Month: September 2024

Source: United States Department of Justice Criminal Division

Note: View the affidavit here.

The Justice Department today announced a court-authorized law enforcement operation that disrupted a botnet consisting of more than 200,000 consumer devices in the United States and worldwide. As described in court documents unsealed in the Western District of Pennsylvania, the botnet devices were infected by People’s Republic of China (PRC) state-sponsored hackers working for Integrity Technology Group, a company based in Beijing, and known to the private sector as “Flax Typhoon.”

The botnet malware infected numerous types of consumer devices, including small-office/home-office (SOHO) routers, internet protocol (IP) cameras, digital video recorders (DVRs), and network-attached storage (NAS) devices. The malware connected these thousands of infected devices into a botnet, controlled by Integrity Technology Group, which was used to conduct malicious cyber activity disguised as routine internet traffic from the infected consumer devices. The court-authorized operation took control of the hackers’ computer infrastructure and, among other steps, sent disabling commands through that infrastructure to the malware on the infected devices. During the course of the operation, there was an attempt to interfere with the FBI’s remediation efforts through a distributed denial-of-service (DDoS) attack targeting the operational infrastructure that the FBI was utilizing to effectuate the court’s orders. That attack was ultimately unsuccessful in preventing the FBI’s disruption of the botnet.

“The Justice Department is zeroing in on the Chinese government backed hacking groups that target the devices of innocent Americans and pose a serious threat to our national security,” said Attorney General Merrick B. Garland. “As we did earlier this year, the Justice Department has again destroyed a botnet used by PRC-backed hackers to infiltrate consumer devices here in the United States and around the world. We will continue to aggressively counter the threat that China’s state- sponsored hacking groups pose to the American people.”

“Our takedown of this state-sponsored botnet reflects the Department’s all-tools approach to disrupting cyber criminals. This network, managed by a PRC government contractor, hijacked hundreds of thousands of private routers, cameras, and other consumer devices to create a malicious system for the PRC to exploit,” said Deputy Attorney General Lisa Monaco. “Today should serve as a warning to cybercriminals preying on Americans – if you continue to come for us, we will come for you.”

“This dynamic operation demonstrates, once again, the Justice Department’s resolve in countering the threats posed by PRC state-sponsored hackers,” said Assistant Attorney General Matthew G. Olsen of the National Security Division. “For the second time this year, we have disrupted a botnet used by PRC proxies to conceal their efforts to hack into networks in the U.S. and around the world to steal information and hold our infrastructure at risk. Our message to these hackers is clear: if you build it, we will bust it.”

“The disruption of this worldwide botnet is part of the FBI’s commitment to using technical operations to help protect victims, expose publicly the scope of these criminal hacking campaigns, and to use the adversary’s tools against them to remove malicious infrastructure from the virtual battlefield,” said FBI Deputy Director Paul Abbate. “The FBI’s unique legal authorities allowed it to lead an international operation with partners that collectively disconnected this botnet from its China-based hackers at Integrity Technology Group.”

“The targeted hacking of hundreds of thousands of innocent victims in the United States and around the world shows the breadth and aggressiveness of PRC state-sponsored hackers,” said U.S. Attorney Eric G. Olshan for the Western District of Pennsylvania. “This court-authorized operation disrupted a sophisticated botnet designed to steal sensitive information and launch disruptive cyber attacks. We will continue to work with our partners inside and outside government, using every tool at our disposal, to defend and maintain global cybersecurity.”

“The FBI’s investigation revealed that a publicly-traded, China-based company is openly selling its customers the ability to hack into and control thousands of consumer devices worldwide. This operation sends a clear message to the PRC that the United States will not tolerate this shameless criminal conduct,” said Special Agent in Charge Stacey Moy of the FBI San Diego Field Office.

According to the court documents, the botnet was developed and controlled by Integrity Technology Group, a publicly-traded company headquartered in Beijing. The company built an online application allowing its customers to log in and control specified infected victim devices, including with a menu of malicious cyber commands using a tool called “vulnerability-arsenal.” The online application was prominently labelled “KRLab,” one of the main public brands used by Integrity Technology Group.

The FBI assesses that Integrity Technology Group, in addition to developing and controlling the botnet, is responsible for computer intrusion activities attributed to China-based hackers known by the private sector as “Flax Typhoon.” Microsoft Threat Intelligence described Flax Typhoon as nation-state actors based out of China, active since 2021, who have targeted government agencies and education, critical manufacturing, and information technology organizations in Taiwan, and elsewhere. The FBI’s investigation has corroborated Microsoft’s conclusions, finding that Flax Typhoon has successfully attacked multiple U.S. and foreign corporations, universities, government agencies, telecommunications providers, and media organizations.

A cybersecurity advisory describing Integrity Technology Group tactics, techniques and procedures was also published today by the FBI, the National Security Agency, U.S. Cyber Command’s Cyber National Mission Force, and partner agencies in Australia, Canada, New Zealand and the United Kingdom. 

The government’s malware disabling commands, which interacted with the malware’s native functionality, were extensively tested prior to the operation. As expected, the operation did not affect the legitimate functions of, or collect content information from, the infected devices. The FBI is providing notice to U.S. owners of devices that were affected by this court-authorized operation. The FBI is contacting those victims through their internet service provider, who will provide notice to their customers.

The FBI’s San Diego Field Office and Cyber Division, the U.S. Attorney’s Office for the Western District of Pennsylvania, and the National Security Cyber Section of the Justice Department’s National Security Division led the domestic disruption effort. Assistance was also provided by the Criminal Division’s Computer Crime and Intellectual Property Section. These efforts would not have been successful without the collaboration of partners, including French authorities, and Lumen Technologies’ threat intelligence group, Black Lotus Labs, which first identified and described this botnet, which it named Raptor Train, in July 2023.

If you believe you have a compromised computer or device, please visit the FBI’s Internet Crime Complaint Center (IC3) or report online to CISA. You may also contact your local FBI field office directly.

The FBI continues to investigate Integrity Technology Group’s and Flax Typhoon’s computer intrusion activities.

Source: United States Department of Justice Criminal Division

Attorney General Merrick Garland has appointed two Acting U.S. Trustees, the Executive Office for U.S. Trustees announced today. Under 28 U.S.C. § 585(a), the Attorney General may fill U.S. Trustee vacancies by appointing an Acting U.S. Trustee. 

Jonas V. Anderson has been appointed as the Acting U.S. Trustee for Alaska, Idaho, Montana, Oregon and Washington (Region 18). Anderson replaces Gregory M. Garvin, who has been appointed as the Acting U.S. Trustee for Colorado, Utah and Wyoming (Region 19). Garvin replaces Patrick S. Layng, who is retiring after 36 years of service to the Justice Department, including the last 10 years as the interim U.S. Trustee for Region 19.

The appointments of Anderson and Garvin are effective Sept. 28.

Anderson joined the U.S. Trustee Program (USTP) in 2010 as a trial attorney in the Las Vegas office through the Attorney General’s Honors Program after clerking for Judge Deanell Reece Tacha of the U.S. Court of Appeals for the Tenth Circuit. Anderson has served as the Assistant U.S. Trustee in charge of the USTP’s Eugene, Oregon, office since 2016, and for two years he served as the Acting Assistant U.S. Trustee of the Portland, Oregon, office. He received his Juris Doctor and Master of Legal Letters degrees from Duke University School of Law, a master’s degree from Yale University and a bachelor’s degree magna cum laude from Brigham Young University.

After seven years as the Acting U.S. Trustee in Region 18, Garvin will transition to a similar role in Region 19, where he has already been serving as the Assistant U.S. Trustee for the Denver field office since 2008. Before joining the USTP, Garvin was in private practice in the Kansas City area for 17 years focusing on commercial litigation and bankruptcy matters, including representing debtors in chapter 7 and 13 as well as individuals, small businesses and creditors in chapter 11. He received his bachelor’s degree and his law degree from the University of Kansas.

The USTP’s mission is to promote the integrity and efficiency of the bankruptcy system for the benefit of all stakeholders — debtors, creditors and the public. The USTP consists of 21 regions with 89 field offices nationwide and an Executive Office in Washington, D.C. Learn more about the USTP at www.justice.gov/ust.

Source: United States Department of Justice

Oak Street Health, headquartered in Chicago and a wholly-owned subsidiary of CVS Health since 2023, has agreed to pay $60 million to resolve allegations that it violated the False Claims Act by paying kickbacks to third-party insurance agents in exchange for recruiting seniors to Oak Street Health’s primary care clinics.

The Anti-Kickback Statute prohibits anyone from offering or paying, directly or indirectly, any remuneration — which includes money or any other thing of value — to induce referrals of patients or to provide recommendations of items or services covered by Medicare, Medicaid and other federally funded programs. Under the Medicare Advantage (MA) Program, also known as Part C, Medicare beneficiaries have the option to obtain their health care through privately-operated insurance plans known as MA plans. Some MA Plans contract with health care providers, including Oak Street Health, to provide their plan members with primary care services.

The United States alleged that, in 2020, Oak Street Health developed a program to increase patient membership called the Client Awareness Program. Under the Program, third-party insurance agents contacted seniors eligible for or enrolled in Medicare Advantage and delivered marketing messages designed to generate interest in Oak Street Health. Agents then referred interested seniors to an Oak Street Health employee via a three-way phone call, otherwise known as a “warm transfer,” and/or an electronic submission. In exchange, Oak Street Health paid agents typically $200 per beneficiary referred or recommended. These payments incentivized agents to base their referrals and recommendations on the financial motivations of Oak Street Health rather than the best interests of seniors. The settlement resolves allegations that, from September 2020 through December 2022, Oak Street Health knowingly submitted, and caused the submission of, false claims to Medicare arising from kickbacks to agents that violated the Anti-Kickback Statute.

“Health care providers that attempt to profit from kickbacks will be held accountable,” said Principal Deputy Assistant Attorney General Brian M. Boynton, head of the Justice Department’s Civil Division. “We are committed to rooting out illegal practices committed by Medicare Advantage providers, insurance agents and brokers that undermine the interests of federal health care programs and the patients they serve.”

“Kickbacks, in any form, have no place in our federal healthcare system” said Acting U.S. Attorney Morris Pasqual for the Northern District of Illinois. “My office is alert for kickbacks that can subvert patient choice and defraud federal health care programs. This investigation and settlement help to ensure that patient choice is prioritized above a provider’s bottom line.”

“Kickbacks impose hidden costs on the federal health care system and compromise medical choice and decision-making,” said Special Agent in Charge Mario Pinto of the Department of Health and Human Services Office of the Inspector General (HHS-OIG). “Working determinedly with our law enforcement partners, HHS-OIG will continue to protect the integrity of federal health care programs, and we encourage the public to come forward with information about violative conduct.”

The civil settlement includes the resolution of claims brought under the qui tam or whistleblower provisions of the False Claims Act by Joseph Stinson. Under those provisions, a private party can file an action on behalf of the United States and receive a portion of any recovery. The qui tam case is captioned U.S. ex rel. Stinson v. Oak Street Health, et al., No. 20-cv-7381 (N.D. Ill.). As part of today’s resolution, Mr. Stinson will receive $9.9 million.

The resolution obtained in this matter was the result of a coordinated effort between the Civil Division’s Commercial Litigation Branch, Fraud Section, and the U.S. Attorney’s Office for the Northern District of Illinois, with assistance from HHS-OIG and the FBI.

The investigation and resolution of this matter illustrates the government’s emphasis on combating health care fraud. One of the most powerful tools in this effort is the False Claims Act. Tips and complaints from all sources about potential fraud, waste, abuse and mismanagement can be reported to HHS at 800-HHS-TIPS (800-447-8477).

Trial Attorney David G. Miller of the Justice Department’s Civil Division and Assistant U.S. Attorney Jonathan C. Haile for the Northern District of Illinois handled the matter.

The claims resolved by the settlement are allegations only. There has been no determination of liability.

Settlement