Month: May 2023

Source: United States Department of Justice News

A U.K. citizen pleaded guilty today in New York to his role in cyberstalking and multiple schemes that involve computer hacking, including the July 2020 hack of Twitter.

Joseph James O’Connor, aka PlugwalkJoe, 23, was extradited from Spain on April 26.

“O’Connor’s criminal activities were flagrant and malicious, and his conduct impacted multiple people’s lives. He harassed, threatened, and extorted his victims, causing substantial emotional harm,” said Assistant Attorney General Kenneth A. Polite, Jr. of the Justice Department’s Criminal Division. “Like many criminal actors, O’Connor tried to stay anonymous by using a computer to hide behind stealth accounts and aliases from outside the United States. But this plea shows that our investigators and prosecutors will identify, locate, and bring to justice such criminals to ensure they face the consequences for their crimes.”

“O’Connor has left an impressive trail of destruction in the wake of his wave of criminality,” said U.S. Attorney Ismail J. Ramsey for the Northern District of California. “This case serves as a warning that the reach of the law is long, and criminals anywhere who use computers to commit crimes may end up facing the consequences of their actions in places they did not anticipate.”  

“O’Connor used his sophisticated technological abilities for malicious purposes – conducting a complex SIM swap attack to steal large amounts of cryptocurrency, hacking Twitter, conducting computer intrusions to take over social media accounts, and even cyberstalking two victims, including a minor victim,” said U.S. Attorney Damian Williams for the Southern District of New York. “O’Connor’s guilty plea today is a testament to the importance of law enforcement cooperation, and I thank our law enforcement partners for helping to bring to justice those who victimize others through cyber-attacks.” 

“Today’s guilty plea is confirmation that the FBI’s strategy to counter cyber crime is working. It’s also indicative of what can be accomplished when we work closely with our partners to bring these perpetrators to justice and make the cyber ecosystem more secure,” said Assistant Director Bryan Vorndran of the FBI’s Cyber Division. “O’Connor’s extradition is as a warning to all dangerous cyber criminals that the FBI will work tirelessly to find them and hold them accountable wherever in the world they may try to hide.”

NDCA Case

According to court documents, between 2019 and 2020, O’Connor participated in a variety of crimes associated with exploitation of social media accounts, online extortion, and cyberstalking.

In July 2020, O’Connor participated in a conspiracy to gain unauthorized access to social media accounts maintained by Twitter Inc. (Twitter). In early July 2020, O’Connor’s co-conspirators used social engineering techniques to obtain unauthorized access to administrative tools used by Twitter to maintain its operations. The co-conspirators were able to use the tools to transfer control of certain Twitter accounts from their rightful owners to various unauthorized users. In some instances, the co-conspirators took control themselves and used that control to launch a scheme to defraud other Twitter users. In other instances, the co-conspirators sold access to Twitter accounts to others. O’Connor communicated with others regarding purchasing unauthorized access to a variety of Twitter accounts, including accounts associated with public figures around the world. A number of Twitter accounts targeted by O’Connor were subsequently transferred away from their rightful owners. O’Connor agreed to purchase unauthorized access to one Twitter account for $10,000.

O’Connor also accessed without authorization one of the most highly visible TikTok accounts in August 2020, which was associated with a public figure with millions of followers (Victim-1). O’Connor and his co-conspirators obtained unauthorized access to Victim-1’s account via a SIM swap after discussing a variety of celebrities to target, and O’Connor used his unauthorized access to Victim-1’s platform to post self-promotional messages, including a video in which O’Connor’s voice is recognizable. O’Connor also stated publicly, via a post to Victim-1’s TikTok account, that he would release sensitive, personal material related to Victim-1 to individuals who joined a specified Discord server.

O’Connor also targeted another public figure (Victim-2) in June 2019. O’Connor and his co-conspirators obtained unauthorized access to Victim-2’s account on Snapchat via a SIM swap. They used that access to obtain sensitive materials, to include private images, that Victim-2 had not made publicly available. O’Connor sent copies of these sensitive materials to his co-conspirators. O’Connor and his co-conspirators also reached out to Victim-2 and threatened to publicly release the stolen sensitive materials unless Victim-2 agreed to publicly post messages related to O’Connor’s online persona, among other things.

Lastly, O’Connor stalked and threatened a minor victim (Victim-3) in June and July 2020. In June 2020, O’Connor orchestrated a series of swatting attacks on Victim-3. A “swatting” attack occurs when an individual makes a false emergency call to a public authority in order to cause a law enforcement response that may put the victim or others in danger. On June 25, 2020, O’Connor called a local police department and falsely claimed that Victim-3 was making threats to shoot people. O’Connor provided an address that he believed was Victim-3’s address, which would have the result of causing a law enforcement response. That same day, O’Connor placed another call to the same police department and stated that he was planning to kill multiple people at the same address. In response to that call, the department dispatched every on-duty officer to that address in reference to an armed and dangerous individual. O’Connor sent other swatting messages that same day to a high school, a restaurant, and a sheriff’s department in the same area. In those messages, O’Connor represented himself as either Victim-3 or as a resident at the address he believed was Victim-3’s. The following month, O’Connor called multiple family members of Victim-3 and threatened to kill them.

The NDCA Case was transferred to SDNY pursuant to Federal Rule of Criminal Procedure 20 and consolidated with the SDNY Case.

SDNY Case

According to court documents, between approximately March 2019 and May 2019, O’Connor and his co-conspirators perpetrated a scheme to use subscriber identity module (SIM) swaps, a cyber intrusion technique, to conduct cyber intrusions to steal approximately $794,000 worth of cryptocurrency from a Manhattan-based cryptocurrency company (Company-1), which provided wallet infrastructure and related software to cryptocurrency exchanges around the world. 

During a SIM swap attack, cyber threat actors gain control of a victim’s mobile phone number by linking that number to a SIM card controlled by the threat actors, resulting in the victim’s calls and messages being routed to a malicious unauthorized device controlled by the threat actors. The threat actors then typically use control of the victim’s mobile phone number to obtain unauthorized access to accounts held by the victim that are registered to the mobile phone number.

As part of the scheme, O’Connor and his co-conspirators successfully perpetrated SIM swap attacks targeting at least three Company-1 executives. Following a successful SIM swap attack targeting one of the executives on or about April 30, 2019, O’Connor and his co-conspirators successfully gained unauthorized access to multiple Company-1 accounts and computer systems. On or about May 1, 2019, through their unauthorized access, O’Connor and his co-conspirators stole and fraudulently diverted cryptocurrency of various types from cryptocurrency wallets maintained by Company-1 on behalf of two of its clients. The stolen cryptocurrency was worth at least approximately $794,000 at the time of the theft. 

After stealing and fraudulently diverting the stolen cryptocurrency, O’Connor and his co-conspirators laundered it through dozens of transfers and transactions and exchanged some of it for Bitcoin using cryptocurrency exchange services. Ultimately, a portion of the stolen cryptocurrency was deposited into a cryptocurrency exchange account controlled by O’Connor.

As part of the NDCA Case, O’Connor pleaded guilty to conspiracy to commit computer intrusion and two counts of committing computer intrusions, each of which carries a maximum penalty of five years in prison; making extortive communications, which carries a maximum penalty of two years in prison; two counts of stalking, each of which carries a maximum penalty of five years in prison; and making threatening communications, which carries a maximum penalty of five years in prison. As part of the SDNY case, O’Connor pleaded guilty to conspiracy to commit computer intrusions, which carries a maximum penalty of five years in prison; conspiracy to commit wire fraud, which carries a maximum penalty of 20 years in prison; and conspiracy to commit money laundering, which carries a maximum penalty of 20 years in prison. O’Connor also agreed to forfeit $794,012.64 and to make restitution to victims of his crimes. He is scheduled to be sentenced on June 23. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

The FBI is investigating the case. 

The U.S. Attorney’s Office for the Northern District of California and the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS) are handling the NDCA case. Assistant U.S. Attorney Andrew F. Dawson for the Northern District of California and CCIPS Assistant Deputy Chief Adrienne L. Rose are prosecuting the case.

The U.S. Attorney’s Office for the Southern District of New York’s Complex Frauds and Cybercrime Unit is handling the SDNY case. Assistant U.S. Attorney Olga I. Zverovich for the Southern District of New York is prosecuting the case.

The Justice Department’s Office of International Affairs provided valuable assistance in securing the extradition of O’Connor.

Source: United States Department of Justice News

ELKINS, WEST VIRGINIA – An Elkins, West Virginia, man has admitted to having more than 300 grams of crystal methamphetamine and a firearm.  

Joshua Ervin Cave, 43, pled guilty today to possession and firearms charges. According to court documents, Cave had 338 grams of methamphetamine, also known as “ice,” and a hunting rifle found during search warrants executed at his home and a storage unit. Cave is prohibited from having firearms because of two prior domestic assault convictions in Randolph County Magistrate Court.

Cave is facing up to 20 years in prison for the drug charge and up to 10 years for the firearms charge. He is currently being held at the Tygart Valley Regional Jail. He will be sentenced at a later date. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

This case was investigated by the Mountain Region Drug Task Force.

Assistant U.S. Attorney Stephen Warner is prosecuting the case on behalf of the government.

U.S. Magistrate Judge Michael John Aloi presided.

 

Source: United States Department of Justice News

            WASHINGTON – Shamell Joyner, 35, of the District of Columbia, has been charged by superseding criminal complaint in the United States District Court for the District of Columbia for an April 13, 2023, armed carjacking and a series of armed robberies committed between April 12 and May 2, 2023.

            U.S. Attorney Matthew M. Graves, Special Agent in Charge Wayne A. Jacobs, of the FBI Washington Field Office’s Criminal and Cyber Division, and Chief Robert J. Contee III, of the Metropolitan Police Department announced the charges.

            The superseding criminal complaint describes an armed carjacking from April 13, and eight robberies of commercial establishments from April 12 through May 2, at locations in Northeast and Northwest Washington, as well as in Alexandria, Virginia, and Hanover, Maryland.  As alleged in the complaint, Joyner brandished a firearm during all of the robberies.  He discharged a firearm during the April 12 armed robbery of a Northwest Washington gas station and the April 17 armed robbery of an Alexandria, Virginia convenience store.  A store employee working at the time of the Alexandria robbery sustained a non–life threatening gunshot wound to his leg.

            Joyner is also alleged to have carjacked a man at gunpoint in the Mount Vernon Triangle neighborhood on April 13, and to have used that car to commit subsequent armed robbery offenses.  In addition, Joyner is alleged to have robbed a Hanover, Maryland gas station at gunpoint on May 2, during which he also stole a station employee’s vehicle.  The Metropolitan Police Department found Joyner in the stolen vehicle’s driver’s seat later that day and arrested him.  At the time of his arrest, Joyner was in possession of a firearm used in several of the robberies, as well as clothing and other evidence that tied him to numerous offenses.

            Joyner has been detained since his May 2, 2023, arrest pending further court proceedings.

            Joyner is charged with 16 counts under the United States and District of Columbia Codes.  Under the U.S. Code, Joyner is charged with six counts of Interference with Interstate Commerce by Robbery (also known as “Hobbs Act” robbery), which carries a maximum sentence of 20 years in prison; six counts of Using, Carrying, and Possessing a Firearm During a Crime of Violence, which carries a mandatory minimum sentence of up to 10 years in prison and a maximum sentence of life in prison; two counts of Interstate Transportation of Stolen Vehicles, which carries a maximum sentence of 10 years in prison; and one count of Unlawful Possession of a Firearm and Ammunition by a Person Convicted of a Crime Punishable by Imprisonment for a Term Exceeding One Year, which carries a maximum sentence of 15 years in prison.  Under the D.C. Code, Joyner is charged with one count of Armed Carjacking, which carries a mandatory minimum sentence of 15 years in prison and a maximum sentence of 40 years in prison. The maximum potential sentences in this case are prescribed by Congress and the Council of the District of Columbia and are provided here for informational purposes only, as any sentence imposed in this case will be determined by a federal district court judge after considering applicable sentencing guidelines and other statutory factors.

            A criminal complaint is merely an allegation, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

            This case is being investigated by the FBI’s Washington Field Office’s Violent Crime Task Force and the Metropolitan Police Department’s Carjacking Task Force. Valuable assistance was provided by the Bureau of Alcohol, Tobacco, Firearms and Explosives, and the Alexandria City, Anne Arundel County, Fairfax County, and Prince George’s County Police Departments. The case is being prosecuted by Assistant U.S. Attorney Paul V. Courtney and Special Assistant United States Attorney Lauren E. Renaud of the U.S. Attorney’s Office for the District of Columbia.

            The investigation into these offenses and potentially related armed robberies of commercial establishments located in the District of Columbia, Maryland, and Virginia remains ongoing.  Anyone with tips can call 1-800-CALL-FBI (800-225-5324) or visit tips.fbi.gov.

Source: United States Department of Justice News

Baltimore, Maryland – Stephen Franklin, age 54, of Salisbury, Maryland, pleaded guilty today to a wire fraud conspiracy and to aggravated identity theft in connection with the theft of more than $1.8 million from Shore Appliance Connection. 

The guilty plea was announced by United States Attorney for the District of Maryland Erek L. Barron and Special Agent in Charge Thomas J. Sobocinski of the Federal Bureau of Investigation, Baltimore Field Office.

According to his plea agreement, Franklin was the chief operating officer of Accurate Optical, a chain of optometric shops on the Eastern Shore of Maryland and with the owners of Accurate Optical he also purchased East Coast Optometric, a chain of South Carolina optical shops.  Franklin and co-defendant Duane G. Larmore met through the Salisbury Chamber of Commerce and became friendly.

As detailed in the plea agreement, Larmore was an employee at Shore Appliance Connection (“Shore Appliance”), located in Salisbury, Maryland, whose duties included maintaining the books and records for the company.  The company was owned and operated by Owner #1 and Owner #2.  From mid-September 2016 through about March 2020, Franklin conspired with others, including Larmore, to steal more than $1.8 million from Shore Appliance.

Specifically, Franklin and Larmore stole over $1 million from Shore Appliance to use for their own purposes, including to make investments and to pay business expenses for Franklin’s businesses, without the knowledge and consent of the owners of Shore Appliance.  For example, Franklin introduced Larmore to an individual who offered an opportunity to invest in an oil deal that promised quick and substantial returns, for an initial investment of $100,000.  Franklin did not have $100,000 but knew that Larmore could obtain the investment funds from Shore Appliance.  Larmore wire transferred $100,000 of Shore Appliance’s money to an account controlled by Franklin, who wire transferred the funds to an individual in the United Kingdom to invest in the oil deal.  Those funds were ultimately returned to Shore Appliance because the name on the bank account did not match the named beneficiary on the wire transfer form completed by Franklin.  Prior to the funds being returned and at Franklin’s urging, Larmore transferred another $100,000 to T.H., purportedly an attorney for the oil deal.  Franklin also convinced Larmore to invest in other deals, including: in 2016, a $95,000 investment with GenFinance II, PLC, London, U.K., which then required an additional $300,000, and then additional funds for additional expenses and travel abroad; in 2018, an investment through W.S. of $35,000 and an investment through Gateway Capital of $50,000; and in 2019 – 2020, investments and expenses through I.P. and E. P.-S. to recover assets in the custody of U.S. Customs, part of the Department of Homeland Security.  No investment paid any return to the schemers.

To conceal how much money had been removed from Shore Appliance and to obtain cash to invest, Franklin suggested that Larmore enter into factoring contracts.  Franklin had experience with borrowing operating funds for his optical companies from factors and provided Larmore with the names and contact information for factoring companies.  Factoring is a means by which businesses, can obtain cash quickly by leveraging accounts receivable.  With Franklin’s encouragement, Larmore applied for a factoring contract for Shore Appliance without the knowledge or approval of the owners, corporate directors, or officers of Shore Appliance.  As detailed in the plea agreement, the factoring contracts provided cash deposits to Shore Appliance’s bank accounts but encumbered the accounts receivable of Shore Appliance and required payments and interest of more than $725,000. 

To obtain contracts with factoring companies for Shore Appliance and to conceal the fact that the Shore Appliance owners were not aware of and had not approved the factoring contracts, the signatures of the owners were forged, and the fraudulent signatures were witnessed or notarized by Franklin.  Further, Larmore and a female employee of Franklin’s posed as the owners in telephone conversations with representatives of the factoring companies to confirm their approval of the factoring contracts.  In addition, to conceal Larmore’s embezzlements and the factoring agreements, Larmore caused Shore Appliance to draw on Shore Appliance’s lines of credit with two separate financial institutions to obtain another $200,000 in cash.  As of March 2020, Shore Appliance still owed $208,394.92 in principal and interest on these lines of credit.

Finally, when Franklin’s business began having financial difficulties, Franklin requested that Larmore provide funds from Shore Appliance for Franklin’s companies.  Larmore provided funds to Franklin for his businesses, including to pay rent and employee salaries, as well as paying to rent a storage facility and hire trucks to move equipment and office furniture when Accurate Optical was evicted from its Salisbury, Maryland office in July 2019.  All the while, Franklin continued to suggest that Larmore put money into other investment schemes, which Larmore did. 

In all, Larmore paid $739,295.28 of Shore Appliance’s funds, without the officers and owners’ knowledge or consent, to invest in fraudulent schemes that never paid any money back.  Of that amount, $395,000 was moved through bank accounts controlled by Franklin.  Franklin caused an additional loss of $171,548.67 by having Larmore transfer funds to Franklin or to Franklin’s companies.  As a result of the conspiracy and efforts to conceal the losses, Shore Appliance lost an additional $731,250.07 in fees and other payments to factors and to factoring brokers.  Shore appliance also paid extra interest in the amount of $208,395 from Larmore drawing on its bank lines of credit.  Thus, the factoring arrangements and advances on Shore Appliance’s lines of credit in total caused Shore Appliance to lose in actual funds $939,645.  However, Shore Appliance as of March 2020 still owed the factors almost $270,000.  For all of Franklin’s and Larmore’s conduct, actual cash losses to Shore Appliance totaled $1,850,488.94 and intended losses totaled $2,137,674.74.

Franklin faces a maximum sentence of 20 years in federal prison for a wire fraud conspiracy and a mandatory sentence of two years in federal prison, consecutive to any other sentence imposed, for aggravated identity theft.  U.S. District Judge Deborah K. Chasanow has scheduled sentencing for September 7, 2023, at 9:30 a.m.  As stated in his plea agreement, Franklin will be required to pay restitution in the full amount of the victims’ losses, which the parties stipulate is $1,850,488.94.  Franklin’s liability is joint with co-defendant Duane G. Larmore.  Duane G. Larmore, age 48, of Salisbury, previously pleaded guilty to his role in the conspiracy and is awaiting sentencing.

United States Attorney Erek L. Barron commended the FBI for its work in the investigation.  Mr. Barron thanked Assistant U.S. Attorneys Evelyn L. Cusson, Joyce K. McDonald, and Leo J. Wise, who are prosecuting the case.

For more information on the Maryland U.S. Attorney’s Office, its priorities, and resources available to help the community, please visit www.justice.gov/usao-md and https://www.justice.gov/usao-md/community-outreach. For more information about resources available to report fraud, please visit https://www.justice.gov/usao-md/report-fraud.

# # #

Source: United States Department of Justice News

ANCHORAGE – A federal grand jury in Alaska returned an indictment on April 21, 2023, charging a Wasilla man with serving as an airman without an airman’s certificate and displaying false or misleading marks about the registration of an aircraft.

According to court documents, Michael Anthony Roberts, 61, served as an airman without an airman’s certificate when he piloted Piper PA-18 registered as N99640, at Wolf Lake Airport, Wasilla, Alaska on February 27, 2022. The aircraft crashed on takeoff. The indictment also charges that Roberts displayed a false or misleading mark on the Piper PA-18 about the registration of the aircraft.    

Roberts is charged with one count of serving as an airman without a pilot certificate, in violation of 49 U.S.C. § 46306(b)(7) and one count of displaying false or misleading marks about the registration of an aircraft, in violation of 49 U.S.C. § 46306(b)(3). If convicted, he faces a maximum penalty of three years in prison and a $250,000 fine on each count. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

The defendant had his initial court appearance on May 9, 2023, before U.S. Magistrate Judge Matthew M. Scoble of the U.S. District Court for the District of Alaska, where he was ordered to be detained pending trial.

U.S. Attorney S. Lane Tucker of the District of Alaska made the announcement.

The Office of the Inspector General for the Department of Transportation, the Federal Aviation Administration, and the Alaska State Troopers are investigating the case.

Assistant U.S. Attorney Seth Brickey is prosecuting the case.

An indictment is merely an allegation and all defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

###

usao/ak/23-037