Month: September 2024

Source: United States Department of Justice Criminal Division

Remarks as Prepared for Delivery

Thank you joining us this afternoon.

I am Matt Olsen, the Assistant Attorney General for National Security at the Department of Justice. I am joined today by the U.S. Attorney Erek Barron for the District of Maryland and Special Agent in Charge William DelBagno of the FBI Baltimore Field Office.

Today, we are announcing a superseding indictment against five officers of the Russian military intelligence agency, known as the GRU, and one civilian Russian cyber-criminal for their campaign to conduct cyber intrusions.

The superseding indictment adds to charges made public in June of this year against the Russian civilian, Amin Stigal. As alleged, the defendants are responsible for, among other malicious cyber activity, carrying out the series of destructive computer attacks, commonly referred to in the cybersecurity community as the “WhisperGate” campaign, which targeted computers in Ukraine shortly before Russia’s invasion in February 2022. More generally, the indictment alleges conspiracies related to cyber intrusions targeting victims in the United States, in Ukraine and elsewhere.

This WhisperGate campaign included the targeting of civilian infrastructure and Ukrainian computer systems wholly unrelated to the military or national defense, including government agencies responsible for emergency services, the judiciary, food safety and education.

Seeking to sap the morale of the Ukrainian public, the defendants also stole and leaked the personal data of thousands of Ukrainian civilians, including by posting individual patient heath information and other sensitive private data for sale online, and then taunting their victims.

They attempted to cover their tracks by pretending to be criminals engaged in ransomware attacks — leaving behind ransom notes demanding Bitcoin payments to return data from victim systems that the perpetrators knew had been destroyed and could not be recovered. Indeed, Stigal’s involvement demonstrates the Russian government’s continued willingness to provide a haven for cybercriminals in exchange for such criminals being “on call” to provide support and deniability for its military and intelligence services.

These conspirators did not limit their activities to Ukraine. They targeted computers around the world and used computer infrastructure of an unwitting U.S.-based company to conduct the WhisperGate attacks. The conspirators went on to target computer systems in other nations supporting Ukraine in its fight for survival, such as one alleged instance of targeting a European country’s transportation infrastructure. Ultimately, their targets included computer systems in 26 NATO partners, including the United States.

Before I turn it over to U.S. Attorney Barron to discuss this case in more detail, I will note that we are announcing today’s charges alongside the concurrent actions of our partners.

The U.S. Department of State is offering a Rewards for Justice reward of up to $10 million for information on the defendants. Over a dozen domestic and foreign partners have issued a joint cyber security advisory regarding the group’s cyber activities. And Estonia also has announced criminal charges against several individuals involved in the same hacking activity, including two of the same defendants.

The Justice Department stands united with our partners and allies in supporting the Ukrainian people in the wake of Russia’s unlawful and unjust invasion. The National Security Division will continue to use every tool in the department’s arsenal – including our private and international partnerships – to identify the individuals, take down the infrastructure and expose the tools and techniques propping up the Russian Government and carrying out its wide-variety of malicious and destabilizing activities.

When it comes to countering Russia’s cyber-enabled malicious activities, National Security Division prosecutors are operating as a force multiplier for prosecutors and agents throughout the country. They are emphasizing prevention and, since Russia’s invasion, have conducted multiple court-authorized takedowns of the GRU’s and other Russian botnets and malware networks. This includes the April 2022 Cyclops Blink operation to remove the GRU’s malware from infected C2 devices, successfully dismantling the GRU botnet and remediating thousands of infected devices, which Russia could have otherwise deployed against Ukraine and its allies. In May 2023, they executed the court-authorized removal of the FSB’s “Snake” malware from hundreds of computer systems in at least 50 countries, undermining the FSB’s global espionage apparatus. And, just a few months ago, the National Security Cyber Section spearheaded the court-authorized takedown of a network of hundreds of compromised routers that the GRU had set up as the successor to Cyclops Blink. Even as our cyber adversaries evolve and adjust tactics, we are rising to counter them every step of the way.

We are also bringing this proactive posture to disrupting cyber-enabled foreign malign influence operations as well. Just yesterday, the Attorney General announced the department’s “Doppelganger” takedown operation to seize 32 internet domains used by the Russian government and its proxies to impersonate legitimate U.S. and foreign media organizations and perpetrate a covert campaign to interfere in the 2024 U.S. presidential election. This followed an action a few months ago to take down a Russian intelligence-operated, AI-enhanced bot farm that was similarly used to disseminate disinformation and sow discord in the U.S. and elsewhere. 

I want to thank U.S. Attorney Barron and the prosecutors in the U.S. Attorney’s Office for the District of Maryland, and the FBI’s Baltimore Field Office, Milwaukee Field Office and Boston Field Office. Their dedication and partnership in disrupting this serious activity illustrates the department’s commitment to meeting national security and cybersecurity threats with action.

Source: United States Department of Justice Criminal Division

The Justice Department today announced that Samuel Ogoshi, 24, and Samson Ogoshi, 21, both of Lagos, Nigeria, were each sentenced to 210 months in prison and five years of supervised release for conspiracy to sexually exploit minors. On March 25, 2022, 17-year-old high school student, Jordan DeMay, of Marquette, Michigan, died as a result of this sextortion scheme, which targeted over 100 other victims.

“These defendants sexually exploited and extorted more than 100 victims, including at least eleven minors, resulting in the tragic death of a 17- year-old high school student,” said Attorney General Merrick B. Garland. “These sentences should serve as a warning that the perpetrators of online sexual exploitation and extortion cannot escape accountability for their heinous crimes by hiding behind their phones and computers. The Justice Department will find them, no matter where they are, and we will bring them to justice in the United States.”

“Today’s sentencing of Samuel and Samson Ogoshi sends a thundering message,” said U.S. Attorney Mark Totten for the Western District of Michigan. “To criminals who commit these schemes: you are not immune from justice. We will track you down and hold you accountable, even if we have to go half-way around the world to do so. The day when you could commit these crimes, rake in easy cash, destroy lives, and escape justice is gone. And to parents, teenagers, and everyone who uses a cell phone: please, please be careful. These devices can connect you to criminal networks around the world. Don’t assume people are who they say they are. Don’t share compromising images. And if you’re a victim, please reach out. There’s help, and law enforcement stands ready.”

“The sentencing of sextortionists Samuel and Samson Ogoshi ensures both international criminals will no longer victimize minors in the United States or throughout the world,” said Special Agent in Charge Cheyvoryea Gibson of the FBI Detroit Field Office. “Spreading awareness on sextortion is a top priority of the FBI here in Michigan. Our hearts and prayers are with the loved ones of Jordan DeMay and those affected by the criminal acts of these individuals.”

At a press conference today, U.S. Attorney Totten emphasized the scope of this threat and the need for vigilance by sharing that multiple other deaths tied to sextortion schemes are under investigation in the Western District of Michigan.

As detailed in their plea agreements (here and here), Samuel and Samson Ogoshi engaged in a scheme while living in Nigeria to sexually exploit more than 100 victims, including at least 11 identified minor victims. They purchased hacked social media accounts and used them to pose as young women, making fake profiles and using the messaging feature on the social media accounts to contact victims. They conducted online research about their victims to learn where they lived, attended school, worked, and the identities of their family and friends. They then solicited their minor victims to produce sexually explicit images of themselves. Once they received the images, they created a collage of pictures that included the sexually explicit image with other images of the victim and their school, family, and friends. The Ogoshi brothers threatened to disclose the collages to the family, friends, and classmates of the victim unless the victim agreed to pay money using online cash applications.

In November 2022, the U.S. Attorney’s Office for the Western District of Michigan charged Samuel Ogoshi, Samson Ogoshi, and Ezekiel Robert, all Nigerian nationals, in the sextortion scheme that resulted in the death of Jordan DeMay. The Ogoshi Brothers were extradited to the United States in August 2023 and pleaded guilty in April. On March 21, a Nigerian court ordered Robert to be extradited to the United States. He has appealed that decision, and the matter is before the Nigerian High Court.

In addition, on Aug. 2, U.S. Attorney Totten announced the unsealing of a federal indictment in a separate case charging five U.S.-based defendants with conspiring to commit money laundering that facilitated the sextortion scheme. 

The FBI, Marquette Sheriff’s Department, and Michigan State Police Cybercrimes Unit in Marquette are investigating the case, with the cooperation and assistance of the Economic and Financial Crimes Commission of Nigeria. The Department of Justice’s Office of International Affairs, Department of State, and Nigerian Attorney General’s Office – Ministry of Justice provided critical assistance securing the arrest and extradition of the defendants.

Assistant U.S. Attorneys Daniel Mekaru and Davin Reust for the Western District of Michigan are prosecuting the case.

Safety Tips and Resources for Victims, Teens, and Parents

The FBI provides the following tips on how people can protect themselves from sextortion schemes:

1. Be selective about what you share online. If your social media accounts are open to everyone, a predator may be able to figure out a lot of information about you.
2. Be wary of anyone you encounter for the first time online. Block or ignore messages from strangers.
3. Be aware that people can pretend to be anything or anyone online. Videos and photos are not proof that people are who they claim to be. Images can be altered or stolen. In some cases, predators have even taken over the social media accounts of their victims.
4. Be suspicious if you meet someone on one game or app and that person asks you to start talking on a different platform.
5. Be in the know. Any content you create online — whether it is a text message, photo, or video — can be made public. And nothing actually “disappears” online. Once you send something, you don’t have any control over where it goes next.
6. Be willing to ask for help. If you are getting messages or requests online that don’t seem right, block the sender, report the behavior to the site administrator, or go to an adult. If you have been victimized online, tell someone. Being a victim of sextortion is not your fault. You can get through this challenge, even if it seems scary and overwhelming. There are people who want to help.

If you have information about or believe you are a victim of sextortion, contact your local FBI field office, call 1-800-CALL-FBI, or report it online at tips.fbi.gov. This FBI PSA and National Center for Missing and Exploited Children PSA share survivor stories and resources for individuals to get help. More FBI sextortion resources are available here.

Source: United States Department of Justice

Note: View the indictment here. 

In an indictment unsealed today, a grand jury in Maryland charged six computer hackers, all of whom were residents and nationals of the Russian Federation (Russia), with conspiracy to commit computer intrusion and wire fraud conspiracy. Five of the defendants were officers in Unit 29155 of the Russian Main Intelligence Directorate (GRU), a military intelligence agency of the General Staff of the Armed Forces. The sixth individual was a civilian already under indictment for conspiracy to commit computer intrusion and is now also charged with wire fraud conspiracy.

Note: Concurrent with the return of the indictment, the U.S. Department of State’s Rewards for Justice program is offering a reward of up to $10 million for information on any of the defendants’ locations or their malicious cyberactivity. Anyone possessing such information should contact Rewards for Justice here. 

The indictment alleges that these GRU hackers and their co-conspirator engaged in a conspiracy to hack into, exfiltrate data from, leak information obtained from and destroy computer systems associated with the Ukrainian Government in advance of the Russian invasion of Ukraine. The defendants did so in order to sow concern among Ukrainian citizens regarding the safety of their government systems and personal data. The defendants’ targets included Ukrainian Government systems and data with no military or defense-related roles. Later targets included computer systems in countries around the world that were providing support to Ukraine, including the United States and 25 other North Atlantic Treaty Organization (NATO) countries.

“The GRU’s WhisperGate campaign, including targeting Ukrainian critical infrastructure and government systems of no military value, is emblematic of Russia’s abhorrent disregard for innocent civilians as it wages its unjust invasion,” said Assistant Attorney General Matthew G. Olsen of the National Security Division. “Today’s indictment underscores that the Justice Department will use every available tool to disrupt this kind of malicious cyber activity and hold perpetrators accountable for indiscriminate and destructive targeting of the United States and our allies.”

“Since July 2021, the U.S. Department of State’s Rewards for Justice (RFJ) program,  administered by the Diplomatic Security Service (DSS), has offered a reward of up to $10 million for information leading to the identification or location of any person who, while acting at the direction or under the control of a foreign government, participates in certain malicious cyber activities against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act,” said DSS Deputy Assistant Secretary for Threat Investigations and Analysis Paul Houston. “Under this reward offer, the RFJ program is seeking information leading to the location of these individuals, GRU’s malicious cyber activity or associated individuals and entities.”

“Today’s superseding indictment underscores our commitment to using all the tools at our disposal to pursue those who would do us and our allies around the world harm,” said U.S. Attorney Erek L. Barron for the District of Maryland. “Cyber intrusion schemes such as the one alleged threaten our national security, and we will use all the technologies and investigative measures at our disposal to disrupt and track down these cybercriminals.”

“Through strokes on a keyboard, the accused criminals used computers to cross into countries, hunting for weaknesses and seeking to harm. The FBI and our law enforcement partners, both national and international, will collectively defend against Russia’s aggressive and illegal actions,” said Special Agent in Charge William J. DelBagno of the FBI Baltimore Field Office. “We are united in identifying, prosecuting and protecting against future crimes and vow to relentlessly hunt down and counter these threats.”

The defendants charged in the indictment are: Yuriy Denisov [Юрий Денисов], a colonel in the Russian military and a commanding officer of Cyber Operations for Unit 29155; four lieutenants in the Russian military assigned to Unit 29155 who worked on cyber operations: Vladislav Borovkov [Владислав Боровков], Denis Denisenko [Денис Денисенко], Dmitriy Goloshubov [Дима Голошубов] and Nikolay Korchagin [Николай Корчагин]; and a civilian co-conspirator, Amin Sitgal [Амин Стигал].

According to court documents, on Jan. 13, 2022, the defendants conspired to use a U.S.-based company’s services to distribute malware known in the cybersecurity community as “WhisperGate,” which was designed to look like ransomware, to dozens of Ukrainian government entities’ computer systems. However, as the indictment alleges, WhisperGate was actually a cyberweapon designed to completely destroy the target computer and related data in advance of the Russian invasion of Ukraine. Ukrainian government networks subjected to this attack included the Ukrainian Ministry of Internal Affairs, State Treasury, Judiciary Administration, State Portal for Digital Services, Ministry of Education and Science, Ministry of Agriculture, State Service for Food Safety and Consumer Protection, Ministry of Energy, Accounting Chamber for Ukraine, State Emergency Service, State Forestry Agency and Motor Insurance Bureau.

In conjunction with these attacks, the defendants compromised several of the targeted Ukrainian computer systems, exfiltrated sensitive data, including patient health records and defaced the websites to read: “Ukrainians! All information about you has become public, be afraid and expect the worst. This is for your past, present and future.” That same day, the defendants offered the hacked data for sale on the internet.

The U.S. government previously joined with allies and partners in May 2022 to attribute this cyber-attack to the Russian military and to condemn the attack and similar destructive cyber activities against Ukraine.

In August 2022, the defendants also hacked the transportation infrastructure of a Central European country that was supporting Ukraine. Beginning in August 2021, the defendants also probed a variety of protected computer systems including those associated with 26 NATO member countries, searching for potential vulnerabilities. The indictment further alleges that from Aug. 5, 2021, to Feb. 3, 2022, the defendants leveraged the same computer infrastructure they used in the Ukraine-related attacks to probe computers belonging to a federal government agency in Maryland in the same manner as they had initially probed the Ukrainian Government networks.

This indictment is part of an international effort, Operation Toy Soldier, to combat the malicious cyber activity by Unit 29155 of the GRU. Accompanying today’s announcement, the FBI and 12 other partners, representing governments of nine countries, released a Joint Cybersecurity Advisory to enhance network defense efforts against Unit 29155’s malicious cyber activities.

The FBI Baltimore Field Office is investigating the case with assistance from FBI Milwaukee and Boston Field Offices.

Assistant U.S. Attorneys Aaron S.J. Zelinsky and Robert I. Goldaris for the District of Maryland are prosecuting the case with valuable assistance from the National Security Division’s National Security Cyber Section.