Category: Security News

Source: United States Department of Justice Criminal Division

Remarks as Delivered

Thank you all. It’s really nice to be here. Thanks, Damian.

It feels a little bit full circle because my first visit was at Damian’s investiture. I got to talk to most of you then. So, now it seems like a good time to talk to you one more time.

Mostly, what I just want to say is what Damian said, which is I am incredibly proud of you. And I am incredibly grateful for the terrific work that you’ve done.

Over the past four years, this office has received public recognition, and rightfully so, for incredibly important cases — for disrupting the Sinaloa Cartel, for driving down violent crime, for successful prosecutions of the CEOs of the largest cryptocurrencies in the world, and for relentlessly pursuing public corruption without fear or favor.

But this is just a sliver of the work you do. And I wish that the public could see all the rest of the work you do. The stuff that doesn’t make it to the headlines. The day in and day out work that you do. The time you take away from your families. The extraordinarily long days you spend and the risks that we all take. They would be extremely proud of you, to see what true patriots all of you are.

Now I want to say, while I care very much about the work that you do, I care even more about the way in which you do that work.

Yes, you are aggressive prosecutors, aggressive investigators, aggressive attorneys in service of the public.

But in everything you do, you do it the right way. You follow the rule of law. You follow the Principles of Federal Prosecution in deciding who you should prosecute and who you shouldn’t prosecute.

Every day you come to work with one job only: to do the right thing. All day long. And I wish the American people could see that. I wish they could be in on your charging conferences. I wish they could be in when you’re debating what should go into briefs. I wish they could be in when you’re making decision about what should go in an indictment or whether there should be an indictment.

They would be so proud.

That’s where the rule of law really exists in this country.

Now, for myself, I may be coming to the end of my tenure at the Justice Department, but I know that all of you will continue. You will continue in the Department’s mission, what has always been its mission: to uphold the rule of law, to keep our country safe, and to protect civil rights.

You — the career lawyers of this district, the career lawyers of all the U.S. Attorneys’ Offices, the career lawyers of the Justice Department as a whole — you are the institutional backbone of this Department.

You are the historical memory of this Department.

You are the heart and the soul of the Department.

You are the Justice Department.

I could not be more proud of you. And I could not be more grateful for all of the work that you have done to protect the American people.

Thank you.

Source: United States Department of Justice Criminal Division

An indictment was unsealed today charging the former CEO of 500.com (now BIT Mining Ltd.), Zhengming Pan, a Chinese national, with violations of the Foreign Corrupt Practices Act (FCPA). BIT Mining Ltd. has agreed to resolve investigations by the Justice Department and the Securities and Exchange Commission (SEC) into related FCPA violations arising from the company’s participation in a corrupt scheme to pay bribes to Japanese government officials.

BIT Mining entered into a three-year deferred prosecution agreement (DPA) in connection with a criminal information filed in the District of New Jersey charging BIT Mining with one count of conspiracy to violate the anti-bribery and books and records provisions of the FCPA and one count of violating the books and records provisions of the FCPA.

A federal grand jury in the District of New Jersey returned an indictment against Pan on June 18. Pan is charged with one count of conspiracy to violate the anti-bribery and books and records provisions of the FCPA, one count of violating the anti-bribery provisions of the FCPA, and two counts of violating the books and records provisions of the FCPA.

“BIT Mining, under the alleged direction of then-CEO Zhengming Pan, agreed to pay nearly $2 million in bribes to Japanese government officials to win a contract to open a lucrative resort and casino in Japan,” said Principal Deputy Assistant Attorney General Nicole M. Argentieri, head of the Justice Department’s Criminal Division. “Pan has been indicted for his alleged role in directing company consultants to pay the bribes and to conceal the illicit payments through sham consulting contracts. Today’s resolution and the charges against Pan demonstrate the department’s continued commitment to holding both corporate and individual wrongdoers accountable for their crimes.”

“Paying bribes to foreign government officials is a serious crime. The top leadership of BIT Mining, then known as 500.com, directed consultants to pay bribes to Japanese government officials to win a bid to open a large resort in Japan,” said U.S. Attorney Philip R. Sellinger for the District of New Jersey. “The illegal scheme started at the top, with the company’s CEO allegedly fully involved in directing the illicit payments and the subsequent efforts to conceal them. The company has admitted its crimes and agreed to pay a $10 million penalty, and its then-CEO has been charged for his role in the scheme. This agreement and indictment hold both the corporation as an entity and its top leadership accountable.”

“Today’s indictment against the former CEO of BIT Mining for bribing Japanese officials highlights the FBI’s commitment to holding individuals accountable for illegal conduct,” said Assistant Director Chad Yarbrough of the FBI Criminal Investigative Division. “This type of criminal activity undermines the integrity of business practices. The FBI will relentlessly pursue those involved in illegal schemes creating unfair advantages and ensure they face the full consequences of the law.”

According to court documents, between 2017 and 2019, BIT Mining, then known as 500.com, admitted that its then-CEO Pan, employees, and agents, agreed to pay approximately $1.9 million in bribes and payments to intermediaries, knowing the money would be used to make bribe payments to Japanese government officials. The purpose of the bribes was to try to help 500.com win a bid to open an integrated resort (a large resort that includes hotels, casinos, retail, dining, convention facilities, and entertainment venues) in Japan. On behalf of 500.com, Pan allegedly engaged third-party consultants to assist 500.com in paying and concealing these bribes. 500.com, through these consultants, paid bribes in the form of cash, travel, entertainment, and gifts. Pan and others allegedly covered up the payment of these bribes by, among other things, entering into sham contracts with the consultants and falsely recording the payments as legitimate expenses, including as management advisory fees. Ultimately, despite carrying out this bribery scheme, 500.com did not win an integrated resort bid in Japan.

Pursuant to the DPA, BIT Mining agreed, based on the application of the U.S. Sentencing Guidelines, that the appropriate criminal penalty is $54 million. However, due to BIT Mining’s financial condition and demonstrated inability to pay the penalty calculated under the U.S. Sentencing Guidelines, BIT Mining and the Justice Department agreed, consistent with the department’s inability to pay guidance, that BIT Mining will pay a total criminal penalty of $10 million. The Justice Department has agreed to credit up to $4 million against the civil penalty BIT Mining has agreed to pay to the SEC to resolve a parallel investigation.

BIT Mining has also agreed to continue to cooperate with the Fraud Section and the U.S. Attorney’s Office for the District of New Jersey in any ongoing or future criminal investigations. In addition, BIT Mining has agreed to continue to enhance its compliance programs and provide reports to the Justice Department regarding remediation and the implementation of compliance measures for the three-year term of the DPA.

The Justice Department reached this resolution with BIT Mining based on a number of factors, including, among others, the nature and seriousness of the offense. BIT Mining received credit for its cooperation with the department’s investigation, which included (i) voluntarily producing relevant documents, financial data, and other information, including from foreign countries, while navigating some foreign data privacy and related criminal laws, accompanied by translations of a limited number of documents; and (ii) providing the government with facts learned during its internal investigation. The cooperation was, however, reactive and limited in degree and impact.

BIT Mining engaged in certain timely remedial measures, which included, among other things, (i) increasing governance and oversight of compliance risks and audit findings by the Board of Directors, (ii) promoting compliance and ethics through company-wide communications, (iii) incorporating compliance criteria in performance evaluations for senior management, (iv) conducting annual risk assessments, (v) creating an anti-corruption policy and engaging in company-wide training and communications to promote it, and (vi) transitioning its business model to an industry that presents a lower corruption risk and reducing its presence in high risk regions. In light of these considerations, BIT Mining’s criminal penalty calculated under the U.S. Sentencing Guidelines reflects a 10% reduction off the bottom of the applicable guidelines fine range.

The FBI’s International Corruption Unit is investigating the case.

Trial Attorneys Jil Simon and Ligia Markman of the Criminal Division’s Fraud Section and Assistant U.S. Attorney Jennifer Kozar for the District of New Jersey are prosecuting the cases.

The Justice Department’s Office of International Affairs and authorities in Japan provided assistance in this matter.

The Fraud Section is responsible for investigating and prosecuting FCPA and Foreign Extortion Prevention Act matters. Additional information about the Justice Department’s FCPA enforcement efforts can be found at www.justice.gov/criminal-fraud/foreign-corrupt-practices-act.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Source: United States Department of Justice Criminal Division

An indictment was unsealed today charging the former CEO of 500.com (now BIT Mining Ltd.), Zhengming Pan, a Chinese national, with violations of the Foreign Corrupt Practices Act (FCPA). BIT Mining Ltd. has agreed to resolve investigations by the Justice Department and the Securities and Exchange Commission (SEC) into related FCPA violations arising from the company’s participation in a corrupt scheme to pay bribes to Japanese government officials.

BIT Mining entered into a three-year deferred prosecution agreement (DPA) in connection with a criminal information filed in the District of New Jersey charging BIT Mining with one count of conspiracy to violate the anti-bribery and books and records provisions of the FCPA and one count of violating the books and records provisions of the FCPA.

A federal grand jury in the District of New Jersey returned an indictment against Pan on June 18. Pan is charged with one count of conspiracy to violate the anti-bribery and books and records provisions of the FCPA, one count of violating the anti-bribery provisions of the FCPA, and two counts of violating the books and records provisions of the FCPA.

“BIT Mining, under the alleged direction of then-CEO Zhengming Pan, agreed to pay nearly $2 million in bribes to Japanese government officials to win a contract to open a lucrative resort and casino in Japan,” said Principal Deputy Assistant Attorney General Nicole M. Argentieri, head of the Justice Department’s Criminal Division. “Pan has been indicted for his alleged role in directing company consultants to pay the bribes and to conceal the illicit payments through sham consulting contracts. Today’s resolution and the charges against Pan demonstrate the department’s continued commitment to holding both corporate and individual wrongdoers accountable for their crimes.”

“Paying bribes to foreign government officials is a serious crime. The top leadership of BIT Mining, then known as 500.com, directed consultants to pay bribes to Japanese government officials to win a bid to open a large resort in Japan,” said U.S. Attorney Philip R. Sellinger for the District of New Jersey. “The illegal scheme started at the top, with the company’s CEO allegedly fully involved in directing the illicit payments and the subsequent efforts to conceal them. The company has admitted its crimes and agreed to pay a $10 million penalty, and its then-CEO has been charged for his role in the scheme. This agreement and indictment hold both the corporation as an entity and its top leadership accountable.”

“Today’s indictment against the former CEO of BIT Mining for bribing Japanese officials highlights the FBI’s commitment to holding individuals accountable for illegal conduct,” said Assistant Director Chad Yarbrough of the FBI Criminal Investigative Division. “This type of criminal activity undermines the integrity of business practices. The FBI will relentlessly pursue those involved in illegal schemes creating unfair advantages and ensure they face the full consequences of the law.”

According to court documents, between 2017 and 2019, BIT Mining, then known as 500.com, admitted that its then-CEO Pan, employees, and agents, agreed to pay approximately $1.9 million in bribes and payments to intermediaries, knowing the money would be used to make bribe payments to Japanese government officials. The purpose of the bribes was to try to help 500.com win a bid to open an integrated resort (a large resort that includes hotels, casinos, retail, dining, convention facilities, and entertainment venues) in Japan. On behalf of 500.com, Pan allegedly engaged third-party consultants to assist 500.com in paying and concealing these bribes. 500.com, through these consultants, paid bribes in the form of cash, travel, entertainment, and gifts. Pan and others allegedly covered up the payment of these bribes by, among other things, entering into sham contracts with the consultants and falsely recording the payments as legitimate expenses, including as management advisory fees. Ultimately, despite carrying out this bribery scheme, 500.com did not win an integrated resort bid in Japan.

Pursuant to the DPA, BIT Mining agreed, based on the application of the U.S. Sentencing Guidelines, that the appropriate criminal penalty is $54 million. However, due to BIT Mining’s financial condition and demonstrated inability to pay the penalty calculated under the U.S. Sentencing Guidelines, BIT Mining and the Justice Department agreed, consistent with the department’s inability to pay guidance, that BIT Mining will pay a total criminal penalty of $10 million. The Justice Department has agreed to credit up to $4 million against the civil penalty BIT Mining has agreed to pay to the SEC to resolve a parallel investigation.

BIT Mining has also agreed to continue to cooperate with the Fraud Section and the U.S. Attorney’s Office for the District of New Jersey in any ongoing or future criminal investigations. In addition, BIT Mining has agreed to continue to enhance its compliance programs and provide reports to the Justice Department regarding remediation and the implementation of compliance measures for the three-year term of the DPA.

The Justice Department reached this resolution with BIT Mining based on a number of factors, including, among others, the nature and seriousness of the offense. BIT Mining received credit for its cooperation with the department’s investigation, which included (i) voluntarily producing relevant documents, financial data, and other information, including from foreign countries, while navigating some foreign data privacy and related criminal laws, accompanied by translations of a limited number of documents; and (ii) providing the government with facts learned during its internal investigation. The cooperation was, however, reactive and limited in degree and impact.

BIT Mining engaged in certain timely remedial measures, which included, among other things, (i) increasing governance and oversight of compliance risks and audit findings by the Board of Directors, (ii) promoting compliance and ethics through company-wide communications, (iii) incorporating compliance criteria in performance evaluations for senior management, (iv) conducting annual risk assessments, (v) creating an anti-corruption policy and engaging in company-wide training and communications to promote it, and (vi) transitioning its business model to an industry that presents a lower corruption risk and reducing its presence in high risk regions. In light of these considerations, BIT Mining’s criminal penalty calculated under the U.S. Sentencing Guidelines reflects a 10% reduction off the bottom of the applicable guidelines fine range.

The FBI’s International Corruption Unit is investigating the case.

Trial Attorneys Jil Simon and Ligia Markman of the Criminal Division’s Fraud Section and Assistant U.S. Attorney Jennifer Kozar for the District of New Jersey are prosecuting the cases.

The Justice Department’s Office of International Affairs and authorities in Japan provided assistance in this matter.

The Fraud Section is responsible for investigating and prosecuting FCPA and Foreign Extortion Prevention Act matters. Additional information about the Justice Department’s FCPA enforcement efforts can be found at www.justice.gov/criminal-fraud/foreign-corrupt-practices-act.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Source: United States Department of Justice Criminal Division

A two-count indictment was unsealed today charging a U.S. Postal Service Postmaster with a federal civil rights violation for sexually assaulting a victim while acting under color of law and assaulting the victim, a federal employee, during the course of her official duties.

According to the indictment, on Nov. 26, 2022, in Teaneck, New Jersey, Gabriel Ekram Pagabe Ali, 47, sexually assaulted the victim, an employee of the U.S. Postal Service while on duty as a Postmaster at the U.S. Post Office in Teaneck.

Count One of the indictment charges Ali with depriving the victim of her right to bodily integrity when he sexually assaulted the victim. Count Two of the indictment charges Ali with forcibly assaulting the victim while she was engaged in official duties.

If convicted, Ali faces a maximum penalty of three years in prison for the civil rights count and eight years in prison for the assault count. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

Assistant Attorney General Kristen Clarke of the Justice Department’s Civil Rights Division, U.S. Attorney Philip R. Sellinger for the District of New Jersey and Special Agent in Charge Matthew Modafferi of the U.S. Postal Service Office of Inspector General made the announcement.

The U.S. Postal Service Office of Inspector General is investigating the case.

Trial Attorneys Laura Gilson and Chloe Neely of the Civil Rights Division’s Criminal Section and Assistant U.S. Attorneys Joseph Gribko and Javon Henry for the District of New Jersey are prosecuting the case.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Source: United States Department of Justice Criminal Division

The Justice Department unsealed criminal charges today against Evgenii Ptitsyn, 42, a Russian national, for allegedly administering the sale, distribution, and operation of Phobos ransomware. Ptitsyn made his initial appearance in the U.S. District Court for the District of Maryland on Nov. 4 after being extradited from South Korea. Phobos ransomware, through its affiliates, victimized more than 1,000 public and private entities in the United States and around the world, and extorted ransom payments worth more than $16 million dollars.

“The Justice Department is committed to leveraging the full range of our international partnerships to combat the threats posed by ransomware like Phobos,” said Deputy Attorney General Lisa Monaco. “Evgenii Ptitsyn allegedly extorted millions of dollars of ransom payments from thousands of victims and now faces justice in the United States thanks to the hard work and ingenuity of law enforcement agencies around the world — from the Republic of Korea to Japan to Europe and finally to Baltimore, Maryland. Together with our partners across the globe, we will continue to hold cybercriminals accountable and protect innocent victims.”

“The indictment alleges that Ptitsyn and his co-conspirators ran the Phobos ransomware group, whose members committed ransomware attacks against more than 1,000 public and private victims throughout the United States and the rest of the world,” said Principal Deputy Assistant Attorney General Nicole M. Argentieri, head of the Justice Department’s Criminal Division. “Ptitsyn and his co-conspirators hacked not only large corporations but also schools, hospitals, nonprofits, and a federally recognized tribe, and they extorted more than $16 million in ransom payments. Ptitsyn’s indictment, arrest, and extradition reflect the Criminal Division’s commitment to leading the fight against the international scourge of ransomware. We are especially grateful to our domestic and foreign law enforcement partners, like South Korea, whose collaboration is essential to disrupting and deterring the most significant cybercriminal threats facing the United States.”

“It’s only a matter of time, cybercriminals will be caught and brought to justice,” said U.S. Attorney Erek L. Barron for the District of Maryland. “According to the indictment, Ptitsyn facilitated the worldwide use of a dangerous ransomware strain to target corporations and various organizations, including government agencies, healthcare facilities, educational institutions, and critical infrastructure. The U.S. Attorney’s Office for the District of Maryland is committed to bringing cybercriminals to justice and working with the private sector and the academic community to prevent and disrupt their activities.”

“The FBI is working tirelessly to ensure that ransomware actors, both developers and affiliates, face the consequences of their actions,” said Assistant Director Bryan Vorndran of the FBI’s Cyber Division. “We know it takes strong partnerships to disrupt cybercriminal networks, and the FBI must thank our partners for the important roles they play in carrying out this mission. The extradition announced today would not have been possible without their assistance.”

As alleged in the indictment, beginning in at least November 2020, Ptitsyn and others conspired to engage in an international computer hacking and extortion scheme that victimized public and private entities through the deployment of Phobos ransomware.

As part of the scheme, Ptitsyn and his co-conspirators allegedly developed and offered access to Phobos ransomware to other criminals or “affiliates” for the purposes of encrypting victims’ data and extorting ransom payments from victims. The administrators operated a darknet website to coordinate the sale and distribution of Phobos ransomware to co-conspirators and used online monikers to advertise their services on criminal forums and messaging platforms. At relevant times, Ptitsyn allegedly used the monikers “derxan” and “zimmermanx.”

Affiliates would then allegedly hack into the victims’ computer networks, often using stolen or otherwise unauthorized credentials; copy and steal files and programs on the victims’ networks; and encrypt the original versions of the stolen data on the networks by installing and executing Phobos ransomware. Affiliates then extorted the victims for ransom payments in exchange for the decryption keys to regain access to encrypted data by leaving ransom notes on compromised victims’ computers and by calling and emailing victims to initiate the ransom payment negotiations. Affiliates also threatened to expose victims’ stolen files to the public or to the victims’ clients, customers, or constituents if the ransoms were not paid.

After a successful Phobos ransomware attack, criminal affiliates paid fees to Phobos administrators like Ptitsyn for a decryption key to regain access to the encrypted files. Each deployment of Phobos ransomware was assigned a unique alphanumeric string in order to match it to the corresponding decryption key, and each affiliate was directed to pay the decryption key fee to a cryptocurrency wallet unique to that affiliate. From December 2021 to April 2024, the decryption key fees were then transferred from the unique affiliate cryptocurrency wallet to a wallet controlled by Ptitsyn.

Ptitsyn is charged in a 13-count indictment with wire fraud conspiracy, wire fraud, conspiracy to commit computer fraud and abuse, four counts of causing intentional damage to protected computers, and four counts of extortion in relation to hacking. If convicted, Ptitsyn faces a maximum penalty of 20 years in prison for each wire fraud count; 10 years in prison for each computer hacking count; and five years in prison for conspiracy to commit computer fraud and abuse. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

The FBI Baltimore Field Office is investigating the case. The Justice Department’s Office of International Affairs worked with the International Criminal Affairs Division of the Korean Ministry of Justice to secure the arrest and extradition of Ptitsyn. The Justice Department extends its thanks to international judicial and law enforcement partners in South Korea, the United Kingdom, Japan, Spain, Belgium, Poland, Czech Republic, France, and Romania, as well as Europol and the U.S. Department of Defense Cyber Crime Center, for their cooperation and coordination with the Phobos ransomware investigation. The Justice Department’s National Security Division also provided valuable assistance.

Senior Counsel Aarash A. Haghighat of the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorneys Aaron S.J. Zelinsky and Thomas M. Sullivan for the District of Maryland are prosecuting the case. CCIPS Trial Attorney Riane Harper and former Assistant U.S. Attorney Jeffrey J. Izant for the District of Maryland provided substantial assistance.

Additional details on protecting networks against Phobos ransomware are available at StopRansomware.gov, including Cybersecurity and Infrastructure Security Agency Advisory AA24-060A.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.