminal organizations and eliminate human smuggling and trafficking networks operating within the Americas that impact public safety and the security of our borders. JTFA currently comprises detailees from U.S. Attorneys’ Offices along the border, including the Northern District of New York. Dedicated support is provided by numerous components of the Justice Department’s Criminal Division, led by the Human Rights and Special Prosecutions Section (HRSP) and supported by the Money Laundering and Asset Recovery Section, the Office of Enforcement Operations and the Office of International Affairs, among others. JTFA also relies on substantial law enforcement investment from DHS, FBI, and the Drug Enforcement Administration, and other partners. To date, JTFA’s work has resulted in more than 380 domestic and international arrests of leaders, organizers, and significant facilitators of alien smuggling; more than 340 U.S. convictions; more than 290 significant jail sentences imposed; and forfeitures of substantial assets.

    The investigation is being conducted under the Extraterritorial Criminal Travel Strike Force (ECT) program, a joint partnership between the Justice Department’s Criminal Division and HSI. The ECT program focuses on human smuggling networks that may present particular national security or public safety risks, or present grave humanitarian concerns. ECT has dedicated investigative, intelligence and prosecutorial resources. ECT coordinates and receives assistance from other U.S. government agencies and foreign law enforcement authorities.

    Trial Attorney Jenna E. Reed of the Criminal Division’s HRSP and Assistant U.S. Attorney Jeffrey Stitt for the Northern District of New York are prosecuting the case.

    This case is part of Operation Take Back America, a nationwide initiative that marshals the full resources of the Department of Justice to repel the invasion of illegal immigration, achieve the total elimination of cartels and transnational criminal organizations and protect our communities from the perpetrators of violent crime. Operation Take Back America streamlines efforts and resources from the Department’s Organized Crime Drug Enforcement Task Forces and Project Safe Neighborhoods.

    MIL Security OSI –