Google Sent Users 40,000 Warnings

Primer questions: Did other tech companies do the same and if so, how many? What does Congress know and where are they with a real cyber policy?

Google’s threat analysis group, which counters targeted and government-backed hacking against the company and its users, sent account holders almost 40,000 warnings in 2019, with government officials, journalists, dissidents, and geopolitical rivals being the most targeted, team members said on Thursday.

The number of warnings declined almost 25 percent from 2018, in part because of new protections designed to curb cyberattacks on Google properties. Attackers have responded by reducing the frequency of their hack attempts and being more deliberate. The group saw an increase in phishing attacks that impersonated news outlets and journalists. In many of these cases, attackers sought to spread disinformation by attempting to seed false stories with other reporters. Other times, attackers sent several benign messages in hopes of building a rapport with a journalist or foreign policy expert. The attackers, who most frequently came from Iran and North Korea, would later follow up with an email that included a malicious attachment.

Color-coded Mercator projection of the world.

“Government-backed attackers regularly target foreign policy experts for their research, access to the organizations they work with, and connection to fellow researchers or policymakers for subsequent attacks,” Toni Gidwani, a security engineering manager in the threat analysis group, wrote in a post.

Top targets

Countries with residents that collectively received more than 1,000 warnings included the United States, India, Pakistan, Japan, and South Korea. Thursday’s post came eight months after Microsoft said it had warned 10,000 customers of nation-sponsored attacks over the 12 previous months. The software maker said it saw “extensive” activity from five specific groups sponsored by Iran, North Korea, and Russia.

Thursday’s post also tracked targeted attacks carried out by Sandworm, believed to be an attack group working on behalf of the Russian Federation. Sandworm has been responsible for some of the world’s most severe attacks, including hacks on Ukrainian power facilities that left the country without electricity in 2015 and 2016, NATO and the governments of Ukraine and Poland in 2014, and according to Wired journalist Andy Greenberg, the NotPetya malware that created worldwide outages, some that lasted weeks.

The following graph shows Sandworm’s targeting of various industries and countries from 2017 to 2019. While the targeting of most of the industries or countries was sporadic, Ukraine was on the receiving end of attacks throughout the entire three-year period:

Sandworm’s targeting efforts (mostly by sector) over the last three years.
Enlarge / Sandworm’s targeting efforts (mostly by sector) over the last three years.
Google

Tracking zero-days

In 2019, the Google group discovered zero-day vulnerabilities affecting Android, iOS, Windows, Chrome, and Internet Explorer. A single attack group was responsible for exploiting five of the unpatched security flaws. The attacks were used against Google, Google account holders, and users of other platforms.

“Finding this many zeroday exploits from the same actor in a relatively short time frame is rare,” Gidwani wrote.

The exploits came from legitimate websites that had been hacked, links to malicious websites, and attachments embedded in spear-phishing emails. Most of the targets were in North Korea or were against individuals working on North Korea-related issues.

The group’s policy is to privately inform developers of the affected software and give them seven days to release a fix or publish an advisory. If the companies don’t meet that deadline, Google releases its own advisory.

One observation that Google users should note: of all the phishing attacks the company has seen in the past few years, none has resulted in a takeover of accounts protected by the account protection program, which among other things makes multifactor authentication mandatory. Once people have two physical security keys from Yubi or another manufacturer, enrolling in the program takes less than five minutes.

Nicolás Maduro,14 Other Officials Charged with Narco-Terrorism, Corruption

Department of Justice
Office of Public Affairs
FOR IMMEDIATE RELEASE

Venezuelan Officials Say President Nicolás Maduro Is ...  source
Thursday, March 26, 2020
Nicolás Maduro Moros and 14 Current and Former Venezuelan Officials Charged with Narco-Terrorism, Corruption, Drug Trafficking and Other Criminal Charges
Maduro and Other High Ranking Venezuelan Officials Allegedly Partnered With the FARC to Use Cocaine as a Weapon to “Flood” the United States

Former President of Venezuela Nicolás Maduro Moros, Venezuela’s vice president for the economy, Venezuela’s Minister of Defense, and Venezuela’s Chief Supreme Court Justice are among those charged in New York City; Washington, DC; and Miami, along with current and former Venezuelan government officials as well as two Fuerzas Armadas Revolucionarias de Colombia (FARC) leaders, announced U.S. Attorney General William P. Barr, U.S. Attorney Geoffrey S. Berman of the Southern District of New York, U.S. Attorney Ariana Fajardo Orshan of the Southern District of Florida, Assistant Attorney General Brian A. Benczkowski of the Justice Department’s Criminal Division, Acting Administrator Uttam Dhillon of the U.S. Drug Enforcement Administration (DEA) and Acting Executive Associate Director Alysa D. Erichs of U.S. Immigration and Customs Enforcement’s Homeland Security Investigations (HSI).

“The Venezuelan regime, once led by Nicolás Maduro Moros, remains plagued by criminality and corruption,” said Attorney General Barr. “For more than 20 years, Maduro and a number of high-ranking colleagues allegedly conspired with the FARC, causing tons of cocaine to enter and devastate American communities. Today’s announcement is focused on rooting out the extensive corruption within the Venezuelan government – a system constructed and controlled to enrich those at the highest levels of the government. The United States will not allow these corrupt Venezuelan officials to use the U.S. banking system to move their illicit proceeds from South America nor further their criminal schemes.”

“Today we announce criminal charges against Nicolás Maduro Moros for running, together with his top lieutenants, a narco-terrorism partnership with the FARC for the past 20 years,” said U.S. Attorney Geoffrey S. Berman. “The scope and magnitude of the drug trafficking alleged was made possible only because Maduro and others corrupted the institutions of Venezuela and provided political and military protection for the rampant narco-terrorism crimes described in our charges. As alleged, Maduro and the other defendants expressly intended to flood the United States with cocaine in order to undermine the health and wellbeing of our nation. Maduro very deliberately deployed cocaine as a weapon. While Maduro and other cartel members held lofty titles in Venezuela’s political and military leadership, the conduct described in the Indictment wasn’t statecraft or service to the Venezuelan people. As alleged, the defendants betrayed the Venezuelan people and corrupted Venezuelan institutions to line their pockets with drug money.”

“Over the last decade, corrupt Venezuelan government officials have systematically looted Venezuela of billions of dollars,” said U.S. Attorney Ariana Fajardo Orshan. “Far too often, these corrupt officials and their co-conspirators have used South Florida banks and real estate to conceal and perpetuate their illegal activity. As the recent charges show, Venezuelan corruption and money laundering in South Florida extends to even the highest levels of Venezuela’s judicial system. In the last couple of years, the US Attorney’s Office in South Florida and its federal law enforcement partners have united to bring dozens of criminal charges against high-level regime officials and co-conspirators resulting in seizures of approximately $450 million dollars.”

“These indictments expose the devastating systemic corruption at the highest levels of Nicolas Maduro’s regime,” said DEA Acting Administrator Uttam Dhillon. “These officials repeatedly and knowingly betrayed the people of Venezuela, conspiring, for personal gain, with drug traffickers and designated foreign terrorist organizations like the FARC. Today’s actions send a clear message to corrupt officials everywhere that no one is above the law or beyond the reach of U.S. law enforcement. The Department of Justice and the Drug Enforcement Administration will continue to protect the American people from ruthless drug traffickers – no matter who they are or where they live.”

“The collaborative nature of this investigation is representative of the ongoing work HSI and international law enforcement agencies perform each day, often behind the scenes and unknown to the public, to make our communities safer and free from corruption,” said HSI’s Acting Executive Associate Director Alysa D. Erichs. “Today’s announcement highlights HSI’s global reach and commitment to aggressively identify, target and investigate individuals who violate U.S. laws, exploit financial systems, and hide behind cryptocurrency to further their illicit criminal activity. Let this indictment be a reminder that no one is above the law – not even powerful political officials.”

A four-count superseding indictment unsealed today in the Southern District of New York (SDNY) charges Nicolás Maduro Moros, 57; Diosdado Cabello Rondón, 56, head of Venezuela’s National Constituent Assembly; Hugo Armando Carvajal Barrios aka “El Pollo,” 59, former director of military intelligence; Clíver Antonio Alcalá Cordones, 58, former General in the Venezuelan armed forces; Luciano Marín Arango aka “Ivan Marquez,” 64, a member of the FARC’s Secretariat, which is the FARC’s highest leadership body; and Seuxis Paucis Hernández Solarte aka “Jesús Santrich,” 53, a member of the FARC’s Central High Command, which is the FARC’s second-highest leadership body. The case is pending before U.S. District Judge Alvin K. Hellerstein.

The U.S. Department of State, through its Narcotics Rewards Program, is offering rewards of up to $15 million for information leading to the arrest and/or conviction of Maduro Moros, up to $10 million for information leading to the arrest and/or conviction of Cabello Rondón, Carvajal Barrios, and Alcalá Cordones, and up to $5 million for information leading to the arrest and/or conviction of Marín Arango.

Maduro Moros, Cabello Rondón, Carvajal Barrios, Alcalá Cordones, Marín Arango, and Hernández Solarte have each been charged with: (1) participating in a narco-terrorism conspiracy, which carries a 20-year mandatory minimum sentence and a maximum of life in prison; (2) conspiring to import cocaine into the United States, which carries a 10-year mandatory minimum sentence and a maximum of life in prison; (3) using and carrying machine guns and destructive devices during and in relation to, and possessing machine guns and destructive devices in furtherance of, the narco-terrorism and cocaine-importation conspiracies, which carries a 30-year mandatory minimum sentence and a maximum of life in prison; and (4) conspiring to use and carry machine guns and destructive devices during and in relation to, and to possess machine guns and destructive devices in furtherance of, the narco-terrorism and cocaine-importation conspiracies, which carries a maximum sentence of life in prison. The potential mandatory minimum and maximum sentences in this case are prescribed by Congress and provided here for informational purposes only, as any sentencing of the defendants will be determined by the judge.

According to the allegations contained in the superseding indictment, other court filings, and statements made during court proceedings:

Since at least 1999, Maduro Moros, Cabello Rondón, Carvajal Barrios and Alcalá Cordones, acted as leaders and managers of the Cártel de Los Soles, or “Cartel of the Suns.” The Cartel’s name refers to the sun insignias affixed to the uniforms of high-ranking Venezuelan military officials. Maduro Moros and the other charged Cartel members abused the Venezuelan people and corrupted the legitimate institutions of Venezuela—including parts of the military, intelligence apparatus, legislature, and the judiciary—to facilitate the importation of tons of cocaine into the United States. The Cártel de Los Soles sought to not only enrich its members and enhance their power, but also to “flood” the United States with cocaine and inflict the drug’s harmful and addictive effects on users in the United States.

Marín Arango and Hernández Solarte are leaders of the FARC. Beginning in approximately 1999, while the FARC was purporting to negotiate toward peace with the Colombian government, FARC leaders agreed with leaders of the Cártel de Los Soles to relocate some of the FARC’s operations to Venezuela under the protection of the Cartel. Thereafter, the FARC and the Cártel de Los Soles dispatched processed cocaine from Venezuela to the United States via transshipment points in the Caribbean and Central America, such as Honduras. By approximately 2004, the U.S. Department of State estimated that 250 or more tons of cocaine were transiting Venezuela per year. The maritime shipments were shipped north from Venezuela’s coastline using go-fast vessels, fishing boats, and container ships. Air shipments were often dispatched from clandestine airstrips, typically made of dirt or grass, concentrated in the Apure State. According to the U.S. Department of State, approximately 75 unauthorized flights suspected of drug-trafficking activities entered Honduran airspace in 2010 alone, using what is known as the “air bridge” cocaine route between Venezuela and Honduras.

In his role as a leader of the Cártel de Los Soles, Maduro Moros negotiated multi-ton shipments of FARC-produced cocaine; directed that the Cártel de Los Soles provide military-grade weapons to the FARC; coordinated foreign affairs with Honduras and other countries to facilitate large-scale drug trafficking; and solicited assistance from FARC leadership in training an unsanctioned militia group that functioned, in essence, as an armed forces unit for the Cártel de Los Soles.

DEA’s Special Operations Division Bilateral Investigations Unit, New York Strike Force, and Miami Field Division conducted the investigation. This case is being handled by the U.S. Attorney’s Office for the Southern District of New York’s Terrorism and International Narcotics Unit. Assistant U.S. Attorneys Amanda L. Houle, Matthew J. Laroche, Jason A. Richman, and Kyle A. Wirshba are in charge of the prosecution.

* * *

An indictment unsealed today in the District of Columbia charges Vladimir Padrino Lopez, 56, Minister of Defense of Venezuela. The indictment alleges that from March 2014 until May 2019, Padrino Lopez conspired with others to distribute cocaine on board an aircraft registered in the United States.

Padrino Lopez, who holds the rank of General in the Venezuelan armed forces, held the authority for interdicting aircraft, many of which are registered in the United States, suspected of being used to traffic drugs from Venezuela to countries in Central America. On numerous occasions, Padrino Lopez ordered or authorized the Venezuelan military to force suspected trafficking aircraft to land or to shoot down the aircraft. However, Padrino Lopez allowed for other aircraft whose drug trafficking coordinators paid bribes to him to safely transit Venezuelan airspace.

On Sept. 25, 2018, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) included Padrino Lopez on its Specially Designated Nationals List. Pursuant to the Foreign Narcotics Kingpin Designation Act, this means that his assets are blocked and U.S. persons are generally prohibited from having financial transactions with him.

The DEA Orlando District Office led the investigation, which was supported by the Organized Crime Drug Enforcement Task Force program and the Criminal Division’s Office of Enforcement Operations. Acting Deputy Chief Charles Miracle and Trial Attorneys Michael Christin and Kirt Marsh of the Criminal Division’s Narcotic and Dangerous Drug Section are prosecuting the case.

* * *

Maikel Jose Moreno Perez, 54, current Chief Justice of the Venezuelan Supreme Court, was charged via a criminal complaint in the Southern District of Florida with conspiracy to commit money laundering and money laundering in connection with the alleged corrupt receipt or intended receipt of tens of millions of dollars and bribes to illegally fix dozens of civil and criminal cases in Venezuela.

The complaint alleges, for example, that the defendant authorized a seizure and sale of a General Motors auto plant with an estimated value of $100 million in exchange for a personal percentage of the proceeds. Similarly, the complaint alleges that the defendant received bribes to authorize the dismissal of charges or release against Venezuelans, including one charged in a multibillion-dollar fraud scheme against the Venezuelan state-owned oil company.

According to the criminal complaint, in or around October 2014, Moreno Perez told U.S. authorities in a visa application that he earned the equivalent of about $12,000 per year from his work in Venezuela. From 2012 to 2016, the defendant’s U.S. bank records show approximately $3 million in inflows to the defendant’s accounts, primarily from large round-dollar transfers from shell corporations with foreign bank accounts linked to Co-Conspirator 1, who is a former criminal defense attorney in Venezuela that currently controls a media company in Venezuela.

As set out in the criminal complaint, the defendant’s bank records allegedly show that from 2012 to 2016, the defendant spent approximately $3 million, primarily in the geographical area of South Florida. For example, bank records allegedly show that Moreno Perez spent about $1 million for a private aircraft and private pilot, more than $600,000 in credit or debit card purchases at stores primarily in South Florida (including tens of thousands of dollars at luxury stores in Bal Harbor, such as Prada and Salvatore Ferragamo), about $50,000 in payments to a luxury watch repair store in Aventura, and approximately $40,000 in payments to a Venezuelan beauty pageant director.

HSI’s Miami Field Office conducted the investigation. Assistant U.S. Attorney Michael N. Berger of the Southern District of Florida is in charge of the prosecution.

* * *

A separate superseding indictment unsealed today in the Southern District of New York charges Tareck Zaidan El Aissami Maddah, 45, Venezuela’s vice president for the economy, Joselit Ramirez Camacho, 33, Venezuela’s superintendent of cryptocurrency (Sunacrip), and Samark Lopez Bello, 45, a Venezuelan businessman, with a series of crimes relating to efforts to evade sanctions imposed by OFAC against Maduro Moros, El Aissami Maddah, and Lopez Bello.

The indictment alleges that from February 2017 until March 2019, El Aissami Maddah and Ramirez Camacho worked with U.S. persons and U.S.-based entities to provide private flight services for the benefit of Maduro’s 2018 presidential campaign, in violation of OFAC’s sanctions targeting Maduro after he organized elections for the illegitimate National Constituent Assembly that Cabello Rondon now leads.

The U.S. Department of State, through its Narcotics Rewards Program, is offering a reward of up to $10 million for information leading to the arrest and/or conviction of El Aissami Maddah.

HSI’s New York Field Office conducted the investigation. This case is being handled by the U.S. Attorney’s Office for the Southern District of New York’s Terrorism and International Narcotics Unit. Assistant U.S. Attorneys Sam Adelsberg and Amanda L. Houle are in charge of the prosecution.

* * *

Other individuals charged in separate indictments include:

Luis Motta Dominguez, 67, Former Minister of Energy, was charged in the Southern District of Florida for his alleged role in laundering the proceeds of violations of the Foreign Corrupt Practices Act (FCPA) in connection with his alleged receipt of bribes to award Corpoelec business to U.S.-based companies;
Nestor Reverol Torres, 55, former General Director of Venezuela’s La Oficina Nacional Antidrogas (ONA) and former commander of Venezuela’s National Guard and Edylberto Jose Molina Molina, 57, former Sub-Director of Venezuela’s ONA and currently Venezuela’s military attaché to Germany, were charged in the Eastern District of New York with participating in an international cocaine distribution conspiracy where they allegedly assisted narcotics traffickers in importing cocaine into the United States;
Vassyly Kotosky Villarroel Ramirez aka “Mauro” and “Angel,” 47, a former captain in the Venezuelan Guardia Nacional, was charged in a third superseding indictment in the Eastern District of New York with participating in an international cocaine distribution conspiracy between Jan. 1, 2004, and Dec. 1, 2009;
Rafael Antonio Villasana Fernandez, 48, a former officer in the Venezuelan Guardia Nacional, was charged in the Eastern District of New York with participating in an international cocaine distribution conspiracy between Jan. 1, 2004, and Dec. 1, 2009. According to court documents, Kotosky and Villasana allegedly used official government vehicles to transport more than seven metric tons of cocaine from the Colombian border to various airports and seaports in Venezuela for ultimate importation into the United States;
Nervis Gerardo Villalobos Cardenas, 52, former Vice Minister of Energy of Venezuela, was charged in a 20-count indictment in the Southern District of Texas with conspiracy to commit money laundering, money laundering and conspiracy to violate the Foreign Corrupt Practices Act (FCPA) for his alleged role in an international money laundering scheme involving bribes paid by the owners of U.S.-based companies to Venezuelan government officials to corruptly secure energy contracts and payment priority on outstanding invoices; and
Oscar Rafael Colmenarez Villalobos, 51, former Venezuelan Air Force Officer, charged in the District of Arizona with violations of the Arms Export Control Act. He allegedly conspired with others, including individuals associated with an aviation company in Arizona, to smuggle from the United States to Venezuela T-76 military aircraft engines used on OV-10 Bronco aircraft to individuals in Venezuela and allegedly made false and misleading statements on shipping and export control documents to conceal the prohibited activities and transactions from detection of the U.S. government.

An indictment is merely an allegation and all defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Hey Amb. Yovanovitch and Adam Schiff, Call Holding Line 3

Remember the accusations during the Trump impeachment trial that Ukraine had cleaned up corruption? President Trump withheld aid for a couple of very legitimate reasons including corruption in the Ukraine military, corruption in the banking system and money-laundering. The Democrats continued to place guilt of dying Ukrainians because of the military conflict with Russia in the lap of President Trump. Then there was that pesky Internet Research Agency in St. Petersburg that spread propaganda across the world.

Ladies and gentlemen…it is still happening over there…where is the media? Where is Shifty Schiff and Nasty Nadler? Maria Yovanovitch is retired but gotta wonder what she knew.

Anyway read on….this is yet but only part of what continues to go on in Ukraine…Rudy Giuliani is working many other channels.

Hat tip to the REAL investigative reporters on the case…well done.

Image result for milton group kiev source

Luxury cars line the parking lot of the upscale Mandarin Plaza mall in Kyiv, while their well-heeled owners flaunt their wealth in its jewellery and designer clothes stores.

But hidden on its upper floors, protected by armed guards and under the constant surveillance of security cameras, a very different product is being sold.

Sitting elbow-to-elbow under fluorescent lights, a multi-lingual army of call center staff hawk get-rich-quick dreams across the world in the form of cryptocurrency and stock investments for a company called Milton Group.

Now, a cache of documents handed to the Swedish daily Dagens Nyheter by a whistleblower from inside the call center, and shared with OCCRP, exposes the inner workings of this type of fraud: an old-fashioned boiler-room scam that leverages the power of social media to operate on a global scale.

Armed with a list of over 1,000 people targeted by the call center, reporters from 21 countries and dozens of media outlets spoke to more than 180 victims, revealing a trail of ruined lives from Sweden’s Arctic Circle to the Ecuadorian Amazon, passing through small industrial towns in the Balkans and major world cities like London and Sydney.

The stories were strikingly similar. Many first came into contact with the scam through Facebook ads promising remarkable returns on investments. After entering their contact details to find out more, victims would be deluged with high-pressure sales calls. They would make a small “investment” that quickly yielded impressive — but fake — profits. But requests to withdraw the full funds were not honored.

Those worst affected were preyed upon by the call center’s “retention” desk, whose job was to conjure up new ways to extract more money, often through brutal psychological pressure. Some were harassed into taking out huge loans, threatened by forged letters from UK financial regulators demanding taxes, or contacted by fake lawyers offering to help get their money back — for yet another fee. In the most extreme cases, Milton Group’s retention specialists would convince victims to install software on their computers that allowed the scammers to control them remotely, and steal more money in the process. Some lost more than $200,000.

The victims, fooled by foreign names and addresses, and assurances of sky-high returns, believed they were on the phone with a legitimate investment business based in Western Europe. They had no inkling that the people on the other end of the line were largely young Ukrainians or Middle Eastern and African migrants in Kyiv.

Ukrainian Milton Group scheme source

Some tried to report their losses to police in their countries, but law enforcement largely failed to connect the dots. Cyber-crime units in multiple countries affected by the call center, including Spain and Italy, told OCCRP and its partners that they were aware of such cross-border frauds, but that they are hard to detect, often go unreported, and require cooperation between law enforcement bodies across many jurisdictions.

However, Swedish authorities have now opened an investigation based on the whistleblower’s extensive evidence, and have been in touch with Europol about the allegations.

“This company what they do, everything is fake,” said Alexey, the whistleblower. (His real name cannot be used to protect his safety.) “They just steal money from people.”

He said staff were told the Kyiv center took in a massive 65 million euros in sales in 2019. To celebrate, the company’s leaders threw a lavish New Year’s party themed around the novel “The Great Gatsby,” about a Jazz-Age bootlegger and con artist. Under neon lights, hundreds of Milton staffers watched contortionists and fire-dancers perform, and were awarded prizes, including cars, cash, and free lodging, for especially good salesmanship.

Milton is apparently tied to other call centers in Albania, Georgia, and North Macedonia employing hundreds more staff.

While it is impossible to determine whether every investment that passed through the Kyiv center was fraudulent, reporters from DN and across OCCRP’s network spoke to more than 180 victims listed in Milton’s client database who confirmed they had lost their money in investment scams. A few had been able to withdraw some funds, likely in an attempt to encourage further investments, or remained hopeful they would be able to cash out their “earnings” one day.

The supposed investments were made by transferring funds through Western Union, bank accounts, credit cards, and cryptocurrencies. Milton salespeople received a higher commission if they could convince their clients to pay in bitcoins and other cryptocurrencies, since they are harder to trace. Many of the bank-to-bank transfers were routed through the private accounts of individuals with a UK financial company, with clear instructions not to indicate the money was for investing.

In many cases identified by OCCRP, online credit-card payments were handled by a Cyprus-based company called Naspay, which bills itself as a “state-of-the-art payment gateway” and is owned by David Todua — the same Georgian-Israeli man the whistleblower identified to law enforcement as the person behind Milton Group. (Todua vigorously denies holding any “formal or informal position” in the company, although he conceded that he had attended Milton Group’s New Year’s party as a guest. He also said that Naspay does not process payments, but merely “transfers information” between websites that accept payments and financial institutions. OCCRP did not find evidence Todua has any ownership of Milton.)

After their initial investments, some victims were told they needed to send additional fees in cash to individuals in far-flung countries such as Colombia and Uganda rather than company bank accounts.

Leif Nixon, a Swedish cryptocurrency expert who helps law enforcement investigate bitcoin-related crime, analyzed the bitcoin addresses used by Milton Group to accept payments from its customers. He said the set-up did not appear to be that of a legitimate operator.

He noted several indications that clients’ money was not being invested as promised, including the fact that many different people were told to send their bitcoins to the same few addresses. Clients were also given different addresses each time they made a payment.

“It’s like opening a bank account, but you don’t get an account number; instead, for every deposit you make you get a different account number,” Nixon explained.

Ultimately, he said, $5.9 million in bitcoins from seven of Milton Group’s addresses disappeared into East Asian exchanges in 2019.

“I can’t see why a legitimate operation would make these kinds of transactions,” he said. “It doesn’t make any sense.”

Call center staff were well aware that their job was to steal, the whistleblower says. Alexey told DN that on one of his first days at Milton, the sales manager joked that even when she was as young as six, she dreamed of being a “motherfucker and stealing people’s money.”

At a training session for new staff at a Tbilisi call center linked to the Milton Group, attended by an undercover reporter last month, a trainer explained that the company’s goal was for customers “to lose their money in a realistic way.” Asked why, she laughed: “It’s naive to ask, to be honest. When they lose the money, it stays with us.”

An internal customer database reviewed by reporters is laced with expletives about “fucking” clients out of money, as well as highlighting their vulnerabilities and how they might best be targeted. In one note from October 2019, a Milton staff member wrote of a 67-year-old Swedish woman: “Sold her home to pay, no money, crying.”

That woman, reached by Dagens Nyheter in a rural part of central Sweden, told journalists she was tricked into investing over $100,000 by Milton staff who took out loans on her behalf.

She, like many other victims, was initially sucked in by the illusion that she was making huge profits: “You become hypnotized and brainwashed.”

But when she wanted to withdraw her supposed earnings, “they disappeared.” Today she cannot afford to buy food or pay her rent. “I have nothing to live for,” she said. While Milton Group’s fake investments have brought its victims financial ruin, the picture is very different for the firm’s alleged managers.

A review of their social media profiles shows that they have a penchant for expensive cars, foreign holidays, and guns. Some also have high-level political connections.

The CEO of Milton Group is Jacob Keselman, who declares himself “the Wolf of Kiev” on his Instagram account, a nod to “The Wolf of Wall Street,” the Hollywood film about a notorious penny-stock scammer. His social media profiles are replete with photos of luxury cars, foreign holidays, and the occasional gun. In one photo he can be seen working in a room with a spectacular view of the Eiffel Tower. He writes: “The one who loves his job is truly happy.”

OCCRP could not obtain official information about Keselman’s national origin, but on his LinkedIn profile he writes that his native language is Russian, he attended university in Kyiv, and he did two stints in sales in Israel before joining Milton Group.

Contacted for comment, Keselman denied that Milton Group had defrauded anyone. “You know how it is working, investment and forex brands … a lot of clients lose money because they don’t understand how it’s working,” he said. He went on to claim that Milton only provided IT support for companies selling investments. He did not respond to follow-up questions.

David Todua, a 38-year-old Georgian-born Israeli citizen, is a frequent visitor to the call center office in Mandarin Plaza, where according to Alexey the staff knew him as one of Milton Group’s owners.

Alexey said he saw Todua there at least six times, including once in November 2019, when he congratulated the staff on their performance and said Milton had brought in $50 million that year to date. The whistleblower said Todua always travelled with multiple bodyguards.

No official documents connect Todua to the scam call center, which on paper is owned by a different Georgian, Irakli Dadivadze. OCCRP was unable to track down any information about him.

However, Todua does own Naspay, a Cyprus-based payment platform through which Milton processes many of its “investments,” internal documents show.

At the firm’s New Year’s party, a man named David was called up to the stage by Keselman, the CEO, identified as the company’s “father,” and presented with a cake with three candles in it, representing the three years Milton Group had been in operation. The whistleblower identified this “father” as David Todua.

“In December, the company turned three years old,” Keselman said, according to an audio recording of the event obtained by OCCRP. “We are big kids, and our father is proud of us, while we are proud of him. And firstly [we] want to say a big thank you, David. And we want to give a cake, because what birthday is without a cake? And David will blow out the candle today.”

Todua told OCCRP he had been at the firm’s New Year’s party as a guest of Keselman, but denied holding any role in the company. “I am not father of any company, I am a proud father of 5 children,” he said.

On Instagram, he calls himself david_todua_007 and poses with a golden Kalashnikov, shoots with a sniper rifle, celebrates birthdays with a champagne tower, and posts photos of expensive cars parked outside his home. (“Hunting is indeed one of my hobbies,” he told OCCRP.)

He also has business ties with a surprising number of politicians from several countries, including ministers and other figures from the United National Movement party, which governed Georgia under President Mikheil Saakashvili for almost a decade until 2012. Saakashvili later became a Ukrainian citizen and forged a political career in the country.

Little is known about Todua’s life in Israel, where he migrated with his family in 1993, but court records and posts from his social media accounts show that he lived until recently in a villa near Tel Aviv. Today he lives in Cyprus.

In Albania, which boasts a 400-strong call center that also appears to be linked to Milton Group, the company operating it is owned by an adviser to a senior minister.

?The Georgian Connections

Although David Todua’s family left Georgia for Israel when he was just 11, as an adult he has ties to a surprising number of prominent political figures from his home country.

Most notably, his business partner in two Ukrainian companies is Davit Kezerashvili, an ex-defense minister and former chief of Georgia’s financial police under Saakashvili.

Todua and Kezerashivili co-own Project Partners, a real-estate and construction firm that is based out of a neighboring office building in Kyiv as Milton Group. Its head is Gia Getsadze, a former deputy justice minister in both Georgia and Ukraine.

Project Partners, in turn, co-owns a construction and civil engineering firm, Elitekomfortbud, with another former Georgian official, Petre Tsiskarishvili, a minister of agriculture under Saakashvili and a former leader of his United National Movement party.

Kezerashvili was charged in 2013 with accepting some $12 million in bribes to turn a blind eye to massive smuggling of alcohol from Ukraine to Georgia. He was ultimately cleared of the charges, which he says were politically motivated, but continues to live outside Georgia.

OCCRP has found no evidence that any of the former ministers are involved in the call center. In an email, Kezerashvili said he had never heard of Milton Group and had no knowledge of its activities, but confirmed that he was a business partner of Todua.

“You Will Never Regret This Decision”

Milton Group’s Kyiv call center does not appear unusual at first glance: Hundreds of phone sellers sit side by side, headsets on, using modern telephone and customer management systems.

Workers make up to 300 calls a day to clients around the world in an attempt to reach their monthly sales targets and secure bonuses.

The center is split into different sales desks by language — including Russian, English, Italian, and Spanish — each targeting their own areas of the world. Sellers use so-called “stage names” to build trust with the person on the other end of the call: A Senegalese man on the German desk goes by the name “Todd Kaiser,” while a Ukrainian woman whose real name is Daria calls herself “Diana Swan” or “Kira Lively.”

But undercover footage from inside Mandarin Plaza, as well as leaked internal documents, confirm that Milton was no ordinary call center.”

It is protected by burly guards and personal mobile phones are forbidden.

On the walls, next to posters of sports cars, a whiteboard sets out sellers’ monthly targets: $40,000 for the Russian market; $60,000 for Spanish, and $100,000 for those working the English-speaking desk.

The staffers in the sales department are provided with a set of notes explaining exactly how to target “clients” by nationality.

Scandinavians, the notes say, are mostly “old people and they really need someone to talk to.”

People from the UK, Australia, and New Zealand, on the other hand, like to believe they know everything and are certain that their countries are the best in the world, so call center workers are advised to pump them up.

“The only way to Handle [sic] such people is not to argue with them on whatever direction they take and make them feel that they are intelligent,” the notes explain.

“Later talk to them about how important the financial market has become because of great countries like Australia, UK, and New Zealand.”

“You will never regret this decision” is another line suggested to entice customers.

Those targeted by Milton Group are offered the chance to invest in cryptocurrency, stocks, or foreign currencies through a variety of different “brands,” all of which have generic-sounding names and similar websites, and are moved out of the rotation over time. Recently, Milton Group’s brands have included CryptoMB, Cryptobase, and VetoroBanc. All have been subject to recent investor warnings from regulators in the UK, Italy, and Spain.

The precise relationship between the call center and the brands they market is not always clear. Brands are sometimes not associated with any legal entity; when they are, they hide behind offshore secrecy. CryptoMB and VetoroBanc are run by offshore firms in the Marshall Islands and St. Vincent & Grenadines, respectively, while OCCRP could find no evidence that Cryptobase was tied to any specific company.

Alexey told journalists that the supposed VetoroBanc was entirely fabricated inside the Milton offices, with the name chosen by the Italian retention manager because it sounded “like one of the Italian banks.” The VetoroBanc website uses stock images for its staff that appear to have been taken from the internet. “Sylvia Moreno,” a supposed market analyst, is in fact an American pediatrician.

Alexey explained that staff had no specific expertise in financial products, but were carefully taught to sell “emotions.”

“It doesn’t matter which emotions, positive or negative: You can sell those fake products if people are really thinking about that,” he explained.

Clients were often shown huge profits to encourage them to invest further funds, but the money was always just numbers on a screen, the whistleblower explained. The only time victims were allowed to receive any of their funds back was in order to encourage an even bigger investment.

The most promising — and vulnerable — investors were passed on to the “retention team,” where the top salesmen work.

Their job is to “squeeze the money from the clients to the last cent,” Alexey explained, pushing them to borrow money and sell their cars and apartments. In one case, he said, a heavily pregnant Russian woman was convinced to hand over the small nest egg she had scraped together for her baby.

The most prolific and ingenious scammer at Milton Group is a man on the retention team who tells prospective investors his name is “William Bradley.”

In fact, he is a young Iranian who uses images of well-known US salesman and motivational speaker Marc Wayshak — who dubs himself “America’s sales strategist” — to disguise his identity on video calls.

OCCRP was unable to verify his real name, but at work and on social media he goes by “Hamze” and speaks fluent Farsi. Alexey claimed he takes in a massive $450,000 a month.

The call center’s internal customer database tracks how much each client has “invested,” as well as the potential to extract more money from them. Comments seen by OCCRP are laced with profanities and details of clients’ vulnerabilities.

One reads: “I saw 800 EUR in his bank and he is sick, he have problem and he told me I want someone fuck me and I said Foster [another call center operator] will fuck you.”

Another reads: “Getting fucked every month for at least 1000 EUR. Gets pension on the 20th/works every tuesday.”

Notes from the Milton Group’s internal customer database describing the situation of one of their victims, Östen Morian. Credit: Alexander Mahmoud/DN

Of another man, a call center staffer wrote: “Very Old man/pushed him to get the commission payment, hoping he can sort that out today, should call back at 3pm Sweden time.”

A month later, another note appears: “He is at his friend’s home because he doesn’t have money for food. Call him back on Monday, lost 400 k.”

That client was 75-year-old Östen Morian, a retired carpenter who lives close to the Arctic Circle in remote northern Sweden.

Contacted by DN, Morian confirmed he had lost around 400,000 Swedish krona (about $41,000) to the scammers after taking out loans, at 39 percent interest, to make what turned out to be fake investments. He was left heavily indebted.

“I don’t know what I can do,” he said. “Wait to die only.”

Go here for citations, photos and video

 

Armed Guard of Concentration Camp from Tennessee Ordered Deported

WASHINGTON – A U.S. Immigration Judge in Memphis, Tennessee has issued a removal order against a German citizen and Tennessee resident, based on his service in Nazi Germany in 1945 as an armed guard of concentration camp prisoners in the Neuengamme Concentration Camp system (Neuengamme).

After a two-day trial, U.S. Immigration Judge Rebecca L. Holt issued her opinion finding Friedrich Karl Berger removable under the Immigration and Nationality Act because his “willing service as an armed guard of prisoners at a concentration camp where persecution took place” constituted assistance in Nazi-sponsored persecution. The court found that Berger served at a Neuengamme sub-camp near Meppen, Germany, and that the prisoners there included “Jews, Poles, Russians, Danes, Dutch, Latvians, French, Italians, and political opponents” of the Nazis.

Judge Holt found that Meppen prisoners were held during the winter of 1945 in “atrocious” conditions and were exploited for outdoor forced labor, working “to the point of exhaustion and death.” The court further found, and Berger admitted, that he guarded prisoners to prevent them from escaping during their dawn-to-dusk workday, and on their way to and from the worksites. At the end of March 1945, with the advance of British and Canadian forces, the Nazis abandoned Meppen. The court found that Berger helped guard the prisoners during their forcible evacuation to the Neuengamme main camp – a nearly two-week trip under inhumane conditions which claimed the lives of some 70 prisoners.

***

Built in December 1938 by one hundred inmates transferred from Sachsenhausen concentration camp, Neuengamme concentration camp was established around an empty brickworks in Hamburg-Neuengamme. The bricks produced there were to be used for the “Fuehrer buildings”, part of the National Socialists’ redevelopment plans for the river Elbe in Hamburg.

1943

Until June 4th, 1940, Neuengamme was a sub-camp of Sachsenhausen. At this date Neuengamme became an independent concentration camp, under the direct control of the overseer of concentration camps. The prisoners worked on the construction of the camp and the brickworks, regulating the flow of the Dove-Elbe river and the building of a branch canal, as well as on the mining of clay. The number of inmates increased dramatically in only a few months: in 1940, the population of the camp was 2,000 prisoners (with a proportion of 80% German inmates among them), Between 1940 and 1945, more than 95,000 prisoners were incarcerated in Neuengamme. On April 10th, 1945, the number of prisoners in the camp itself was 13,500. More than 2,000 men and 10,300 women were working in the different sub-camps depending on Neuengamme SS administration.

***

“Berger was part of the SS machinery of oppression that kept concentration camp prisoners in atrocious conditions of confinement,” said Assistant Attorney General Brian A. Benczkowski of the Department of Justice’s Criminal Division. “This ruling shows the Department’s continued commitment to obtaining a measure of justice, however late, for the victims of wartime Nazi persecution.”

The investigation was initiated by DOJ’s Human Rights and Special Prosecution Section (HRSP) and was conducted in partnership with ICE’s Homeland Security Investigations Human Rights Violators and War Crimes Center and HSI’s Nashville Special Agent in Charge office.

“The investigation of human rights violations and those who engage in these heinous acts, continues to be a focus for Homeland Security Investigations and this successful outcome is an example of those efforts” stated Jerry C. Templet Jr, Special Agent in Charge, HSI Nashville.

The removal case was jointly tried by attorneys in ICE New Orleans Office of the Principal Legal Advisor (Memphis), and attorneys from DOJ’s HRSP, with the assistance of the Human Rights Violators and War Crimes Center.

Established in 2009, ICE’s Human Rights Violators and War Crimes Center furthers ICE’s efforts to identify, locate and prosecute human rights abusers in the United States, including those who are known or suspected to have participated in persecution, war crimes, genocide, torture, extrajudicial killings, female genital mutilation and the use or recruitment of child soldiers. The HRVWCC leverages the expertise of a select group of agents, lawyers, intelligence and research specialists, historians and analysts who direct the agency’s broader enforcement efforts against these offenders.

Since 2003, ICE has arrested more than 450 individuals for human rights-related violations of the law under various criminal and/or immigration statutes. During that same period, ICE obtained deportation orders against and physically removed 1034 known or suspected human rights violators from the United States. Additionally, ICE has facilitated the departure of an additional 160 such individuals from the United States.

Currently, HSI has more than 180 active investigations into suspected human rights violators and is pursuing more than 1,640 leads and removal cases involving suspected human rights violators from 95 different countries. Since 2003, The HRVWCC has issued more than 76,000 lookouts for individuals from more than 110 countries and stopped over 315 human rights violators and war crimes suspects from entering the U.S.

DOJ New Unit to Strip US Citizenship of Criminals and Terrorists

 

Hoorah…it is a great start.

new unit staffed with an estimated 30 lawyers will review cases that point to those that fraudulently obtained citizenship by failing to disclose past convictions for serious crimes — including terrorism and war crimes.

The section, which will be within the DOJ’s Office of Immigration Litigation, will be dedicated to denaturalizing those who had failed to disclose they had been involved in criminal activity on their N-400 form for naturalization. It requires the government to show that citizenship was obtained illegally or “procured by concealment of a material fact or by willful misrepresentation.”

Form N-400 | Gastelum Law

That form includes questions asking whether an applicant has been involved in genocide and torture among other serious crimes, if they have ever been part of a terrorist or totalitarian organization, if they had been associated with the Nazi government in Germany, and if they have been charged or convicted with a crime or served prison time. Targets for denaturalization are those who have made material breaches of those questions.

“When a terrorist or sex offender becomes a U.S. citizen under false pretenses, it is an affront to our system — and it is especially offensive to those who fall victim to these criminals,” Assistant Attorney General Jody Hunt said. “The new Denaturalization Section will further the Department’s efforts to pursue those who unlawfully obtained citizenship status and ensure that they are held accountable for their fraudulent conduct.”

The department has seen an increase in such cases both because of an increased effort by U.S. Citizenship and Immigration Services (USCIS) to root out fraud, as well as Operation Janus — an operation which began during the Obama administration and that identified hundreds of thousands of cases where paper fingerprint data was not entered into the centralized fingerprint database.

Officials have pointed to recent cases whereby the DOJ has secured the denaturalization of terrorists, war criminals and sex offenders. They include:

  • An individual convicted of terrorism in Egypt who admitted recruiting for Al Qaeda in the U.S. He was denaturalized while in Egypt and had his passport taken away from him.
  • An individual who received military training in an Afghan jihadist camp and coordinated with 9/11 mastermind Usama Bin Laden. He “self-deported” to Somaliland.
  • An individual who was convicted in Bosnia of executing eight unarmed civilians and prisoners of war during the Balkans conflict. He was denaturalized while serving a sentence in Bosnia.
  • One individual who engaged in sexual contact with a 7-year-old family member and another who sexually abused a minor for multiple years.

The department has filed 228 civil denaturalization cases since 2008, and 94 since 2017. Officials say it has increased its filing rate by 200 percent in the past three years and has seen an increase in referrals by over 600 percent.

Such denaturalization proceedings are not targeted at people who commit crimes after they become citizens, only those who have made fraudulent citizenship applications and left out crimes they committed on that form. A number of cases involve those who were initially denied entry to the U.S. or removed from the country, only to re-enter under a false identity.

Citizens cannot be deported, but those who have been stripped of citizenship revert back to permanent residency status, which allows deportation or barring of entry from the U.S. in the case of serious criminal offenses. Source