Category Archives: Treasury

US Treasury’s Evidence Iran and Russia Cooperating in Syria

Posted on by

The U.S. Treasury Department sanctioned nine targets last week related to an illicit oil network between Iran and Russia.

“We are acting against a complex scheme Iran and Russia have used to bolster the [Bashar] Assad regime and generate funds for Iranian malign activity,” said Treasury Secretary Steven Mnuchin. “Central Bank of Iran officials continue to exploit the international financial system, and in this case even used a company whose name suggests a trade in humanitarian goods as a tool to facilitate financial transfers supporting this oil scheme.

“The United States is committed to imposing a financial toll on Iran, Russia and others for their efforts to solidify Assad’s authoritarian rule, as well as disrupt the Iranian regime’s funding of terrorist organizations,” he added.

Experts said this move was crucial in combating the Iranian threat.

“The scheme uncovered by the Treasury Department shows just how closely Iran and Russia are cooperating to not only help prop up the Assad regime financially, but to help finance the leading players in Iran’s global terrorism,” Boris Zilberman of the Foundation for Defense of Democracies told JNS. “So when Russia talks about cooperating with the United States to counter-terrorism this is empty rhetoric plain and simple.”

“As this scheme shows, Russia works hand in hand with some of the very terror groups we seek to counter,” he continued. “Russia is not a partner in our counter-terrorism efforts, but is, in fact, an adversary.”

“There are already sanctions on Russian arms exporters, but the United States should continue to uncover and sanction schemes such as this,” added Zilberman. “The administration could also consider, in conjunction with Israel, striking destabilizing arms transfers by Hezbollah.

“It’s an important step, and highlights just how much [Russian President Vladimir] Putin has supported Iran, Hezbollah and Assad, and how committed he is, despite hopes that Putin’s partnership with Iran is skin-deep short-lived,” the Washington Institute for Near East Policy’s Anna Borshchevskaya told JNS.

“Hard to tell if this pressure will succeed without being incorporated into a broader strategy,” she continued. “It comes as no surprise that the Kremlin said earlier this month it will continue to help Iran trade oil. It’s possible to imagine Moscow setting up another intermediary to continue shipping oil to the Syrian regime, but nonetheless, this is an important step.”

The State Department joined Treasury in sending a message to the Islamic Republic.

Islamic State crisis: US hits IS oil targets in Syria ...

“The sanctions levied today directly target the Iranian regime’s exploitation of the international financial system to hide revenue streams it uses to fund terrorist activity, provide support for sectarian militias responsible for abuses against civilian populations and destabilize the region,” said the department in a statement. “The Iranian regime, Iranian-commanded forces inside Syria and the proxy terrorist groups it supports such as those targeted today continue to foment instability to extend their malign influence. These actions by the Iranian and Assad regimes undermine the legitimate processes to resolve the conflict in Syria.”

This development preceded Secretary of State Pompeo blasting Iranian President Hassan Rouhani on Monday for calling Israel a “cancerous tumor” and a “fake regime.”

“This is a dangerous and irresponsible step that will further deepen Iran’s isolation,” warned Pompeo.

“The Iranian regime is no friend of America or Israel when they repeatedly call for the death of millions, including Muslims,” he added. “The Iranian people know better and do not agree with their government, which has badly represented them to the world for 39 years. The people have suffered under this tyranny for far too long.”

*** It is quite right that Iran is no friend of the United States or Israel. That Obama/Kerry nuclear deal was supposed to lay the groundwork for Iran to be a good citizen of the world….read on…not so much.

***

Two Iranian Men Indicted for Deploying Ransomware to Extort Hospitals, Municipalities, and Public Institutions, Causing Over $30 Million in Losses

A federal grand jury returned an indictment unsealed today in Newark, New Jersey charging Faramarz Shahi Savandi, 34, and Mohammad Mehdi Shah Mansouri, 27, both of Iran, in a 34-month-long international computer hacking and extortion scheme involving the deployment of sophisticated ransomware, announced Deputy Attorney General Rod J. Rosenstein, Assistant Attorney General Brian A. Benczkowski of the Justice Department’s Criminal Division, U.S. Attorney Craig Carpenito for the District of New Jersey and Executive Assistant Director Amy S. Hess of the FBI.

The six-count indictment alleges that Savandi and Mansouri, acting from inside Iran, authored malware, known as “SamSam Ransomware,” capable of forcibly encrypting data on the computers of victims.  According to the indictment, beginning in December 2015, Savandi and Mansouri would then allegedly access the computers of victim entities without authorization through security vulnerabilities, and install and execute the SamSam Ransomware on the computers, resulting in the encryption of data on the victims’ computers.  These more than 200 victims included hospitals, municipalities, and public institutions, according to the indictment, including the City of Atlanta, Georgia; the City of Newark, New Jersey; the Port of San Diego, California; the Colorado Department of Transportation; the University of Calgary in Calgary, Alberta, Canada; and six health care-related entities: Hollywood Presbyterian Medical Center in Los Angeles, California; Kansas Heart Hospital in Wichita, Kansas; Laboratory Corporation of America Holdings, more commonly known as LabCorp, headquartered in Burlington, North Carolina; MedStar Health, headquartered in Columbia, Maryland; Nebraska Orthopedic Hospital now known as OrthoNebraska Hospital, in Omaha, Nebraska and Allscripts Healthcare Solutions Inc., headquartered in Chicago, Illinois.

According to the indictment, Savandi and Mansouri would then extort victim entities by demanding a ransom paid in the virtual currency Bitcoin in exchange for decryption keys for the encrypted data, collecting ransom payments from victim entities that paid the ransom, and exchanging the Bitcoin proceeds into Iranian rial using Iran-based Bitcoin exchangers.  The indictment alleges that, as a result of their conduct, Savandi and Mansouri have collected over $6 million USD in ransom payments to date, and caused over $30 million USD in losses to victims.

“The Iranian defendants allegedly used hacking and malware to cause more than $30 million in losses to more than 200 victims,” said Deputy Attorney General Rosenstein.  “According to the indictment, the hackers infiltrated computer systems in 10 states and Canada and then demanded payment. The criminal activity harmed state agencies, city governments, hospitals, and countless innocent victims.”

“The allegations in the indictment unsealed today—the first of its kind—outline an Iran-based international computer hacking and extortion scheme that engaged in 21st-century digital blackmail,” said Assistant Attorney General Benczkowski.  “These defendants allegedly used ransomware to infect the computer networks of municipalities, hospitals, and other key public institutions, locking out the computer owners, and then demanded millions of dollars in payments from them. As today’s charges demonstrate, the Criminal Division and its law enforcement partners will relentlessly pursue cybercriminals who harm American citizens, businesses, and institutions, regardless of where those criminals may reside.”

“The defendants in this case developed and deployed the SamSam Ransomware in order to hold public and private entities hostage and then extort money from them,” said U.S. Attorney Carpenito.  “As the indictment in this case details, they started with a business in Mercer County and then moved on to major public entities, like the City of Newark, and healthcare providers, like the Hollywood Presbyterian Medical Center in Los Angeles and the Kansas Heart Hospital in Wichita—cravenly taking advantage of the fact that these victims depend on their computer networks to serve the public, the sick, and the injured without interruption.  The charges announced today show that the U.S. Attorney’s Office for the District of New Jersey will continue to act to disrupt such criminal acts, and identify those who are responsible for them, no matter where in the world they may seek to hide.”

“This indictment demonstrates the FBI’s continuous commitment to unmasking malicious actors behind the world’s most egregious cyberattacks,” said Executive Assistant Director Hess.  “By calling out those who threaten American systems, we expose criminals who hide behind their computer and launch attacks that threaten our public safety and national security.  The actions highlighted today, which represent a continuing trend of cyber criminal activity emanating from Iran, were particularly threatening, as they targeted public safety institutions, including U.S. hospital systems and governmental entities.  The FBI, with the assistance of our private sector and U.S. government partners, are sending a strong message that we will work together to investigate and hold all criminals accountable.”

Savandi and Mansouri are charged with one count of conspiracy to commit wire fraud, one count of conspiracy to commit fraud and related activity in connection with computers, two substantive counts of intentional damage to a protected computer and two substantive counts of transmitting a demand in relation to damaging a protected computer.

According to the indictment, Savandi and Mansouri created the first version of the SamSam Ransomware in December 2015, and created further refined versions in June and October 2017.  In addition to employing Iran-based Bitcoin exchangers, the indictment alleges that the defendants also utilized overseas computer infrastructure to commit their attacks.   Savandi and Mansouri would also use sophisticated online reconnaissance techniques (such as scanning for computer network vulnerabilities) and conduct online research in order to select and target potential victims, according to the indictment.  According to the indictment, the defendants would also disguise their attacks to appear like legitimate network activity.

To carry out their scheme, the indictment alleges that the defendants also employed the use of Tor, a computer network designed to facilitate anonymous communication over the internet.  According to the indictment, the defendants maximized the damage caused to victims by launching attacks outside regular business hours, when a victim would find it more difficult to mitigate the attack, and by encrypting backups of the victims’ computers.  This was intended to—and often did—cripple the regular business operations of the victims, according to the indictment.  The most recent ransomware attack against a victim alleged in the indictment took place on Sept. 25, 2018.

This case was investigated by the FBI’s Newark Field Office.  Senior Counsel William A. Hall Jr. of the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorney and Chief of the Cybercrimes Unit Justin S. Herring of the District of New Jersey are prosecuting the case.  The Department thanks its law enforcement colleagues at the National Crime Agency (UK), West Yorkshire Police (UK), Calgary Police Service (Canada), and the Royal Canadian Mounted Police.  Significant assistance was provided by the Justice Department’s National Security Division and the Criminal Division’s Office of International Affairs.

This the Reason N Korea Cancelled the Meeting?

Posted on by

The excuses both sides explain scheduling conflicts. C’mon, lil Kim is not exactly that busy to take a meeting with America, right? As North and South Korea have begin to dismantle 20 guard posts along the DMZ. South Korea has 60 such positions while North Korea has an estimated 160. Allegedly, all firearms have been already removed from the guard posts. Personnel is still there but it is said they are unarmed.

Back to that cancelled meeting….

 A satellite image of a secret North Korean ballistic missile base. The North has offered to dismantle a different major missile launching site while continuing to make improvements at more than a dozen others.CreditCreditCSIS/Beyond Parallel, via DigitalGlobe 2018

More detail is explained here.

What is the reason then? Missile sites….hummm

North Korea are still operating undeclared missile bases and even improving some of their missile sites instead of shutting them down.

The latest report from the Center for Strategic and International Studies in Washington said it had identified 13 of an estimated 20 secret missile operating bases inside North Korea.

They could be used to house ballistic missiles of various ranges, with the largest believed to be capable of striking anywhere in the United States.

The report, written by researcher Joseph Bermudez, said maintenance and minor infrastructure improvements have been observed at some of the sites.

The sites identified in the report are scattered in remote, mountainous areas across North Korea.

It even identified improvements being made to its Sakkanmol site, close to the border with South Korea.

President Trump is still hoping to persuade Pyongyang to give up its nuclear weapons and long-range missiles.

The North Korean leader Kim Jong Un and U.S. President Donald Trump pledged to work towards ‘denuclearization’ at their landmark June summit in Singapore.

Shortly after the summit, Trump tweeted that there was no longer a nuclear threat from North Korea.

North Korea declared its nuclear force ‘complete’ and halted missile and nuclear bomb testing earlier this year.

North Korea has said it has closed its Punggye-ri nuclear testing site and the Sohae missile engine test facility.

It also raised the possibility of shuttering more sites and allowing international inspections if Washington took ‘corresponding measures’.

Last week, North Korea called off a meeting with U.S. Secretary of State Mike Pompeo in New York.

The country’s state media said on Monday the resumption of some small-scale military drills by South Korea and the United States violated a recent agreement aimed at lowering tensions on the Korean peninsula.

‘Missile operating bases are not launch facilities,’ Bermudez wrote.

‘While missiles could be launched from within them in an emergency, Korean People’s Army (KPA) operational procedures call for missile launchers to disperse from the bases to pre-surveyed or semi-prepared launch sites for operations.’

None of the missile bases have been acknowledged by North Korea, and analysts say an accurate disclosure of nuclear weapons and missile capabilities would be an important part of any denuclearization deal.

 

U.S. Treasury Employee Arrested Charged with Leaking to Media

Posted on by

The official 18 page indictment is here.

US Treasury employee arrested, accused of leaking media secret information about suspicious financial transactions related to Paul Manafort, Russians

  • A U.S. Treasury employee has been arrested and charged with leaking to a BuzzFeed News reporter multiple secret reports about suspicious financial transactions.
  • The documents relate to former Trump campaign chief Paul Manafort, Trump campaign official Richard Gates, accused Russian agent Maria Butina, the Russian Embassy and suspected Russian money launderer Prevezon Alexander.
  • The accused employee, Natalie Mayflower Sours Edwards will face criminal charges in New York.

A U.S. Treasury employee has been arrested on charges that she leaked to BuzzFeed News multiple reports about suspicious financial transactions involving ex-Trump campaign chief Paul Manafort, law-enforcement officials said.

The highly confidential documents allegedly leaked by the employee also were related to former Trump campaign official Richard Gates, accused Russian agent Maria Butina, a suspected Russian money launderering entity and the Russian Embassy in Washington, according to a criminal complaint.

Natalie Mayflower Sours Edwards

Natalie Mayflower Sours Edwards, a 40-year-old senior advisor in Treasury’s financial crimes enforcement network who was arrested Tuesday, will face federal criminal charges in New York, officials said.

She is charged with unlawfully disclosing so-called suspicious activity reports, or SARS, and conspiracy to do the same. Both felony counts carry a maxmium potential sentence of five years in prison.

A Quinton, Virginia, resident, Edwards was released on a $100,000 personal recognizance bond after her presentment Wednesday afternoon in U.S. District Court for the Eastern District of Virginia. Under the conditions of her release, Edwards is barred from contacting reporters or handling documents belonging to her Treasury division without approval.

A lawyer for Edwards did not immediately respond to a request for comment.

SARS are used to alert Treasury officials and other authorities about financial transactions that may be related to criminal conduct, such as money laundering. Treasury’s FinCEN division, for which Edwards works, manages the collection of SARS. It is illegal for a government employee to disclose a SAR or its contents outside of the scope of their work.

The complaint against Edwards says that she started leaking “numerous SARS in October 2017” to an unidentified reporter, and continued doing so until this month.

She had “hundreds of electronic communications” with the reporter, “many via an encrypted application,” the complaint said.

After Edwards began leaking SARS, the journalist wrote about a dozen articles which mentioned the details of those reports, according to the complaint.

Articles cited in the complaint carry the bylines of Jason Leopold and Anthony Cormier, two BuzzFeed reporters, as well as other journalists at that media outlet.

The articles cited documents transactions pertaining to Manafort and Gates, both of whom have since pleaded guilty to financial crimes related to their consulting work for a pro-Russia political party in Ukraine.

They also related to Butina, who is currently being held without bond on charges of being a Russian agent, the accused money launderering real-estate entity Prevezon Alexander, and the Russian Embassy in Washington.

At the time of Edwards’ arrest, according to federal prosecutors in Manhattan, she “was in possession of a flash drive” that appeared to be the same device “on which she saved the unlawfully disclosed” SARS.

Also in her possession was “a cellphone containing numerous communications over an encrypted application in which she transmitted [SARS] and other sensitive government information” illegally, prosecutors said.

“When questioned by law enforcement officials [Tuesday], Edwards confessed she has provided [SARS] to [the reporter] via an encrypted application, through falsely denied knowing that [the reporter] intended to or did publish that information” through a news organization, the complaint said.

BuzzFeed News declined to comment. Leopold and Cormier did not immediately return requests for comment.

 

Items SecState Pompeo Manages in Dealing with N Korea

Posted on by
All is not so copacetic with North Korea. The United States has many channels of intelligence regarding North Korea and dealing with Kim Jung Un with many of the moving parts requires diplomatic artistry.
Below are but two examples and the prediction of a second summit between the United States and North Korea being noted, the logistics is a chess game.
Pompeo Meets North Korean Leader Kim Jong Un | One-News
FireEye has released a report stating the tools and techniques used by the group, “We believe APT38’s financial motivation, unique toolset, and tactics, techniques, and procedures (TTPs) observed during their carefully executed operations are distinct enough to be tracked separately from other North Korean cyber activity. There are many overlapping characteristics with other operations, known as “Lazarus” and the actor we call TEMP.Hermit; however, we believe separating this group will provide defenders with a more focused understanding of the adversary and allow them to prioritize resources and enable defense.”
In their official blog, the company further explained the distinction of the group from any other hackers out there. Foremost, the malware tools used overlap or are similar indicating the similar developer behind the scenes.
The general pattern used by APT38 was observed to be this way –
  • First, the information is gathered by targeting third-party vendors to understand the mechanics of their transactions.
  • Then, initial compromise takes place followed by internal reconnaissance, pivot to victim servers used for swift transactions.
  • After this, finally, the funds are transferred or stolen.
  • This group does not stop just there but it removes all the evidence that might help the authorities trace them back or know the exact way or methodology of the fraud.
FireEye addressed the threat the group poses to its targeted sector by stating, “APT38 is unique in that it is not afraid to aggressively destroy evidence or victim networks as part of its operations. This attitude toward destruction is probably a result of the group trying to not only cover its tracks but also to provide cover for money laundering operations.” The full 32 page report is here.
Meanwhile:

The U.S. Treasury Department last week sanctioned a Turkish company, two Turkish individuals, and a North Korean individual for violating UN sanctions on Pyongyang. These sanctions came just before Secretary of State Mike Pompeo’s fourth trip to North Korea in preparation for an anticipated second Trump-Kim summit.

Treasury targeted the Turkey-based company SIA Falcon International Group; the company’s chief executive officer, Huseyin Sahin; the company’s general manager, Erhan Culha; and North Korea’s economic and commercial counselor in Mongolia, Ri Song Un. The sanctions were issued pursuant to Executive Order 13551, which restricts trade in arms and luxury goods with North Korea. UN Security Council Resolution 1718 from 2006 also prohibits member states from conducting such trade.

In a press release, Treasury noted that SIA Falcon operates in Latvia. In February 2018, Treasury’s Financial Crimes Enforcement Network (FinCEN) named ABLV Bank of Latvia an institution of primary money laundering concern. FinCEN noted that ABLV “institutionalized money laundering as a pillar of the bank’s business practices” and conducted illicit financial transactions for North Korean procurement or export of ballistic missiles. Treasury did not confirm, however, that SIA Falcon’s Latvian branch office used ABLV’s bank services.

Treasury’s latest sanctions came the same day as The Rodong Sinmun, a North Korean state-run newspaper, published an article lambasting U.S. sanctions policy. Just days earlier, North Korea’s foreign minister, Ri Yong Ho, implored the UN Security Council to lift sanctions in response to Pyongyang’s moves to freeze missile and nuclear testing and to destroy the Punggye-ri test facility. However, until North Korea agrees to denuclearization and a full declaration of Pyongyang’s nuclear weapons program, facilities, and capabilities, Washington has confirmed it will not ease sanctions pressure

After Secretary Pompeo’s latest trip to North Korea, Pyongyang’s media outlets suggested U.S.-North Korea relations are improving. Of course, these latest designations, as well as ongoing U.S. diplomatic efforts to ensure international compliance with UN sanctions, could stir further tensions. Despite these risks, the sanctions send a useful message to Pyongyang that the Trump administration will not back down until the Kim regime meets its core demands. Hat tip FDD.

Hezbollah Financier Arrested in Tri-Border Area

Posted on by

(New York, NY) – Prominent Hezbollah financier Assad Ahmad Barakat, designated as a global terrorist by the U.S., was arrested Saturday in the border region between Brazil, Argentina, and Paraguay.

photo and more details here.

Barakat is wanted by Paraguayan authorities for identity theft and by Argentine authorities for money laundering on behalf of Hezbollah. He operated Hezbollah’s financial network in the Tri-Border Area (TBA) of South America, and owned several businesses that conducted money laundering activities to generate funds for the terrorist group. Barakat, who has close ties with Hezbollah’s leadership, was the group’s chief of military operations and fundraising in the TBA in the 1990s.

The U.S. Department of the Treasury designated “Assad Ahmad Barakat” as a Specially Designated Global Terrorist pursuant to Executive Order (E.O.) 13224 on June 10, 2004.

Assad Ahmad Barakat is a U.S.-designated key Hezbollah financier who has operated in the Tri-Border Area (TBA) of South America––the region that straddles the borders of Paraguay, Brazil, and Argentina.* Barakat, who has close ties with Hezbollah’s leadership, was the group’s chief of military operations and fundraising in the TBA in the 1990s.* He operated Hezbollah’s financial network in the region, and owned several businesses of his own that conducted money laundering activities to generate funds for the group.* Barakat was indicted by Paraguay in 2001, and served a six-and-a-half-year prison sentence in the country after he was arrested in Brazil in 2002.* He was released from Paraguayan custody in 2009.* He is wanted by Paraguayan authorities for identity theft and by Argentine authorities for money laundering on behalf of Hezbollah in an Argentine casino. In September 2018, Brazilian police arrested Barakat near the Paraguayan and Argentine borders.*

In the mid-1980s, Barakat immigrated from Lebanon to Paraguay to escape the Lebanese Civil War.* He soon began operating several businesses based in Ciudad del Este, Paraguay, including Apollo Import Export and Mondial Engineering and Construction, through which he conducted money laundering schemes to generate funds for Hezbollah.* Barakat also operated additional businesses based in Lebanon, Chile, and the United States, at times with the assistance of his brothers Hatem and Hamzi.* He also collected funds for Hezbollah by pressuring Lebanese shopkeepers in the TBA to pay a quota to the group under threat of putting their family members on a “Hezbollah blacklist.”* Barakat regularly sent large sums of money to the group in Lebanon and Iran and even personally carried funds to Lebanon, traveling with a Paraguayan passport as of 2000.*

In addition to his direct fundraising roles, Barakat reportedly served as the deputy financial director of a mosque in Brazil, as the deputy for another Hezbollah financial official, Ali Muhammad Kazan, and eventually as the primary liaison in the TBA for Hezbollah’s Secretary General Hassan Nasrallah.* He was also reportedly one of two individuals in charge of distributing counterfeit U.S. currency in the TBA.* As of 2001, Barakat reportedly traveled to Lebanon and Iran annually to meet with Hezbollah’s leadership.*

*** Born in Lebanon, his Place of residence is Foz do Iguacú, Brazil; Iquique, Chile; Ciudad del Este, Paraguay (as of 2006) currently in Brazilian custody.

Barakat was also involved in planning Hezbollah’s military operations. He was an organizer and key financier of Hezbollah’s 1994 bombing of the AMIA Jewish community center in Buenos Aires that killed 85 people and injured over 300.* Barakat relayed information to Hezbollah’s leadership about Arabs in the TBA who traveled to the United States or Israel. He regularly hosted and attended meetings with other senior Hezbollah leaders in the TBA, such as one meeting in Brazil in the fall of 2000 at which they discussed potential assassination plots. Authorities later discovered videos on Barakat’s personal computer of violent Hezbollah military operations in Lebanon.*

In 2001, Paraguay indicted Barakat on charges of association, abetment of crime, and tax evasion, and an international warrant was issued for his arrest. In response, Barakat fled the TBA that October.* However, he was arrested by Brazilian authorities in Foz do Iguaçu, Brazil, on June 22, 2002, and extradited to Paraguay that December, where he served a six and a half-year prison sentence.*

Barakat was designated as a Specially Designated Global Terrorist by the U.S. Department of the Treasury on June 10, 2004. Two of his businesses, Casa Apollo and Barakat Import Export Ltda., were also designated at the time for their involvement in generating support for Hezbollah.*

Barakat was released from Paraguayan custody in 2009, though Paraguay reportedly lost track of his whereabouts since.* According to the Brazilian Federal Police, Barakat continued to operate on behalf of Hezbollah in Argentina, Brazil, and Chile. Argentine police accused him of money laundering at a casino in the Argentine city of Puerto Iguazu. In August 2018, Brazil’s supreme court authorized Barakat’s arrest after Paraguay issued an arrest warrant. On September 21, 2018, Brazilian police announced they had arrested Barakat in Foz do Iguaco, Brazil, near the border with Paraguay and Argentina. It remains unclear whether or to where he may be extradited.