CEO of Dozens of Companies and Entities Charged in Scheme to Traffic an Estimated $1 Billion in Fraudulent and Counterfeit Cisco Networking Equipment

A federal grand jury in the District of New Jersey returned an indictment last week charging a resident of Florida with running a massive operation over many years to traffic in fraudulent and counterfeit Cisco networking equipment with an estimated retail value of over $1 billion.

According to the indictment, Onur Aksoy, aka Ron Aksoy, aka Dave Durden, 38, of Miami, allegedly ran at least 19 companies formed in New Jersey and Florida as well as at least 15 Amazon storefronts, at least 10 eBay storefronts, and multiple other entities (collectively, the “Pro Network Entities”) that imported tens of thousands of fraudulent and counterfeit Cisco networking devices from China and Hong Kong and resold them to customers in the United States and overseas, falsely representing the products as new and genuine. The operation allegedly generated over $100 million in revenue, and Aksoy received millions of dollars for his personal gain.

According to the indictment, the devices the Pro Network Entities imported from China and Hong Kong were typically older, lower-model products, some of which had been sold or discarded, which Chinese counterfeiters then modified to appear to be genuine versions of new, enhanced, and more expensive Cisco devices. As alleged, the Chinese counterfeiters often added pirated Cisco software and unauthorized, low-quality, or unreliable components – including components to circumvent technological measures added by Cisco to the software to check for software license compliance and to authenticate the hardware. Finally, to make the devices appear new, genuine, high-quality, and factory-sealed by Cisco, the Chinese counterfeiters allegedly added counterfeited Cisco labels, stickers, boxes, documentation, packaging, and other materials.

The fraudulent and counterfeit products sold by the Pro Network Entities suffered from numerous performance, functionality, and safety problems. Often, they would simply fail or otherwise malfunction, causing significant damage to their users’ networks and operations – in some cases, costing users tens of thousands of dollars. Customers of Aksoy’s fraudulent and counterfeit devices included hospitals, schools, government agencies, and the military.

As set forth in the indictment, between 2014 and 2022, Customs and Border Protection (CBP) seized approximately 180 shipments of counterfeit Cisco devices being shipped to the Pro Network Entities from China and Hong Kong. In response to some of these seizures, Aksoy allegedly falsely submitted official paperwork to CBP under the alias “Dave Durden,” an identity that he used to communicate with Chinese co-conspirators. To try to avoid CBP scrutiny, Chinese co-conspirators allegedly broke the shipments up into smaller parcels and shipped them on different days, and Aksoy used at least two fake delivery addresses in Ohio. After CBP seized a shipment of counterfeit Cisco products to Aksoy and the Pro Network Entities and sent a seizure notice, Aksoy allegedly often continued to order counterfeit Cisco products from the same supplier.

According to the indictment, between 2014 and 2019, Cisco sent seven letters to Aksoy asking him to cease and desist his trafficking of counterfeit goods. Aksoy allegedly responded to at least two of these letters by causing his attorney to provide Cisco with forged documents. In July 2021, agents executed a search warrant at Aksoy’s warehouse and seized 1,156 counterfeit Cisco devices with a retail value of over $7 million.

Aksoy is charged with one count of conspiracy to traffic in counterfeit goods and to commit mail and wire fraud; three counts of mail fraud; four counts of wire fraud; and three counts of trafficking in counterfeit goods. Aksoy was charged by a criminal complaint filed in New Jersey on June 29 and was arrested in Miami the same day.

Assistant Attorney General Kenneth A. Polite, Jr. of the Justice Department’s Criminal Division; Attorney for the United States Vikas Khanna of the District of New Jersey; Acting Special Agent in Charge Eddy Wang of the Homeland Security Investigations (HSI) Los Angeles Field Office; Special Agent in Charge Bryan Denny of the U.S. Department of Defense, Defense Criminal Investigative Service (DCIS) Western Field Office; Special Agent in Charge Floyd Martinez of the General Services Administration Office of Inspector General (GSA-OIG), Southeast and Caribbean Division; Special Agent in Charge Peter Tolentino of the Naval Criminal Investigative Service (NCIS), Economic Crimes Field Office; Special Agent in Charge Anthony Salisbury of the HSI Miami Field Office; and Special Agent in Charge Jason Molina of the HSI Newark Field Office made the announcement today.

The CBP Electronics Center of Excellence; the CBP Los Angeles National Targeting and Analysis Center; and the CBP Office of Trade, Regulatory Audit and Agency Advisory Services, Miami Field Office provided valuable assistance.

If you believe you are a victim of Aksoy or the Pro Network Entities, please visit www.justice.gov/largecases or https://edit.justice.gov/usao-nj/united-states-v-onur-aksoy-pro-network for more information.

The Pro Network Entities include at least the following:

Pro Network Companies	Approximate Month and Year of Formation	State of Formation
Pro Network LLC	August 2013	New Jersey
Netech Solutions LLC	November 2016	Florida
Target Network Solutions LLC	January 2017	Florida
Easy Network LLC	April 2017	New Jersey
ACE NETUS LLC (aka Ace Network)	April 2017	New Jersey
My Network Dealer LLC	April 2017	New Jersey
1701 Doral LLC	May 2017	New Jersey
Maytech Trading LLC	August 2017	Florida
NFD Trading LLC	September 2017	Florida
Kenet Solutions LLC	September 2017	Florida
Team Tech Global LLC	January 2018	New Jersey
Tenek Trading LLC	January 2018	Florida
The Network Gears LLC	February 2018	Florida
All Networking Solutions LLC (aka All Network)	April 2018	Florida
San Network LLC	October 2018	Florida
Pro Network US Inc.	January 2019	Florida
Jms Tek LLC	August 2019	Florida
Renewed Equipment LLC	August 2021	Florida
Pro Ship US LLC	August 2021	Florida

 

Pro Network Amazon Storefronts	Approximate Date of Earliest Known Activity
Albus Trade Hub	January 2014
EasyNetworkUS	March 2014
Get Better Trade	July 2015
Mercadeal	February 2017
Netech Solutions	February 2018
Netkco LLC	September 2014
NFD Trading LLC	January 2018
Palm Network Solutions	June 2017
Renewed Equip	August 2017
Servtaur	August 2019
Smart Network	July 2017
SOS Tech Trade	August 2017
Target-Solutions	September 2020
TeamTech Global	March 2016
TradeOrigin US	August 2015

 

Pro Network eBay Storefronts	Approximate Date of Earliest Known Activity
connectwus	March 2014
futuretechneeds	July 2017
getbettertrade	July 2017
getontrade	April 2016
maytechtradingllc	October 2017
netechsolutions	April 2017
netkco	September 2014
nfdtrading	February 2018
smartnetworkusa	January 2014
tenektradingllc	May 2018

HSI, DCIS, GSA-OIG, NCIS, and CBP are investigating the case.

Senior Counsel Matthew A. Lamberti of the Criminal Division’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Andrew M. Trombly and Senior Trial Counsel Barbara Ward of the District of New Jersey are prosecuting the case.

An indictment is merely an allegation, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Press release distributed by the DOJ.

Featured image: by Got Credit is marked with CC BY 2.0.

A federal jury convicted a New York man this week in an over $600 million health care fraud, wire fraud, and identity theft scheme.

According to court documents and evidence presented at trial, Mathew James, 54, of East Northport, operated a medical billing company that billed for procedures that were either more serious or entirely different than those James’ doctor-clients performed.  James directed his doctor-clients to schedule elective surgeries through the emergency room so that insurance companies would reimburse at substantially higher rates. When insurance companies denied the inflated claims, James impersonated patients to demand that the insurance companies pay the outstanding balances of tens or hundreds of thousands of dollars.

“James orchestrated a fraudulent medical billing scheme to steal from insurance companies and businesses, in order to line his own pockets,” said Assistant Attorney General Kenneth A. Polite, Jr. of the Justice Department’s Criminal Division. “This conviction shows that medical billers who fuel health care fraud will be brought to justice.”

“The defendant stands convicted of carrying out an audacious scheme in which he used insurance companies like ATM machines. He stole hundreds of millions of dollars until he was finally exposed by a paper trail a mile-long, phone recordings on which he impersonated patients, and text messages and emails with his co-conspirator doctor clients demonstrating his nefarious billing practices. For this massive fraud, a federal jury convicted him today,” said U.S. Attorney Breon Peace for the Eastern District of New York. “Health care fraud is not a victimless crime, because fraudulent billing ultimately affects consumers who must pay the cost of higher insurance premiums.”

“Health care fraud, including fraudulent billing schemes like this, costs U.S. taxpayers tens of billions of dollars annually. These crimes impact all of us in many ways, including increased health insurance premiums, greater out-of-pocket expenses and copayment amounts for medical treatment, and reduced or lost benefits, just to name a few,” said Assistant Director Luis Quesada of the FBI’s Criminal Investigative Division. “The FBI, together with our law enforcement partners, is committed to rooting out health care fraud in all its forms and bringing those who seek to exploit our health care system to justice.”

James was convicted of conspiracy to commit health care fraud, health care fraud, three counts of wire fraud, and three counts of aggravated identity theft. He is scheduled to be sentenced at a later date and faces up to 10 years in prison for health care fraud conspiracy, up to 10 years in prison for health care fraud, up to 20 years in prison for each of three wire fraud counts, and a two year mandatory minimum each for three aggravated identity theft counts. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

The FBI investigated the case.

Acting Assistant Chief Miriam Glaser Dauermann of the Criminal Division’s Fraud Section and Assistant U.S. Attorneys Catherine Mirabile and Antoinette Rangel of the Eastern District of New York are prosecuting the case.

The Fraud Section leads the Criminal Division’s efforts to combat health care fraud through the Health Care Fraud Strike Force Program. Since March 2007, this program, comprised of 15 strike forces operating in 24 federal districts, has charged more than 4,200 defendants who collectively have billed the Medicare program for more than $19 billion. In addition, the Centers for Medicare & Medicaid Services, working in conjunction with the Office of the Inspector General for the Department of Health and Human Services, are taking steps to hold providers accountable for their involvement in health care fraud schemes. More information can be found at https://www.justice.gov/criminal-fraud/health-care-fraud-unit.

Press release distributed by the DOJ.

Featured image: by sandiegopersonalinjuryattorney is marked with CC BY-SA 2.0.

The Department of Justice, together with federal law enforcement partners, has announced criminal charges against six defendants in four separate cases for their alleged involvement in cryptocurrency-related fraud, including the largest known Non-Fungible Token (NFT) scheme charged to date, a fraudulent investment fund that purportedly traded on cryptocurrency exchanges, a global Ponzi scheme involving the sale of unregistered crypto securities, and a fraudulent initial coin offering.

“The Department of Justice and our partners are dedicated to using every available tool to protect consumers and investors from fraud and manipulation,” said Assistant Attorney General Kenneth A. Polite, Jr. of the Justice Department’s Criminal Division. “These indictments reflect our deep commitment to prosecuting individuals involved in cryptocurrency fraud and market manipulation.”

“Our office is committed to protecting investors from sophisticated scammers seeking to capitalize on the relative novelty of digital currency,” said U.S. Attorney Juan Antonio Gonzalez for the Southern District of Florida. “As with any emerging technology, those who invest in cryptocurrency must beware of profit-making opportunities that appear too good to be true.”

“These cases serve as a crucial reminder that some con artists hide behind trendy buzzwords, but at the end of the day they are simply seeking to separate people from their money,” said U.S. Attorney Tracy L. Wilkison for the Central District of California. “We will continue to work with our law enforcement partners to educate and protect potential investors about both traditional and trendy investments.”

“As cryptocurrency marketplaces advance and offer new opportunities for consumers, criminals also seek ways to exploit them,” said Assistant Director Luis Quesada of the FBI’s Criminal Investigative Division. “The FBI, alongside our law enforcement partners, will continue to investigate and bring those criminals to justice, and to protect the American people.”

“This investigation and prosecution exemplifies the importance of public-private partnerships,” said Executive Associate Director Steve K. Francis of Homeland Security Investigations (HSI). “As a result of our strong relationships with industry partners, HSI received information leading to this investigation and ultimate indictment. HSI will continue to investigate criminal organizations operating in emerging technologies and are proud to have worked with the Department of Justice Fraud Section to put an end to this criminal activity.”

The following charges are announced today as a part of this national enforcement action.

Crypto NFT Scheme:

United States v. Le Ahn Tuan:

Le Anh Tuan, 26, a Vietnamese national, was charged with one count of conspiracy to commit wire fraud and one count of conspiracy to commit international money laundering in the Central District of California in connection with a scheme involving the “Baller Ape” NFT. As alleged in the indictment, Tuan was involved in the Baller Ape Club, an NFT investment project that purportedly sold NFTs in the form of various cartoon figures, often including the figure of an ape. According to the indictment, shortly after the first day Baller Ape Club NFTs were publicly sold, Tuan and his co-conspirators engaged in what is known as a “rug pull,” ending the purported investment project, deleting its website, and stealing the investors’ money. Based on blockchain analytics, shortly after the rug pull, Tuan and his co-conspirators laundered investors’ funds through “chain-hopping,” a form of money laundering in which one type of coin is converted to another type and funds are moved across multiple cryptocurrency blockchains, and used decentralized cryptocurrency swap services to obscure the trail of Baller Ape investors’ stolen funds. In total, Tuan and his co-conspirators obtained approximately $2.6 million from investors. If convicted of all counts, Tuan faces up to 40 years in prison. HSI is investigating the case. Fraud Section Trial Attorneys Kevin Lowell and Tian Huang are prosecuting the case.

Crypto Ponzi and Unregistered Securities Scheme:

United States v. Emerson Pires, Flavio Goncalves, and Joshua David Nicholas:

Emerson Pires, 33, and Flavio Goncalves, 33, both of Brazil, and Joshua David Nicholas, 28, of Stuart, Florida, were each charged in the Southern District of Florida with one count of conspiracy to commit wire fraud and one count of conspiracy to commit securities fraud in connection with a global cryptocurrency-based Ponzi scheme that generated approximately $100 million from investors. Pires and Goncalves also were charged with conspiracy to commit international money laundering. The indictment alleges that Pires and Goncalves, both founders of EmpiresX, along with Nicholas, the so-called “Head Trader” for EmpiresX, fraudulently promoted EmpiresX, a cryptocurrency investment platform and unregistered securities offering, by making numerous misrepresentations regarding, among other things, a purported proprietary trading bot and fraudulently guaranteeing returns to investors and prospective investors in EmpiresX. As alleged in the indictment, blockchain analytics shows that Pires and Goncalves then laundered investors’ funds through a foreign-based cryptocurrency exchange and operated a Ponzi scheme by paying earlier investors with money obtained from later EmpiresX investors. If convicted of all counts, Pires and Goncalves face up to 45 years in prison and Nicholas faces up to 25 years in prison. FBI and HSI are investigating the case. Fraud Section Trial Attorneys Kevin Lowell and Sara Hallmark and Assistant U.S. Attorney Yisel Valdes of the U.S. Attorney’s Office for the Southern District of Florida are prosecuting the case.

Crypto Initial Coin Offering Scheme:

United States v. Michael Alan Stollery:

Michael Alan Stollery, 54, of Reseda, California, was the CEO and founder of Titanium Blockchain Infrastructure Services (TBIS), a purported cryptocurrency investment platform. Stollery was charged in an information filed in the Central District of California with one count of securities fraud for his role in a cryptocurrency fraud scheme involving TBIS’s initial coin offering, which raised approximately $21 million from investors in the United States and overseas. As alleged, in order to lure investors, Stollery falsified TBIS white papers (a document for prospective investors that typically explains how the technology underlying the cryptocurrency works and the purpose of the cryptocurrency project), planted fake testimonials on TBIS’s website, and fabricated purported business relationships with the U.S. Federal Reserve Board and dozens of prominent companies, including Apple Inc., Pfizer Inc., and The Walt Disney Company, to create the appearance of legitimacy. If convicted of all counts, Stollery faces up to 20 years in prison. The FBI and the Federal Reserve Board’s Western Region San Francisco Office are investigating the case. Fraud Section Trial Attorneys Kevin Lowell, Tian Huang, and Andrew Tyler are prosecuting the case.

“Those who fraudulently misrepresent their relationship with the Federal Reserve to deceive the public in cryptocurrency or other fraud schemes will be held accountable and brought to justice,” said Acting Special Agent in Charge Cory Nootnagel of the Office of Inspector General for the Board of Governors of the Federal Reserve System and the Bureau of Consumer Financial Protection, Western Region. “I commend our agents, their federal law enforcement partners, and the Justice Department’s Criminal Division’s Fraud Section for their hard work and persistence.”

Crypto Commodities Scheme:  

United States v. David Saffron:

David Saffron, 49, of Las Vegas, Nevada, was the owner of Circle Society, a cryptocurrency investment platform. Saffron used Circle Society to solicit investors to participate in an unregistered commodity pool, which is a fund that combines investors’ contributions to trade on the futures and commodity markets. Saffron was charged in the Central District of California with one count of conspiracy to commit wire fraud, four counts of wire fraud, one count of conspiracy to commit commodities fraud, and one count of obstruction of justice. As alleged in the indictment, Saffron falsely represented to investors that he traded investors’ funds to earn profits using a trading bot that could execute over 17,000 transactions per hour on various cryptocurrency exchanges. Saffron falsely represented that his trading bot would generate between 500% to 600% returns on the amount invested. To entice investors to invest, Saffron allegedly led investor meetings at luxury homes in the Hollywood Hills and elsewhere, and traveled with a team of armed security guards in order to create the false appearance of wealth and success. In total, Saffron fraudulently raised approximately $12 million from investors. If convicted of all counts, Saffron faces up to 115 years in prison. IRS Criminal Investigation (IRS-CI) is investigating the case. Fraud Section Trial Attorneys Kevin Lowell and Theodore Kneller, and Assistant U.S. Attorney James Hughes of the U.S. Attorney’s Office for the Central District of California are prosecuting the case.

“Mr. Saffron preyed on investor interest in cryptocurrency by enticing victims with fake technology and false promises of guaranteed returns,” said Special Agent in Charge Ryan L. Korner of the IRS-CI’s Los Angeles Field Office. “In reality, Mr. Saffron was operating an illegal Ponzi scheme to defraud victim investors and used the funds for his own personal benefit. IRS-CI will pursue and root out these schemes to protect investors, preserve our commodity markets, and bring financial fraudsters to justice.”

Crypto Fraud Victims:

All investor victims of the Baller Ape Club, EmpiresX, TBIS, and Circle Society schemes are encouraged to visit the webpage https://www.justice.gov/criminal-vns/crypto-enforcement to identify themselves as potential victims and obtain more information on their rights as victims, including the ability to submit a victim impact statement.

An indictment is merely an allegation, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Press release distributed by the DOJ.

Featured image: by Crypto360 is marked with CC BY 2.0.

A former Mississippi pharmacist was sentenced this week to 10 years in the Southern District of Mississippi for a multimillion-dollar scheme to defraud TRICARE and private insurance companies by paying kickbacks to distributors for the referral of medically unnecessary prescriptions. The conduct resulted in more than $180 million in fraudulent billings, including more than $50 million paid by federal health care programs.

According to court documents, Mitchell “Chad” Barrett, 55, now of Gulf Breeze, Florida, and formerly of Mississippi, participated in a scheme to defraud TRICARE and other health care benefit programs by distributing medically unnecessary compounded medications. Barrett was licensed as a pharmacist in Mississippi and was a co-owner of various compounding pharmacies. As part of this scheme, Barrett adjusted prescription formulas to ensure the highest reimbursement without regard to medical necessity. He solicited recruiters to procure prescriptions for high-margin compounded medications and paid those recruiters commissions based on the percentage of reimbursements paid by pharmacy benefit managers and health care benefit programs, including commissions on claims reimbursed by TRICARE. He further routinely and systematically waived and/or reduced copayments to be paid by beneficiaries and members, and utilized a purported copayment assistance program to falsely make it appear as if his pharmacy and its affiliate compounding pharmacies had been collecting copayments.

Barrett pleaded guilty on Aug. 25, 2021, to conspiracy to engage in monetary transactions in criminally derived property. In addition to the term of imprisonment, Barrett was ordered to pay restitution and forfeit all assets traced to his ill-gotten gains.

Assistant Attorney General Kenneth A. Polite, Jr. of the Justice Department’s Criminal Division; U.S. Attorney Darren J. LaMarca for the Southern District of Mississippi; Assistant Director Luis Quesada of the FBI’s Criminal Investigative Division; and Special Agent in Charge Cyndy Bruce of the Department of Defense Office of Inspector General’s Defense Criminal Investigative Service (DoD OIG-DCIS) Southeast Field Office made the announcement.

The FBI Jackson Field Office and DoD OIG-DCIS are investigating the case.

Trial Attorneys Emily Cohen and Alejandra Arias of the Criminal Division’s Money Laundering and Asset Recovery Section and Assistant U.S. Attorney Kathlyn Van Buskirk of the Southern District of Mississippi are prosecuting the case with assistance from Sara Porter and Dustin Davis from the Criminal Division’s Fraud Section.

Press release distributed by the DOJ.

Featured image: by ccPixs.com is marked with CC BY 2.0.

Defendants’ Separate Campaigns Both Targeted Software and Hardware for Operational Technology Systems

The Department of Justice has unsealed two indictments charging four defendants –all Russian nationals who worked for the Russian government– with attempting, supporting and conducting computer intrusions that together, in two separate conspiracies, targeted the global energy sector between 2012 and 2018. In total, these hacking campaigns targeted thousands of computers, at hundreds of companies and organizations, in approximately 135 countries.

A June 2021 indictment returned in the District of Columbia, United States v. Evgeny Viktorovich Gladkikh, concerns the alleged efforts of an employee of a Russian Ministry of Defense research institute and his co-conspirators to damage critical infrastructure outside the United States, thereby causing two separate emergency shutdowns at a foreign targeted facility. The conspiracy subsequently attempted to hack the computers of a U.S. company that managed similar critical infrastructure entities in the United States.

An August 2021 indictment returned in the District of Kansas, United States v. Pavel Aleksandrovich Akulov, et al., details allegations about a separate, two-phased campaign undertaken by three officers of Russia’s Federal Security Service (FSB) and their co-conspirators to target and compromise the computers of hundreds of entities related to the energy sector worldwide. Access to such systems would have provided the Russian government the ability to, among other things, disrupt and damage such computer systems at a future time of its choosing.

“Russian state-sponsored hackers pose a serious and persistent threat to critical infrastructure both in the United States and around the world,” said Deputy Attorney General Lisa O. Monaco. “Although the criminal charges unsealed today reflect past activity, they make crystal clear the urgent ongoing need for American businesses to harden their defenses and remain vigilant. Alongside our partners here at home and abroad, the Department of Justice is committed to exposing and holding accountable state-sponsored hackers who threaten our critical infrastructure with cyber-attacks.”

“The FBI, along with our federal and international partners, is laser-focused on countering the significant cyber threat Russia poses to our critical infrastructure,” said FBI Deputy Director Paul Abbate. “We will continue to identify and quickly direct response assets to victims of Russian cyber activity; to arm our partners with the information that they need to deploy their own tools against the adversary; and to attribute the misconduct and impose consequences both seen and unseen.”

“We face no greater cyber threat than actors seeking to compromise critical infrastructure, offenses which could harm those working at affected plants as well as the citizens who depend on them,” said U.S. Attorney Matthew M. Graves for the District of Columbia. “The department and my office will ensure that those attacking operational technology will be identified and prosecuted.”

“The potential of cyberattacks to disrupt, if not paralyze, the delivery of critical energy services to hospitals, homes, businesses and other locations essential to sustaining our communities is a reality in today’s world,” said U.S. Attorney Duston Slinkard for the District of Kansas. “We must acknowledge there are individuals actively seeking to wreak havoc on our nation’s vital infrastructure system, and we must remain vigilant in our effort to thwart such attacks. The Department of Justice is committed to the pursuit and prosecution of accused hackers as part of its mission to protect the safety and security of our nation.”

In addition to unsealing these charges, the U.S. government is taking action to enhance private sector network defense efforts and disrupt similar malicious activity.

The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has already released numerous Technical Alerts, ICS Alerts and Malware Analysis Reports regarding Russia’s malign cyber activities, including the campaigns discussed in the indictments. These are located at: https://www.cisa.gov/shields-up

1. United States v. Evgeny Viktorovich Gladkikh – defendant installed backdoors and launched malware designed to compromise the safety of energy facilities

In June 2021, a federal grand jury in the District of Columbia returned an indictment charging Evgeny Viktorovich Gladkikh (Евгений Викторович Гладких), 36, a computer programmer employed by an institute affiliated with the Russian Ministry of Defense, for his role in a campaign to hack industrial control systems (ICS) and operational technology (OT) of global energy facilities using techniques designed to enable future physical damage with potentially catastrophic effects.

According to the indictment, between May and September 2017, the defendant and co-conspirators hacked the systems of a foreign refinery and installed malware, which cyber security researchers have referred to as “Triton” or “Trisis,” on a safety system produced by Schneider Electric, a multinational corporation. The conspirators designed the Triton malware to prevent the refinery’s safety systems from functioning (i.e., by causing the ICS to operate in an unsafe manner while appearing to be operating normally), granting the defendant and his co-conspirators the ability to cause damage to the refinery, injury to anyone nearby, and economic harm. However, when the defendant deployed the Triton malware, it caused a fault that led the refinery’s Schneider Electric safety systems to initiate two automatic emergency shutdowns of the refinery’s operations. Between February and July 2018, the conspirators researched similar refineries in the United States, which were owned by a U.S. company, and unsuccessfully attempted to hack the U.S. company’s computer systems.

The three-count indictment alleges that Gladkikh was an employee of the State Research Center of the Russian Federation FGUP Central Scientific Research Institute of Chemistry and Mechanics’ (Государственный научный центр Российской Федерации федеральное государственное унитарное предприятие Центральный научно-исследовательский институт химии и механики, hereinafter “TsNIIKhM”) Applied Developments Center (“Центр прикладных разработок,” hereinafter “ADC”). On its website, which was modified after the Triton attack became public, TsNIIKhM described itself as the Russian Ministry of Defense’s leading research organization. The ADC, in turn, publicly asserted that it engaged in research concerning information technology-related threats to critical infrastructure (i.e., that its research was defensive in nature).

The defendant is charged with one count of conspiracy to cause damage to an energy facility, which carries a maximum sentence of 20 years in prison, one count of attempt to cause damage to an energy facility, which carries a maximum sentence of 20 years in prison, and one count of conspiracy to commit computer fraud, which carries a maximum sentence of five years in prison.

Assistant U.S. Attorneys Christopher B. Brown and Luke Jones for the District of Columbia, in partnership with the National Security Division’s Counterintelligence and Export Control Section, are prosecuting this case. The FBI’s Washington Field Office conducted the investigation.

The U.S.-based targets of the conspiracy cooperated and provided valuable assistance in the investigation. The Department of Justice and the FBI also expressed appreciation to Schneider Electric for its assistance in the investigation, particularly noting the company’s public outreach and education efforts following the overseas Triton attack.

2. United States v. Pavel Aleksandrovich Akulov, Mikhail Mikhailovich Gavrilov, and Marat Valeryevich Tyukov – defendants undertook years-long effort to target and compromise computer systems of energy sector companies

On Aug. 26, 2021, a federal grand jury in Kansas City, Kansas, returned an indictment charging three computer hackers, all of whom were residents and nationals of the Russian Federation (Russia) and officers in Military Unit 71330 or “Center 16” of the FSB, with violating U.S. laws related to computer fraud and abuse, wire fraud, aggravated identity theft and causing damage to the property of an energy facility.

The FSB hackers, Pavel Aleksandrovich Akulov (Павел Александрович Акулов), 36, Mikhail Mikhailovich Gavrilov (Михаил Михайлович Гаврилов), 42, and Marat Valeryevich Tyukov (Марат Валерьевич Тюков), 39, were members of a Center 16 operational unit known among cybersecurity researchers as “Dragonfly,” “Berzerk Bear,” “Energetic Bear,” and “Crouching Yeti.” The indictment alleges that, between 2012 and 2017, Akulov, Gavrilov, Tyukov and their co-conspirators, engaged in computer intrusions, including supply chain attacks, in furtherance of the Russian government’s efforts to maintain surreptitious, unauthorized and persistent access to the computer networks of companies and organizations in the international energy sector, including oil and gas firms, nuclear power plants, and utility and power transmission companies. Specifically, the conspirators targeted the software and hardware that controls equipment in power generation facilities, known as ICS or Supervisory Control and Data Acquisition (SCADA) systems. Access to such systems would have provided the Russian government the ability to, among other things, disrupt and damage such computer systems at a future time of its choosing.

According to the indictment, the energy sector campaign involved two phases. In the first phase, which took place between 2012 and 2014 and is commonly referred to by cyber security researchers as “Dragonfly” or “Havex,” the conspirators engaged in a supply chain attack, compromising the computer networks of ICS/SCADA system manufacturers and software providers and then hiding malware – known publicly as “Havex” – inside legitimate software updates for such systems. After unsuspecting customers downloaded Havex-infected updates, the conspirators would use the malware to, among other things, create backdoors into infected systems and scan victims’ networks for additional ICS/SCADA devices. Through these and other efforts, including spearphishing and “watering hole” attacks, the conspirators installed malware on more than 17,000 unique devices in the United States and abroad, including ICS/SCADA controllers used by power and energy companies.

In the second phase, which took place between 2014 and 2017 and is commonly referred to as “Dragonfly 2.0,” the conspirators transitioned to more targeted compromises that focused on specific energy sector entities and individuals and engineers who worked with ICS/SCADA systems. As alleged in the indictment, the conspirators’ tactics included spearphishing attacks targeting more than 3,300 users at more than 500 U.S. and international companies and entities, in addition to U.S. government agencies such as the Nuclear Regulatory Commission. In some cases, the spearphishing attacks were successful, including in the compromise of the business network (i.e., involving computers not directly connected to ICS/SCADA equipment) of the Wolf Creek Nuclear Operating Corporation (Wolf Creek) in Burlington, Kansas, which operates a nuclear power plant. Moreover, after establishing an illegal foothold in a particular network, the conspirators typically used that foothold to penetrate further into the network by obtaining access to other computers and networks at the victim entity.

During the Dragonfly 2.0 phase, the conspirators also undertook a watering hole attack by compromising servers that hosted websites commonly visited by ICS/SCADA system and other energy sector engineers through publicly known vulnerabilities in content management software. When the engineers browsed to a compromised website, the conspirators’ hidden scripts deployed malware designed to capture login credentials onto their computers.

The conspiracy’s hacking campaign targeted victims in the United States and in more than 135 other countries.

Akulov, Gavrilov and Tyukov are charged with conspiracy to cause damage to the property of an energy facility and commit computer fraud and abuse, which carries a maximum sentence of five years in prison, and conspiracy to commit wire fraud, which carries a maximum sentence of 20 years in prison. Akulov and Gavrilov are also charged with substantive counts of wire fraud and computer fraud related to unlawfully obtaining information from computers and causing damage to computers. These offenses carry maximum sentences ranging from five to 20 years in prison. Finally, Akulov and Gavrilov are also charged with three counts of aggravated identity theft, each of which carry a minimum sentence of two years consecutive to any other sentence imposed.

Assistant U.S. Attorneys Scott Rask, Christopher Oakley and Ryan Huschka forthe District of Kansas, and Counsel for Cyber Investigations Ali Ahmad and Trial Attorney Christine Bonomo of the National Security Division’s Counterintelligence and Export Control Section are prosecuting this case. The FBI’s Portland and Richmond field offices conducted the investigation, with the assistance of the FBI’s Cyber Division.

Numerous victims, including Wolf Creek and its owners Evergy and the Kansas Electric Power Cooperative, cooperated and provided invaluable assistance in the investigation.

An indictment is merely an allegation and all defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

---

Note: View the concurrent announcement by the Department of State of a $10 million reward for information leading to the arrest of a defendant or identification of other conspirators as part of its Rewards for Justice program.

View the concurrent announcement by the FBI, Department of Energy and Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) of a  Joint Cybersecurity Advisory containing technical details, indicators of compromise and mitigation measures.

Press release distributed by the DOJ.

Featured image: “Computers Original” by prasan.naik is marked with CC BY-NC-ND 2.0.