Security News: High-Ranking Affiliate of Sinaloa Cartel Charged with Drug Conspiracy in Chicago

Source: United States Department of Justice 2

A grand jury in Chicago returned an indictment yesterday charging a high-ranking affiliate of the Sinaloa Cartel for allegedly manufacturing and distributing fentanyl, cocaine, heroin, and other drugs and importing them into the United States.

“As alleged, the defendant conspired to traffic dangerous drugs, including fentanyl, into the United States — and employed dozens of gunmen to protect his drug trafficking operation and the leadership of the Guzman faction of the Sinaloa Cartel,” said Supervisory Official Antoinette T. Bacon of the Justice Department’s Criminal Division. “Stopping Mexican cartels from poisoning our communities with fentanyl and other narcotics is a top priority of this Administration. Today’s indictment demonstrates that the Criminal Division is relentless in its pursuit of the drug traffickers who profit at the expense of the American people.”

“Our nation’s fentanyl crisis has devastated individuals and families in northern Illinois and throughout the country,” said Acting U.S. Attorney Morris Pasqual for the Northern District of Illinois. “Our office will continue to work with our law enforcement partners to disrupt the production and trafficking of fentanyl and other dangerous narcotics before they can reach more victims.”

“From San Diego to Chicago to D.C., we are united to bring down the traffickers pushing these poisons into American communities,” said U.S. Attorney Tara McGrath for the Southern District of California. “We are attacking at every level — from street dealers to cartel leaders.”

“This indictment reinforces the FBI’s unwavering commitment to hold accountable those who endanger our communities and traffic violence and drugs across our borders,” said Assistant Director Chad Yarbrough of the FBI’s Criminal Investigative Division. “Let this serve as a clear message: if you engage in cartel activity, we will pursue you and bring you to justice. Together with our law enforcement partners at every level, we remain fully committed to protecting the American people and stopping the flow of these dangerous drugs into our nation.”

According to court documents, Ceferino Espinoza Angulo, 43, employed dozens of gunmen in Mexico to protect and support the leadership of the Guzman faction of the Sinaloa Cartel, including Ivan Guzman-Salazar, Jesus Alfredo Guzman-Salazar, Ovidio Guzman-Lopez, and Joaquin Guzman-Lopez, collectively known as “the Chapitos.” Espinoza Angulo allegedly conspired to obtain fentanyl precursor chemicals and to manufacture, distribute, and import into the United States fentanyl, cocaine, heroin, methamphetamine, and ecstasy. Ceferino Espinoza also allegedly illegally possessed a machinegun in furtherance of his drug trafficking scheme.

The Chapitos are the sons of Joaquin Guzman Loera, also known as “El Chapo,” who led the Sinaloa Cartel before being convicted by a federal jury in Brooklyn, New York, and sentenced to life in prison. The Chapitos allegedly assumed their father’s role as leaders of the Sinaloa Cartel. The Chapitos have been charged with drug trafficking in other U.S. indictments.

Espinoza Angulo is charged with drug conspiracy and firearm offenses. If convicted, he faces a mandatory minimum penalty of 30 years in prison and a maximum penalty of life in prison. Espinoza Angulo is believed to be residing in Mexico, and a U.S. warrant has been issued for his arrest.

The FBI and Homeland Security Investigations investigated the case. Valuable assistance was provided by the Drug Enforcement Administration’s Special Operations Division, Bilateral Investigations Unit, and the Portland, Oregon, Police Bureau, Narcotics and Organized Crime Unit, High Intensity Drug Trafficking Areas Interdiction Taskforce.

Trial Attorney Kirk Handrich of the Criminal Division’s Narcotic and Dangerous Drug Section, Assistant U.S. Attorneys Michelle Parthum and Andrew C. Erskine for the Northern District of Illinois, and Assistant U.S. Attorney Matthew Sutton for the Southern District of California prosecuted the case.

The case is part of an Organized Crime Drug Enforcement Task Force (OCDETF) operation. OCDETF identifies, disrupts, and dismantles drug trafficking organizations and other criminal networks that threaten the United States using a prosecutor-led, intelligence-driven, multi-agency approach that leverages the strengths of federal, state, and local enforcement agencies.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

New York Man Indicted for Role in Estranged Husband’s Murder in Brazil

Source: United States Department of Justice Criminal Division

A New York man was arrested and charged in a superseding indictment unsealed today in the Southern District of New York for hiring someone to kill his estranged husband, who was murdered in Rio de Janeiro in January 2024. Sikkema made his initial court appearance on the superseding indictment today in the Southern District of New York.

According to court documents, beginning in 2023, Daniel Sikkema, 54, of New York City, offered another individual (CC-1) money in exchange for CC-1 killing Sikkema’s estranged husband, with whom Sikkema was involved in contentious divorce proceedings. The victim, who was a U.S. citizen, had amassed a multi-million-dollar estate and often traveled to Rio de Janeiro where he maintained property. In advance of the victim’s murder, Sikkema sent CC-1 money using a stolen identity and intermediaries in an effort to conceal the source of the payments.

The victim was murdered by CC-1 on Jan. 14, 2024.

Sikkema is charged with one count of conspiracy to commit a murder-for-hire, one count of murder-for-hire, one count of conspiracy to murder a person in a foreign county, and one count of passport fraud. If convicted, he faces a mandatory penalty of life in prison or death. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

Supervisory Official Antoinette T. Bacon of the Justice Department’s Criminal Division, U.S. Attorney Danielle R. Sassoon for the Southern District of New York, and Assistant Director in Charge James E. Dennehy of the FBI New York Field Office made the announcement.

The FBI investigated the case.

Trial Attorney Chelsea Schinnour of the Criminal Division’s Human Rights and Special Prosecutions Section and Assistant U.S. Attorneys Meredith Foster and Remy Grosbard for the Southern District of New York are prosecuting the case.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

California Teenager Sentenced to 48 Months in Prison for Nationwide Swatting Spree

Source: United States Department of Justice Criminal Division

Alan W. Filion, 18, of Lancaster, California, was sentenced today to 48 months in prison for making interstate threats to injure the person of another.

According to the plea agreement, from approximately August 2022 to January 2024, Filion made over 375 swatting and threat calls, including calls in which he claimed to have planted bombs in the targeted locations or threatened to detonate bombs and/or conduct mass shootings at those locations. Filion targeted religious institutions, high schools, colleges and universities, government officials, and numerous individuals across the United States.

Filion intended his calls to cause large-scale deployment of police and emergency services units to the targeted locations. During these calls, he provided information to law enforcement and emergency services agencies that he knew to be false, such as false names, false claims that he and others had placed explosives in particular locations, false claims that he and others possessed dangerous weapons, including firearms and explosives, and false claims that he and other individuals had committed, or intended to imminently commit, violent crimes.

In some instances, armed law enforcement officers approached and entered a targeted residence with their weapons drawn and detained individuals that occupied the residence. Indeed, Filion claimed in a post on Jan. 20, 2023, that when he swats someone, he “usually get[s] the cops to drag the victim and their families out of the house cuff them and search the house for dead bodies.” Additionally, Filion’s calls caused law enforcement officers and dispatchers to respond, and to be unavailable in response to other emergencies.

Filion became a serial swatter for both profit and recreation. He claimed in a Jan. 19, 2023, online post that his “first” swatting was like “2 to 3 years ago” and that “6-9 months ago [he] decided to turn it into a business. . .” On several occasions, Filion placed posts on social media channels advertising his services and swatting-for-a-fee structure.

On Jan.18, 2024, Filion was arrested in California on Florida state charges arising from a May 2023 threat he made to a religious institution in Sanford, Florida. In that threat, he claimed to have an illegally modified AR-15, a Glock 17 pistol, pipe bombs, and Molotov cocktails. He said that he was going to imminently “commit a mass shooting” and “kill everyone” he saw. He pleaded guilty in federal court to making that threat.

Filion also pleaded guilty to making three other threatening calls: an October 2022 call to a public high school in the Western District of Washington, in which he threatened to commit a mass shooting and claimed to have planted bombs throughout the school; a May 2023 call to a Historically Black College or University in the Northern District of Florida, in which he claimed to have placed bombs in the walls and ceilings of campus housing that would detonate in about an hour; and a July 2023 call to a local police department dispatch number in the Western District of Texas, in which he falsely identified himself as a senior federal law enforcement officer, provided the federal law-enforcement officer’s residential address to the dispatcher, claimed to have killed the federal officer’s mother, and threatened to kill any responding police officers.

The FBI and U.S. Secret Service investigated the case, with valuable assistance provided by the Seminole County (Florida) Sheriff’s Office; the Anacortes (Washington) Police Department; the Florida Department of Law Enforcement; the California Department of Justice; the Los Angeles County (California) Sheriff’s Office; and the Volusia County (Florida) Sheriff’s Office.

Assistant U.S. Attorney Kara Wick for the Middle District of Florida prosecuted the case, with valuable assistance from the National Security Division’s Counterterrorism Section; the State Attorney’s Office for Seminole County, Florida, 18th Judicial Circuit; and the U.S. Attorneys’ Offices for the Western District of Washington, Northern District of Florida, Western District of Texas, and District of Columbia. 

Phobos Ransomware Affiliates Arrested in Coordinated International Disruption

Source: United States Department of Justice Criminal Division

Note: View the superseding indictment here.

Phobos Group Alleged to have Attacked Over 1,000 Victims Worldwide

The Justice Department today unsealed criminal charges against Roman Berezhnoy, 33, and Egor Nikolaevich Glebov, 39, both Russian nationals, who allegedly operated a cybercrime group using the Phobos ransomware that victimized more than 1,000 public and private entities in the United States and around the world and received over $16 million in ransom payments. Berezhnoy and Glebov were arrested this week as part of a coordinated international disruption of their organization, which includes additional arrests and the technical disruption of the group’s computer infrastructure.

From May 2019, through at least October 2024, Berezhnoy, Glebov, and others allegedly caused victims to suffer losses resulting from the loss of access to their data in addition to the financial losses associated with the ransomware payments. The victims included a children’s hospital, health care providers, and educational institutions.

8Base Seizure Banner

According to court documents, Berezhnoy, Glebov, and others operated a ransomware affiliate organization, including under the names “8Base” and “Affiliate 2803,” among others, that victimized public and private entities through the deployment of Phobos ransomware.

As part of the scheme, Berezhnoy, Glebov, and others allegedly hacked into victim computer networks, copied and stole files and programs on the victims’ network, and encrypted the original versions of the stolen data with Phobos ransomware. The conspirators then allegedly extorted the victims for ransom payments in exchange for the decryption keys to regain access to the encrypted data by, among other things, leaving a ransom note on compromised victim computers and separately reaching out to victims to initiate ransom payment negotiations.

As alleged, the conspirators also threatened to expose victims’ stolen files to the public or to the victims’ clients, customers, or constituents if the ransoms were not paid. The conspirators are further alleged to have established and operated a darknet website where they repeated their extortionate threats and ultimately published the stolen data if a victim failed to pay the ransom.

After a successful Phobos ransomware attack, criminal affiliates paid fees to Phobos administrators for a decryption key to regain access to the encrypted files. Each deployment of Phobos ransomware was assigned a unique alphanumeric string in order to match it to the corresponding decryption key, and each affiliate was directed to pay the decryption key fee to a cryptocurrency wallet unique to that affiliate.

The charges unsealed today against Berezhnoy and Glebov follow the recent arrest and extradition of Evgenii Ptitsyn, a Russian national, on charges relating to his alleged administration of the Phobos ransomware variant.

In parallel with this week’s arrests, Europol and German authorities have announced an international operation involving the FBI and other international law enforcement partners to disrupt over 100 servers associated with this criminal network.

Berezhnoy and Glebov are charged in an 11-count indictment with one count of wire fraud conspiracy, one count of wire fraud, one count of conspiracy to commit computer fraud and abuse, three counts of causing intentional damage to protected computers, three counts of extortion in relation to damage to a protected computer, one count of transmitting a threat to impair the confidentiality of stolen data, and one count of unauthorized access and obtaining information from a protected computer. If convicted, Berezhnoy and Glebov face a maximum penalty of 20 years in prison on each wire fraud-related count; 10 years in prison on each computer damage count; and five years in prison on each of the other counts. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

Supervisory Official Antoinette T. Bacon of the Justice Department’s Criminal Division, U.S. Attorney Erek L. Barron for the District of Maryland, Assistant Director Bryan Vorndran of the FBI’s Cyber Division, and Special Agent in Charge William J. DelBagno of the FBI Baltimore Field Office made the announcement.

The FBI Baltimore Field Office is investigating the case. The Justice Department extends its thanks to international judicial and law enforcement partners in the United Kingdom, Germany, Japan, Spain, Belgium, Poland, Czech Republic, France, Thailand, Finland, and Romania, as well as Europol and the U.S. Department of Defense Cyber Crime Center, for their cooperation and coordination with the Phobos ransomware investigation. The National Security Division’s National Security Cyber Section and the Justice Department’s Office of International Affairs also provided valuable assistance.

Senior Counsel Aarash A. Haghighat of the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorney Thomas M. Sullivan for the District of Maryland are prosecuting the case. Former CCIPS Trial Attorney Riane Harper and former Assistant U.S. Attorneys Aaron S.J. Zelinsky and Jeffrey J. Izant for the District of Maryland provided substantial assistance.

Additional details on protecting networks against Phobos ransomware are available at StopRansomware.gov, including Cybersecurity and Infrastructure Security Agency Advisory AA24-060A.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

New Jersey CPA Sentenced in Syndicated Conservation Easement Tax Scheme

Source: United States Department of Justice

A New Jersey accountant was sentenced today to 24 months in prison for his role in the promotion and sale of abusive syndicated conservation easement tax shelters.

According to court documents and statements made in court, Ralph Anderson was a CPA and return preparer working for accounting firms in New Jersey and New York. From approximately 2013 to 2019, Anderson promoted and sold tax deductions to his high-income clients in the form of units in illegal syndicated conservation easement tax shelters created by convicted co-conspirators Jack Fisher and James Sinnott.

Anderson knew that, contrary to law, the transactions related to these illegal tax shelters lacked economic substance and that his high-income clients purchased units at his recommendation only to obtain a tax deduction on their tax returns. The charitable deductions purchased by clients were derived from the donation of land with a conservation easement or the land itself to a charity, and the deductions were based on fraudulently inflated appraisals for the donated land. Anderson and the promoters promised the clients a so-called ratio of “4.5 to 1” in charitable deductions for every dollar paid into the tax shelter.

In some instances, to make it appear that his clients had joined the partnerships before the date of the conservation easement donation — which was necessary to claim the tax benefits — Anderson and his co-conspirators also instructed and caused clients to falsely backdate documents, including subscription agreements and checks related to the partnerships. Each year from 2013 to 2019, Anderson and his co-conspirators assisted clients with claiming these false deductions on their tax returns.

In total, Anderson assisted in preparing tax returns for clients that claimed over $9.3 million in false charitable deductions based on backdated documents, which caused a tax loss to the United States of nearly $3 million.

Between approximately 2016 and 2019, Anderson earned over $300,000 in commissions for promoting and selling the illegal tax shelters to his clients. Anderson also claimed false tax deductions for charitable contributions generated from the syndicated conservation easement tax shelters he received as “free units” on his own returns and fraudulently reduced his own taxes on the income he earned from the scheme.

In addition to his prison sentence, U.S. District Court Judge Michael A. Shipp for the District of New Jersey ordered Anderson to serve three years of supervised release and to pay $3,543,005.53 in total restitution to the IRS and Small Business Administration.

After being convicted on all counts after a trial in U.S. District Court for the Northern District of Georgia, Anderson’s co-conspirators, Jack Fisher and James Sinnott, were sentenced to 25 and 23 years in prison, respectively. Nine additional defendants pleaded guilty to criminal conduct related to the syndicated conservation easement tax shelter scheme. These other defendants include appraiser Walter Douglas “Terry” Roberts and Certified Public Accountants Stein Agee, Corey Agee, James Benkoil, Victor Smith, Herbert Lewis and William Tomasello. In addition, attorneys Randall Lenz and Vi Bui pleaded guilty to their roles in this scheme. The fraudulent syndicated conservation easement tax shelter scheme created and promoted by Fisher and Sinnott resulted in over $1.3 billion in fraudulent tax deductions and caused over $400 million in total tax loss to the IRS.

Acting Deputy Assistant Attorney General Karen E. Kelly of the Justice Department’s Tax Division and Chief Guy Ficco of IRS Criminal Investigation (IRS-CI) made the announcement.

IRS-CI and the U.S. Postal Inspection Service investigated the case.

Senior Litigation Counsel Richard M. Rolwing and Trial Attorneys Parker Tobin and Jessica Kraft of the Tax Division prosecuted the case with assistance from former Tax Division Trial Attorney Nicholas Schilling and support from the U.S. Attorney’s Office for the Northern District of Georgia.