title: Drug Trafficker Charged With Possessing 15 Kilograms Of Cocaine In Hidden Compartment Of Car

component: USAO - New York, Southern

body_text: United States Attorney for the Southern District of New York, Jay Clayton, and Assistant Director in Charge of the New York Field Office of the Federal Bureau of Investigation (“FBI”), Christopher G. Raia, announced that EDDIE RUIZ has been charged with one count of possession with intent to distribute a controlled substance. RUIZ was arrested on August 29, 2025, and presented before U.S. Magistrate Judge Katharine H. Parker in Manhattan federal court on August 30, 2025. “As alleged, Eddie Ruiz was transporting over 15 kilograms of cocaine in a hidden compartment in his specially modified vehicle,” said U.S. Attorney Jay Clayton. “Sadly, drug trafficking involves a vast, sophisticated, international network full of players who are motivated by profit and have no regard for the lives they ruin. New Yorkers want that network broken and the players taken off the streets. Together with our law enforcement partners, the women and men of the Southern District of New York will do everything in our power to fight drug trafficking on behalf of New Yorkers.” “An authorized vehicle search revealed Eddie Ruiz allegedly possessed significant quantities of cocaine seemingly packaged for distribution that were hidden in storage compartments in the vehicle,” said FBI Assistant Director in Charge Christopher G. Raia. “Ruiz’s alleged intentions to introduce addictive narcotics to our neighborhoods greatly jeopardizes the health and wellbeing of those residents. During Operation Summer Heat, the FBI will continue to apprehend and interrupt any criminal who seeks to supply lethal substances to our communities.” As alleged in the Complaint: [1] On or about the afternoon of August 29, 2025, a member of New York state law enforcement pulled over a vehicle that RUIZ was driving in Sullivan County near Mamakating, New York, for several violations of New York’s Vehicle and Traffic Law. Following RUIZ’s suspicious behavior during that traffic stop, law enforcement officers approached the vehicle with a drug-detecting canine, which signaled that it had detected the scent of narcotics within. Law enforcement officers then began a roadside search of the vehicle and found a hidden compartment, also known as a “trap,” in its trunk. After partially opening the trap, the officers observed what appeared to be bricks of narcotics, as pictured below. Once the automobile was transported to a secure law enforcement location, the officers fully opened the trap and found it to contain 15 tightly wrapped rectangular packages, packaged consistently with distribution-level quantities of narcotics and weighing approximately one kilogram each. Field-testing of these packages, pictured below, was positive for cocaine. * * * RUIZ, 47, of New York, New York, is charged with one count of possession with intent to distribute cocaine, which carries a mandatory minimum sentence of 10 years in prison and a maximum sentence of life in prison. The minimum and maximum potential sentences in this case are prescribed by Congress and provided here for informational purposes only, as any sentencing of the defendant will be determined by a judge. Mr. Clayton praised the outstanding work of the FBI, and the New York State Police and their Troop F Community Stabilization Unit and Troop K Community Stabilization Unit. This case is being handled by the Office’s White Plains Division. Assistant U.S. Attorney Carmi Schickler is in charge of the prosecution. The charges contained in the Complaint are merely accusations, and the defendant is presumed innocent unless and until proven guilty. u.s._v._ruiz_complaint.pdf [1] As the introductory phrase signifies, the entirety of the text of the Complaint and the description of the Complaint set forth herein constitute only allegations, and every fact described should be treated as an allegation.


title: Norfolk Southern Agrees to Give Amtrak Trains Highest Priority Over Freight Trains and Make its Delay Records for Amtrak Trains Available to the Department of Justice

component: Civil Division

body_text: The Justice Department today announced a settlement with Norfolk Southern Corporation and Norfolk Southern Railway Company (together, Norfolk Southern) to resolve allegations that Norfolk Southern delayed Amtrak passenger trains on Amtrak’s Crescent Route in violation of federal law by failing to give Amtrak trains preference over freight trains. As a result of the settlement, the Justice Department has moved to dismiss its lawsuit against Norfolk Southern. As part of the settlement, Norfolk Southern agreed to provide all Amtrak trains the highest priority; train its employees to give priority to Amtrak trains; require supervisor approval for any dispatching decision that does not give priority to Amtrak trains in non-emergency situations; and provide records regarding delays suffered by Amtrak trains traveling on the Crescent Route controlled by Norfolk Southern. Norfolk Southern has also pledged to assist the Justice Department in determining the root cause of any delays to Amtrak Crescent Route trains. Norfolk Southern’s Vice President of Compliance will annually certify that Norfolk Southern is in compliance with the agreement and its obligations under the law to provide Amtrak trains preference. “Americans traveling by train are entitled to trips free from delays caused by railroads failing to give Amtrak preference over freight trains,” said Assistant Attorney General Brett Shumate of the Justice Department’s Civil Division. “The settlement reached today, as well as Norfolk Southern’s improved performance on Amtrak’s Crescent Route, demonstrates the Department of Justice’s commitment to protecting everyday American train passengers.” The Crescent Route, operated by Amtrak (also known as the National Railroad Passenger Corporation), is a 1,377-mile passenger line that stops at 33 cities and towns connecting rural areas in Virgina, North Carolina, South Carolina, Georgia, Mississippi, Alabama and Louisiana to each other and larger cities. Norfolk Southern controls 1,140 miles of rail line on the Crescent Route and handles dispatching for all trains along that segment. Approximately 304,000 passengers traveled on the Crescent Route during 2024 and year-over-year ridership has increased so far in 2025. According to the complaint filed on July 30, 2024, federal law requires all rail carriers that contract with Amtrak to provide Amtrak passenger trains preference over freight trains. The complaint alleges that Norfolk Southern regularly failed to do so, leading to widespread delays to train passengers. Since the Justice Department filed its complaint, passengers traveling on the Crescent Route have experienced widespread improvements. From 2024 to 2025, the number of delay minutes incurred by Amtrak’s Crescent trains has declined by 53%. Trial Attorneys Max Goldman, Paulina Stamatelos and Oliver McDonald of the Civil Division’s Consumer Protection Branch are handling the case. For more information about the Consumer Protection Branch and its enforcement efforts, visit www.justice.gov/civil/consumer-protection-branch . The claims asserted against defendants are allegations only and there has been no determination of liability.


title: Kosovo National Pleads Guilty To Operating An Online Criminal Marketplace

component: USAO - Florida, Middle

body_text: Tampa, Florida – United States Attorney Gregory W. Kehoe announces that Liridon Masurica (33, Gjilan, Kosovo), also known as “@blackdb,” has pleaded guilty to conspiracy to commit access device fraud. Masurica faces a maximum penalty of 10 years in federal prison. A sentencing date has not yet been set. According to the plea agreement, Masurica was the lead administrator of BlackDB.cc—an online criminal marketplace in operation from 2018 until 2025. The marketplace illegally offered for sale compromised account and server credentials, credit card information, and other personally identifiable information of individuals primarily located in the United States, including those located within the Middle District of Florida. Once purchased, cybercriminals used the items purchased on BlackDB.cc to facilitate a wide range of illegal activity, including tax fraud, credit card fraud, and identity theft. Masurica, a citizen and resident of Kosovo, was taken into custody by authorities in Kosovo on December 12, 2024, and later extradited to the United States pursuant to the extradition treaty between the United States and the Republic of Kosovo. His sentencing date has not yet been set. This case was led by the Federal Bureau of Investigation in cooperation with Kosovo Police’s Cybercrime Investigation Directorate. The FBI’s Legal Attaché Office in Sofia, Bulgaria and the Department of Justice’s Office of International Affairs provided substantial assistance in securing the arrest and extradition of Masurica. Special Prosecution of the Republic of Kosova and Kosovo Police’s Cybercrime Investigation Directorate also provided substantial assistance in Masurica’s arrest. The case is being prosecuted by Assistant United States Attorney Carlton C. Gammons.


title: Felon Indicted for Illegal Possession of a Firearm Following Arrest in Northwest

body_text: WASHINGTON – Tyzell Myrick, 29, of Bowie, Maryland, has been charged in an indictment, unsealed today in U.S. District Court, on a federal firearms charge as part of the “Make D.C. Safe and Beautiful” initiative, announced U.S. Attorney Jeanine Ferris Pirro. Myrick is charged federally with one count of unlawful possession of a firearm and ammunition by a felon. Joining in the announcement were Special Agent in Charge Anthony Spotswood of the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) and Chief Pamela A. Smith of the Metropolitan Police Department (MPD). According to court documents, on Aug. 17, 2025, at around midnight, MPD officers were on patrol in the U Street corridor when they noticed Myrick allegedly carrying a firearm in his waistband. The officers recovered a Glock 22 .40 caliber pistol, loaded with one round in the chamber and an additional 20 rounds in the magazine. Myrick is prohibited from possession of a firearm and ammunition due to a prior 2018 conviction for Hobbs Act robbery and brandishing a firearm during a crime of violence. This prosecution comes as part of the "Make D.C. Safe and Beautiful" initiative, which is surging resources to reduce violent crime in the District of Columbia. This initiative was created to address gun violence in the District, prioritize federal firearms violations, pursue tougher penalties for offenders, and seek detention for federal firearms violators. The case is being investigated by the ATF Washington Field Office and the MPD. Special Assistant U.S. Attorney David B. Liss is prosecuting the case. An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law. 25cr267


title: Prince George’s County Man Sentenced for Unemployment Insurance Fraud and Firearms, Drug Trafficking Crimes

body_text: Greenbelt, Maryland – District Judge Deborah L. Boardman sentenced Ahmed Hussain, 23, of Prince George’s County, Maryland, to 102 months in federal prison, followed by three years of supervised release. Judge Boardman also ordered Hussain to pay $557,078 in restitution. The sentence is in connection with Hussain’s convictions on conspiracy to commit wire fraud and aggravated identity theft charges, stemming from Hussain submitting fraudulent CARES Act unemployment insurance (UI) claims. Hussain’s sentence also covers Hussain’s convictions on felon in possession of a firearm and possession with intent to distribute a controlled substance charges. Kelly O. Hayes, U.S. Attorney for the District of Maryland, announced the sentence with Special Agent in Charge Troy W. Springer, National Capital Region, U.S. Department of Labor – Office of Inspector General (DOL-OIG); Special Agent in Charge Charles Doerrer, Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF); Special Agent in Charge William J. DelBagno, Federal Bureau of Investigation (FBI) – Baltimore Field Office; and Chief George Nader, Prince George’s County Police Department (PGPD). According to the plea agreement, beginning in 2021, and continuing until at least about September 2022, Hussain and his co-conspirators engaged in a scheme to defraud the United States, the State of Maryland, multiple financial institutions, and multiple individuals, including identity theft victims. The co-conspirators submitted false and fraudulent UI benefits claims to the Maryland Department of Labor (MD-DOL), Maryland’s agency that is responsible for processing the claims. As part of the conspiracy, the defendants fraudulently obtained more than $3.5 million in unemployment insurance benefits. Hussain personally participated in UI claims resulting in losses exceeding $550,000. He used debit cards issued in the names of aggravated identity theft victims to obtain UI fraud funds. Company 1, which provided professional support services to the MD-DOL to review UI claims and administer UI benefits, employed co-conspirators Bryan Nushawn Ruffin, 27, of Woodbridge, Virginia, and Kiara Smith, 28, of Fort Washington, Maryland. As detailed in the plea agreement, Hussain and his co-conspirators possessed and used computers that Company 1 issued to Ruffin and Smith to access non-public UI data and databases maintained by the MD-DOL. Ruffin and Smith then granted Hussain and his co-conspirators access to MD-DOL databases which they used to change information on existing UI claims. This included the contact email address, online account password, and payment method for existing UI claims. The co-conspirators furthered the scheme by using the identity theft victims’ personal identifying information (PII). They also used their access to the MD-DOL databases to upload and approve documents submitted in support of fraudulent UI claims, remove fraud holds on UI claims, certify weeks for determining UI benefits, and engage in other actions to facilitate the fraudulent UI benefits payments. During the scheme, the MD-DOL believed they were disbursing UI benefits to debit cards/accounts of UI applicants, but the accounts were actually opened and controlled by Hussain and his co-conspirators. Hussain also admitted that on November 16, 2022, while law enforcement executed a residential search warrant at his home, they found that he knowingly possessed a stolen black Honor Defense 9mm handgun. He possessed the firearm in relation to his drug-trafficking activities. Officers also found 60 pounds of marijuana, drug distribution baggies, and 229 rounds of ammunition of varying calibers in Hussain’s room. Prior to law enforcement finding him in possession of the firearm and ammunition, Hussain had been convicted — and knew he had been convicted — of an offense punishable by more than one year imprisonment. Therefore, Hussain was prohibited from possessing a firearm or ammunition. Co-Defendants Ruffin, Smith, and Zakria Hussain, 28, of Oxon Hill, Maryland, aka “Oso,” and Lawrence Nathanial Harris, 32, of Temple Hills, Maryland, aka “Manman” and “Biggbank,” already pled guilty and are awaiting sentencing. The District of Maryland COVID-19 Strike Force is one of five strike forces established throughout the United States by the U.S. Department of Justice to investigate and prosecute COVID-19 fraud, including fraud relating to the Coronavirus Aid, Relief, and Economic Security (CARES) Act. The CARES Act was designed to provide emergency financial assistance to Americans suffering the economic effects caused by the COVID-19 pandemic. The strike forces focus on large-scale, multi-state pandemic relief fraud perpetrated by criminal organizations and transnational actors. The strike forces are interagency law enforcement efforts, using prosecutor-led and data analyst-driven teams designed to identify and bring to justice those who stole pandemic relief funds. For more information about the Department’s response to the pandemic, visit justice.gov/coronavirus . Anyone with information about allegations of attempted fraud involving COVID-19 can report it by calling the Department of Justice’s National Center for Disaster Fraud (NCDF) Hotline at 866-720-5721 or via the NCDF Web Complaint Form at justice.gov/disaster-fraud/ncdf-disaster-complaint-form . U.S. Attorney Hayes commended the DOL-OIG, ATF, FBI, and PGPD, for their work in the investigation and the MD-DOL for its assistance. Ms. Hayes thanked Assistant U.S. Attorneys Harry M. Gruber, Paul A. Riley, Joseph L. Wenner, Christopher Sarma, and Special Assistant U.S. Attorney Lanay Mitchell who are prosecuting this case. She also recognized the Maryland COVID-19 Strike Force and Paralegal Specialist Joanna B.N. Huber for their valuable assistance. For more information about the Maryland U.S. Attorney’s Office, its priorities, and resources available to report fraud, visit justice.gov/usao-md and justice.gov/usao-md/community-outreach . # # #


title: Tangipahoa Parish Man Guilty of Violating Federal Controlled Substances Act

component: Drug Enforcement Administration (DEA)

body_text: NEW ORLEANS, LA – RODNEY BERRY (“BERRY”) , age 42, plead guilty on August 28, 2025, to violations of the Federal Controlled Substances Act before United States District Judge Barry Ashe, announced Acting U.S. Attorney Michael M. Simpson. BERRY plead guilty to Counts 1, 6, and 7 of the indictment pending against him. Count 1 charged BERRY with conspiracy to distribute, and possess with intent to distribute, controlled substances, in violation of Title 21 U.S.C. § 841(a)(1); § 841(b)(1)(A); § 841(b)(1)(B); and 846. Count 6 charged BERRY with illegal use of a communications facility, in violation of Title 21, U.S.C. §843(b) and Title 18, U.S.C. §2. Count 7 charged BERRY with possessing with intent to distribute 50 grams or more of a mixture containing a detectable amount of methamphetamine, in violation of Title 21 U.S.C. § 841(a)(1) and § 841(b)(1)(B). On Count 1, BERRY faces a minimum of 5 years and up to 40 years imprisonment, up to a $5,000,000 fine, and at least 4 years of supervised release following imprisonment. On Count 6, BERRY faces up to 4 years imprisonment, up to a $250,000 fine, and up to 1 year of supervised release following imprisonment. On Count 7, BERRY faces a minimum of 5 years and up to 40 years imprisonment, up to a $5,000,000 fine, and at least 4 years of supervised release following imprisonment. As to each charge, BERRY also faces payment of a mandatory $100 special assessment fee. According to the indictment, beginning at a time unknown, but continuing until at least September 10, 2024, BERRY and seven other individuals conspired to distribute, and possess with intent to distribute, fentanyl and methamphetamine throughout the Tangipahoa Parish region of the Eastern District of Louisiana. The conspiracy was carried out through wire and electronic communications. This effort is part of an Organized Crime Drug Enforcement Task Force (OCDETF) operation. OCDETF identifies, disrupts, and dismantles the highest-level criminal organizations that threaten the United States using a prosecutor-led, intelligence-driven, multi-agency approach. Additional information about the OCDETF Program can be found at http://www.justice.gov/OCDETF . Acting United States Attorney Simpson praised the work of the Drug Enforcement Administration, Homeland Security Investigations, the Hammond Police Department, the Jefferson Parish Sheriff’s Office, and the Tangipahoa Parish Sheriff’s Office. The prosecution is being handled by Assistant United States Attorney Lauren Sarver of the Narcotics Unit.


title: Man Pleads Guilty to Attempting to Use a Weapon of Mass Destruction and Attempting to Destroy an Energy Facility in Nashville

component: Federal Bureau of Investigation (FBI)

body_text: Skyler Philippi, 24, of Columbia, Tennessee, pleaded guilty today to attempting to use a weapon of mass destruction and attempting to destroy an energy facility. “For months, Philippi planned what he had hoped would be a devastating attack on Nashville’s energy infrastructure. He acquired what he believed to be explosives, surveilled his target, and equipped a drone to attack an electrical substation. Motivated by a violent ideology, Philippi wanted ‘to do something big.’ Instead, the FBI disrupted his plans, and Philippi now awaits sentencing,” said Assistant Attorney General for National Security John A. Eisenberg. “The National Security Division and the FBI will continue to protect our Nation’s critical infrastructure from would-be saboteurs.” “Our office is fully committed to thwarting dangerous attacks motivated by hate,” said Acting U.S. Attorney Robert E. McGuire for the Middle District of Tennessee. “I commend the agents who investigated this conduct and stopped this attack from victimizing our community. I commend the prosecutors who held the defendant accountable for his terrible actions.” “Skyler Philippi planned to attack an energy facility with a drone containing explosives, which had the potential to knock out power to thousands of American homes and to critical facilities like hospitals,” said Assistant Director Donald Holstead of the FBI’s Counterterrorism Division. “Through rigorous investigation, his plan was disrupted. Protecting our communities from threats to public safety is a priority for the FBI, and we will continue to work with our law enforcement partners to hold accountable those who attempt to damage critical infrastructure and threaten our national security.” According to court documents, in June 2024, Philippi communicated to a confidential human source (CHS) that he wanted to commit a mass shooting at a YMCA facility located in or around Columbia, Tennessee. In July 2024, Philippi told another CHS about the impact of attacking large interstate substations and said that attacking several substations would “shock the system,” causing other substations to malfunction. Philippi researched previous attacks on electric substations and concluded that attacking with firearms would not be sufficient. Philippi, therefore, planned to use a drone with explosives attached to it and to fly the drone into the substation. Philippi said that his plan was to fly a drone with explosives attached to it into the electric substation, that he preferred to build a drone himself to avoid law enforcement detection, and that he wanted to attach TATP (Triacetone Triperoxide, a high-energy explosive material) or C-4 explosive material to the drone. In August 2024, Philippi told an undercover employee (UCE) that he had written what he called a “manifesto” outlining his desire to attack “high tax cities or industrial areas to let the kikes lose money,” and about his previous affiliation with Atomwaffen Division and the National Alliance. In September 2024, Philippi conducted reconnaissance of a specific electric substation. Philippi ordered a plastic explosive composition known as C-4 and other explosives from the UCEs. Philippi purchased black powder to be used in pipe bombs, which Philippi intended to use during the attack on the substation. Philippi texted: “if you want to do the most damage as an accelerationist, attack high economic, high tax, political zones in every major metropolis.” Referring to the substation, Philippi stated, “Holy sh**. This will go up like a fu**in fourth of July firework.” On Nov. 2, 2024, Philippi met the undercover employees at a hotel and participated in a Nordic ritual, which included reciting a Nordic prayer and discussing the Norse god Odin. Philippi told the UCEs that “this is where the New Age begins” and that it was “time to do something big” that would be remembered “in the annals of history.” Philippi and the UCEs drove to the operation site. The UCEs moved to their assigned positions as lookouts for Philippi. Law-enforcement agents arrested Philippi. When he was taken into custody, Philippi was at the rear of the vehicle, with the drone powered up, and the explosive device was armed and located next to the drone. Philippi was prepared to attach the explosives to the drone when he was arrested. Sentencing is scheduled for Jan. 8, 2026. Philippi faces a maximum penalty of life in prison and a maximum fine of $250,000. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors. The FBI Nashville Field Office is investigating the case. Assistant U.S. Attorney Josh Kurtzman for the Middle District of Tennessee and Trial Attorneys Justin Sher and James Donnelly of the National Security Division’s Counterterrorism Section are prosecuting the case.


title: Columbia Man Pleads Guilty to Attempting to Use a Weapon of Mass Destruction and to Destroy an Energy Facility in Nashville

body_text: NASHVILLE – Skyler Philippi, 24, of Columbia, Tennessee, pleaded guilty today to attempting to use a weapon of mass destruction and attempting to destroy an energy facility. “For months, Philippi planned what he had hoped would be a devastating attack on Nashville’s energy infrastructure. He acquired what he believed to be explosives, surveilled his target, and equipped a drone to attack an electrical substation. Motivated by a violent ideology, Philippi wanted ‘to do something big.’ Instead, the FBI disrupted his plans, and Philippi now awaits sentencing,” said Assistant Attorney General for National Security John A. Eisenberg. “The National Security Division and the FBI will continue to protect our Nation’s critical infrastructure from would-be saboteurs.” “Our office is fully committed to thwarting dangerous attacks motivated by hate,” said Acting U.S. Attorney Robert E. McGuire for the Middle District of Tennessee. “I commend the agents who investigated this conduct and stopped this attack from victimizing our community. I commend the prosecutors who held the defendant accountable for his terrible actions.” “Skyler Philippi planned to attack an energy facility with a drone containing explosives, which had the potential to knock out power to thousands of American homes and to critical facilities like hospitals,” said Assistant Director Donald Holstead of the FBI’s Counterterrorism Division. “Through rigorous investigation, his plan was disrupted. Protecting our communities from threats to public safety is a priority for the FBI, and we will continue to work with our law enforcement partners to hold accountable those who attempt to damage critical infrastructure and threaten our national security.” “As he admitted in federal court today, in furtherance of his ideological beliefs, Skyler Philippi conducted extensive research into explosive devices and potential targets to launch an attack against critical infrastructure,” said Special Agent in Charge Joe Carrico of the FBI Nashville Field Office. “The FBI is committed to doing everything in our ability to detect, disrupt, and deter attacks by domestic violent extremists. It is thanks to the extraordinary efforts of the FBI Nashville Field Office’s Joint Terrorism Task Force, U.S. Attorney’s Office for the Middle District of Tennessee, and law enforcement partners that Philippi’s plot was detected and stopped.” According to court documents, in June 2024, Philippi communicated to a Confidential Human Source (CHS) that he wanted to commit a mass shooting at a YMCA facility located in or around Columbia, Tennessee. In July 2024, Philippi told another CHS about the impact of attacking large interstate substations and said that attacking several substations would “shock the system,” causing other substations to malfunction. Philippi researched previous attacks on electric substations and concluded that attacking with firearms would not be sufficient. Philippi, therefore, planned to use a drone with explosives attached to it and to fly the drone into the substation. Philippi said that his plan was to fly a drone with explosives attached to it into the electric substation, that he preferred to build a drone himself to avoid law enforcement detection, and that he wanted to attach TATP (Triacetone Triperoxide, a high-energy explosive material) or C-4 explosive material to the drone. In August 2024, Philippi told an undercover employee (UCE) that he had written what he called a “manifesto” outlining his desire to attack “high tax cities or industrial areas to let the kikes lose money,” and about his previous affiliation with Atomwaffen Division and the National Alliance. In September 2024, Philippi conducted reconnaissance of a specific electric substation. Philippi ordered a plastic explosive composition known as C-4 and other explosives from the UCEs. Philippi purchased black powder to be used in pipe bombs, which Philippi intended to use during the attack on the substation. Philippi texted: “if you want to do the most damage as an accelerationist, attack high economic, high tax, political zones in every major metropolis.” Referring to the substation, Philippi stated, “Holy sh**. This will go up like a fu**in fourth of July firework.” On Nov. 2, 2024, Philippi met the undercover employees at a hotel and participated in a Nordic ritual, which included reciting a Nordic prayer and discussing the Norse god Odin. Philippi told the UCEs that “this is where the New Age begins” and that it was “time to do something big” that would be remembered “in the annals of history.” Philippi and the UCEs drove to the operation site. The UCEs moved to their assigned positions as lookouts for Philippi. Law-enforcement agents arrested Philippi. When he was taken into custody, Philippi was at the rear of the vehicle, with the drone powered up, and the explosive device was armed and located next to the drone. Philippi was prepared to attach the explosives to the drone when he was arrested. Philippi will be sentenced on January 8, 2026. At sentencing, Philippi faces a maximum penalty of life in prison and a maximum fine of $250,000. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors. The FBI Nashville Field Office is investigating the case. Assistant U.S. Attorney Josh Kurtzman of the Middle District of Tennessee and Trial Attorneys Justin Sher and James Donnelly of the National Security Division’s Counterterrorism Section are prosecuting the case. # # # # #


title: California woman sentenced to 10 years in prison for drug charges on the Rocky Boy’s Indian Reservation

component: Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF)

body_text: GREAT FALLS – A California woman who trafficked significant amounts of drugs on the Rocky Boy’s Indian Reservation was sentenced yesterday to 120 months in prison followed by 5 years of supervised release, U.S. Attorney Kurt Alme said. Ashley Joceyln Cortez, 25, pleaded guilty in April 2025 to conspiracy to possess with intent to distribute controlled substances. Chief U.S. District Judge Brian M. Morris presided. The government alleged in court documents that from October 2023 until May 21, 2024, Cortez trafficked substantial amounts of methamphetamine, fentanyl, and cocaine to the Rocky Boy’s Indian Reservation. She made four trips for a co-defendant beginning in November 2023. Cortez estimated she transported 23 pounds of meth, 4,500 fentanyl pills, five ounces of fentanyl powder, and three ounces of cocaine. She also estimated she transported $230,000 and watched a co-defendant distribute drugs out of her house in Box Elder. On May 21, 2024, law enforcement executed a state search warrant at the co-defendant’s residence in Box Elder. During the execution of the search warrant, a law enforcement agent saw Cortez hiding in a bathroom with the water running. After detaining her, the agent noticed a large amount of methamphetamine and cocaine in the bathtub with the water running. It was apparent to the agent Cortez was attempting to destroy evidence. During the search, law enforcement seized approximately 64.5 grams of methamphetamine, approximately 98 grams of cocaine, and about 64 fentanyl pills. They also found approximately $8,800 in cash and a firearm. The U.S. Attorney’s Office prosecuted the case. The investigation was conducted by the FBI, ATF, Tri-Agency Task Force, Montana Division of Criminal Investigation, Chippewa Cree Law Enforcement Services, and Hill County Sheriff’s Office. This case is part of Project Safe Neighborhoods (PSN), a program bringing together all levels of law enforcement and the communities they serve to reduce violent crime and gun violence, and to make our neighborhoods safer for everyone. On May 26, 2021, the Department launched a violent crime reduction strategy strengthening PSN based on these core principles: fostering trust and legitimacy in our communities, supporting community-based organizations that help prevent violence from occurring in the first place, setting focused and strategic enforcement priorities, and measuring the results. For more information about Project Safe Neighborhoods, please visit Justice.gov/PSN . XXX


title: Former Army Soldier Sentenced to Concurrent Sentences of Life For Sexually Abusing Two Children

component: USAO - Georgia, Southern

body_text: Defendant faces a minimum of 30 years imprisonment SAVANNAH, GA: A former Army soldier was sentenced on Thursday, September 4, 2025, after sexually abusing two children on Fort Stewart Military Reservation in Georgia. Austin Michael Burak , 32, Oak Harbor, WA, was convicted of abusive sexual contact of a child and aggravated sexual abuse of a child following a jury trial in the Southern District of Georgia, said Meg E. Heap, U.S. Attorney for the Southern District of Georgia. U.S. District Court Chief Judge R. Stan Baker sentenced Burak to lifetime imprisonment for each of the two minor victims. “There are appropriately severe consequences for sexually assaulting children,” said U.S. Attorney Heap. “We will continue to aggressively prosecute those who prey on the most innocent among us. The community is safer now that a sexual predator will spend the rest of his life imprisoned.” As described in courtroom testimony, in August of 2017, Burak sexually abused and raped two minor boys while they slept in the safety of their own beds. Three other witnesses testified at trial to being sexually assaulted by Burak when they were minors, including one recounting years of sexual abuse at his hands. “The FBI is unwavering in its commitment to protect our most vulnerable—our children,” said Paul Brown, Special Agent in Charge of FBI Atlanta. “This sentence ensures that Austin Burak will never again have the opportunity to harm another child, and it demonstrates the dedication of our agents and law enforcement partners who work tirelessly to bring justice to survivors of these heinous crimes.” “The sentencing of Austin Burak represents a significant outcome in the pursuit of justice for the victims in this horrific case,” said Special Agent in Charge Michele Starostka of the Department of the Army Criminal Investigation Division’s Western Field Office. “Army CID worked diligently alongside our partners at the FBI and the U.S. Attorney’s Office in this case, and we remain steadfast in our dedication to protecting our communities.” The case was investigated by the Army Criminal Investigation Division at Joint Base Lewis-McChord, Washington, and the Federal Bureau of Investigation and prosecuted by Assistant United States Attorneys Sherri A. Stephan and Michael Z. Spitulnik.


title: Mexican man sentenced to prison for illegal reentry

component: USAO - Montana

body_text: MISSOULA – A Mexican man who was in the United States illegally was sentenced yesterday to 15 months imprisonment to be followed by 3 years of supervised release, U.S. Attorney Kurt Alme said. Rigonaldo Diaz-Chixna, 30, pleaded guilty in May 2025 to illegal reentry. U.S. District Judge Dana L. Christensen presided. The government alleged in court documents that on December 10, 2024, Diaz-Chixna, a Mexican citizen was arrested in Bozeman for obstructing a peace officer and for two outstanding warrants. Law enforcement officers conducted fingerprint analysis which confirmed Diaz-Chixna’s most recent removal from the United States was on or about July 19, 2022. This removal occurred after his felony conviction for illegal reentry on June 3, 2022, in the District of Montana. There is no indication in Department of Homeland Security files that Diaz-Chixna ever applied for or obtained the permission of the United States Attorney General or the Secretary of the Department of Homeland Security to reenter the United States. Assistant U.S. Attorney Shannon Clarke prosecuted the case. The investigation was conducted by the Department of Homeland Security and Bozeman Police Department. This case is part of Operation Take Back America a nationwide initiative that marshals the full resources of the Department of Justice to repel the invasion of illegal immigration, achieve the total elimination of cartels and transnational criminal organizations (TCOs), and protect our communities from the perpetrators of violent crime. Operation Take Back America streamlines efforts and resources from the Department’s Organized Crime Drug Enforcement Task Forces (OCDETFs) and Project Safe Neighborhood (PSN). XXX


title: Ocoee Man Sentenced To 3 Years In Federal Prison For Operating Fraudulent Tax Preparation Business

body_text: Orlando, FL – U.S. District Judge Roy B. Dalton has sentenced James Fednor Meristin to three years in federal prison for conspiracy to defraud the United States. The Court also ordered Meristin to pay $2,338,675 in restitution to the Internal Revenue Service. Meristin pled guilty on May 6, 2025. According to court documents, Meristin and other co-conspirators operated a tax preparation business, Kings and Queens Multi Services, between 2019 and 2023, which prepared and filed false and fraudulent tax returns for its clients. These fraudulent returns were designed to maximize client refunds by, among other things, claiming COVID-related sick and family leave credits for which the taxpayer was not entitled. Because of the excessive returns generated for their clients, Meristin and his co-conspirators were able to charge and receive exorbitant fees for their tax preparation services, including as high as $20,000 per return. Meristin also admitted to deficiencies and fraudulent items in his own tax returns. “Filing false tax returns is stealing from the U.S. government,” said Special Agent in Charge Ron Loecker, IRS Criminal Investigation Tampa Field Office. “Whether it is the taxpayer or tax preparer defrauding the government, IRS Criminal Investigation special agents will continue pursing and holding accountable individuals who violate our tax system.” This case was investigated by the Internal Revenue Service - Criminal Investigation. It was prosecuted by Assistant United States Attorney Robert D. Sowell.


title: Metairie Man Guilty of Possessing Materials Involving Sexual Exploitation of Minors and Violating Federal Gun Control Act

body_text: NEW ORLEANS, LOUISIANA – Acting U.S. Attorney Michael M. Simpson announced that ROBERT ANTHONY MARSH, JR.(“MARSH”) , age 60, of Metairie, pled guilty on August 26, 2025, to Possession of Materials Involving the Sexual Exploitation of Minors, in violation of Title 18, United States Code, Section 2252(a)(4)(B) and (a)(2), and Possession of a Firearm by a Convicted Felon, in violation of Title 18, United States Code, Sections 922(g)(1) and 924(a)(8). As to the possession of sexual exploitation materials, MARSH faces a mandatory minimum sentence of ten (10) years and a maximum sentence of twenty (20) years imprisonment, and/or a fine of up to $250,000.00, a term of supervised release of no less than five (5) years and up to life, and a $100.00 mandatory special assessment fee. As to the firearm possession by a convicted felon, MARSH faces a maximum sentence of fifteen (15) years imprisonment, a fine of up to $250,000.00, up to three years of supervised release, and a $100.00 mandatory special assessment fee. According to court documents, on December 19, 2024, MARSH’s home was searched by state law enforcement officials and agents with the U.S. Department of Homeland Security, Homeland Security Investigations. At the time of this search, MARSH was on supervised release for a 2014 state conviction for Pornography Involving Juveniles. On December 19, 2024, following the search of his home, MARSH was arrested by Louisiana State Probation and Parole for possession of a Model 922 H&R Arms Co. firearm by a prohibited person and possession of child pornography. Thereafter, MARSH was transferred from state to federal custody in connection with this federal investigation. On August 26, 2025, MARSH pled guilty in federal court to knowingly possessing over 21 videos depicting the sexual victimization of minors and to knowingly possessing the firearm as a prohibited person. Sentencing in this matter is scheduled for November 18, 2025, before United States District Judge Darrel James Papillion. This case was brought as part of Project Safe Childhood, a nationwide initiative to combat the growing epidemic of child sexual exploitation and abuse launched in May 2006 by the Department of Justice. Led by United States Attorney’s Offices and the Criminal Division’s Child Exploitation and Obscenity Section (CEOS), Project Safe Childhood marshals federal, state and local resources to better locate, apprehend and prosecute individuals who exploit children via the Internet, as well as to identify and rescue victims. For more information about Project Safe Childhood, please visit www.projectsafechildhood.gov. Acting U.S. Attorney Simpson praised the work of the U.S. Department of Homeland Security, Homeland Security Investigations; the Bureau of Alcohol, Tobacco, Firearms and Explosives; the Jefferson Parish Police Department; and the Louisiana Department of Public Safety & Corrections, Probation and Parole. The prosecution of this case is being handled by Assistant U.S. Attorney Brian M. Klebba, Project Safe Childhood Coordinator and Chief of the Financial Crimes Unit. * * *


title: MONTGOMERY COUNTY MAN CONVICTED OF ROBBERY AND FIREARM OFFENSES

component: USAO - Pennsylvania, Middle

body_text: SCRANTON - The United States Attorney’s Office for the Middle District of Pennsylvania announced that Mohammed Zeidan, a/k/a “Mo,” age 36, of East Greenville, Pennsylvania, was convicted on September 5, 2024, for conspiracy to commit Hobbs Act Robbery, attempted Hobbs Act Robbery, and firearms conspiracy following a four-day trial before Senior United States District Judge Robert D. Mariani. According to Acting United States Attorney John C. Gurganus, Zeidan was friends with members of the Schuylkill County chapter of the Infamous Ryders Motorcycle Club, of which co-defendant Steven Wong was the president. Wong used his position to recruit members of the motorcycle club and other associates to participate in a series of brutal home-invasion armed robberies in Schuylkill and Berks County in the summer and fall of 2020. Zeidan agreed to participate in an August 29, 2020, home-invasion robbery with three other co-conspirators in which Zeidan and two others entered the home of a street-level drug dealer while wearing masks and armed with firearms and knives and rob the victims of drugs and drug proceeds. One of the firearms used was a fully automatic homemade AR-15 style assault rifle. Zeidan did not personally carry a firearm during the robbery but tried to break down the backdoor of the residence and impersonated a police officer in order to convince the potential victims to come downstairs. Instead, the victims jumped out of the second-floor window, injuring themselves. Zeidan and his fellow co-conspirators then ran from the home without stealing anything of value. Zeidan was later blamed by the other conspirators for the failure of the August 29, 2020, attempted robbery. Members of the conspiracy later committed additional armed home-invasion robberies in Mahanoy City, Pennsylvania, and Shillington, Pennsylvania. Zeidan’s fellow co-conspirators, including Wong, have all been convicted and are currently awaiting sentencing. The charges stem from an investigation involving the Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF), the Pennsylvania State Police, the Mahanoy City Police Department, the Schuylkill Haven Police Department, the Pottsville Police Department, the Shillington Police Department, the Reading Police Department, and the Lehigh County District Attorney’s Office. The case was prosecuted by Assistant United States Attorneys James Buchanan and Sarah Lloyd. This case is also part of Project Safe Neighborhoods (PSN), a program bringing together all levels of law enforcement and the communities they serve to reduce violent crime and gun violence, and to make our neighborhoods safer for everyone. On May 26, 2021, the Department launched a violent crime reduction strategy strengthening PSN based on these core principles: fostering trust and legitimacy in our communities, supporting community-based organizations that help prevent violence from occurring in the first place, setting focused and strategic enforcement priorities, and measuring the results. In this case, the maximum penalty is twenty years’ imprisonment. A sentence following a finding of guilt is imposed by the Judge after consideration of the applicable federal sentencing statutes and the Federal Sentencing Guidelines. # # #


title: Justice Department Seeks Forfeiture of Over $5 Million in Bitcoin Stolen in SIM Swapping Scams

component: Criminal Division

body_text: WASHINGTON — The Justice Department has filed a civil forfeiture complaint against over $5 million in bitcoin (BTC). The funds are alleged to be ill-gotten gains from multiple SIM swap attacks targeting victims across the United States, announced U.S. Attorney Jeanine Ferris Pirro. As alleged in the complaint, these funds are traceable to the theft and unauthorized transfer of cryptocurrency from cryptocurrency wallets owned by five victims. The thefts took place between Oct. 29, 2022, and March 21, 2023. Joining in the announcement were Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department’s Criminal Division and FBI Special Agent in Charge Brett D. Skiles of the Miami Field Office. The perpetrators of these thefts utilized a SIM swapping technique that allowed the perpetrators to authenticate their unauthorized access to the victims’ cryptocurrency accounts and transfer the victim funds to perpetrator-controlled accounts. A SIM swap attack is a type of account takeover whereby a perpetrator generally targets weaknesses in multi-factor authentication in order to gain access to a victim’s phone number by swapping the victim’s phone number to a SIM card associated with a phone in the perpetrator’s control. With this access, the perpetrators intercept codes destined for the victim’s phone and utilize those codes to “authenticate” that they are the victim. This allows the perpetrators to masquerade as the victim and conduct unauthorized activity transfers from the victim accounts. After each of the five thefts occurred, the perpetrators moved the stolen funds through multiple cryptocurrency wallets and ultimately consolidated them into one wallet that funded an account at Stake.com, an online casino. Many of these transactions were circular in that they eventually returned funds to their original source, and consistent with money laundering utilized to “clean” proceeds of criminal activity. For example, from on or about March 20, 2023, to on or about March 22, 2023, shortly after a portion of victim funds were consolidated into a single wallet, that wallet and the Stake.com account engaged in at least 32 circular transactions, including repeated deposits and withdrawals of BTC. Circular transactions obfuscate the origin of funds by inflating the volume of inflows and outflows in an account, making the larger balance (or source of funds) appear to engage in legitimate business. For more information regarding SIM swapping and how to prevent it, please visit www.ic3.gov/PSA/2024/PSA240411 . This case is being prosecuted by Trial Attorneys Jessica Peck and Gaelin Bernstein of the Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorneys for the District of Columbia Kevin Rosenberg, Alexandra Hughes, and Asset Forfeiture Coordinator Rick Blaylock, Jr. CCIPS investigates and prosecutes cybercrime in coordination with domestic and international law enforcement agencies, often with assistance from the private sector. Since 2020, CCIPS has secured the conviction of over 180 cybercriminals and obtained court orders for the return of over $350 million in victim funds.


title: “LockerGoga,” “MegaCortex,” and “Nefilim” Ransomware Administrator Charged with Ransomware Attacks

body_text: Earlier today, the U.S. District Court for the Eastern District of New York unsealed a superseding indictment charging Volodymyr Viktorovich Tymoshchuk — also known as deadforz, Boba, msfv, and farnetwork — a Ukrainian national, with serving as an administrator in the LockerGoga, MegaCortex, and Nefilim ransomware schemes. “Volodymyr Tymoshchuk is charged for his role in ransomware schemes that extorted more than 250 companies across the United States and hundreds more around the world,” said Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department’s Criminal Division. “In some instances, these attacks resulted in the complete disruption of business operations until encrypted data could be recovered or restored. This prosecution and today’s rewards announcement reflects our determination to protect businesses from digital sabotage and extortion and to relentlessly pursue the criminals responsible, no matter where they are located.” “Tymoshchuk is a serial ransomware criminal who targeted blue-chip American companies, health care institutions, and large foreign industrial firms, and threatened to leak their sensitive data online if they refused to pay,” said U.S. Attorney Joseph Nocella Jr. for the Eastern District of New York. “For a time, the defendant stayed ahead of law enforcement by deploying new strains of malicious software when his old ones were decrypted. Today’s charges reflect international coordination to unmask and charge a dangerous and pervasive ransomware actor who can no longer remain anonymous.” “Volodymyr Tymoshchuk repeatedly used ransomware attacks to target hundreds of companies in the United States and around the globe in attempts to extort victims,” said Assistant Director in Charge Christopher G. Raia of the FBI New York Field Office. “Today’s announcement should serve as warning, cyber criminals may believe they act with impunity while conducting harmful cyber intrusions, but law enforcement is onto you and will hold you accountable. The FBI along with our law enforcement partners will continue to scour the globe to bring to justice any individual attempting to use the anonymity of the internet to commit crime.” “The criminals behind Nefilim ransomware may believe they can profit from extortion and data leaks, but they are wrong,” said Special Agent in Charge Christopher J. S. Johnson of the FBI’s Springfield Field Office. “The FBI is actively pursuing them to disrupt their operations and bring them to justice. We urge all organizations to report these attacks immediately — because every report helps us dismantle these networks and ensure cybercriminals are held accountable.” As alleged in the superseding indictment, between December 2018 and October 2021, Tymoshchuk used the LockerGoga, MegaCortex, and Nefilim ransomware variants to encrypt computer networks in countries around the world, including in the Eastern District of New York, elsewhere in the United States, France, Germany, the Netherlands, Norway, and Switzerland. These ransomware attacks caused millions of dollars of losses, including damage to victim computer systems, remediation costs, and ransomware payments to the perpetrators. In these attacks, the perpetrators typically customized the ransomware executable file (the ransomware file responsible for encryption) for each ransomware victim. The customization allowed the ransomware actors to create a decryption key that could only decrypt the network of the specific victim. If a victim paid the ransom demand, the perpetrators would send a decryption tool, which enabled the victim to decrypt the computer files locked by the ransomware program. Between July 2019 and June 2020, Tymoshchuk and his co‑conspirators are alleged to have compromised the networks of more than 250 victim companies in the United States and hundreds of other companies around the world with LockerGoga and MegaCortex. However, many of these extortion attempts were unsuccessful because law enforcement often notified victims that their networks had been compromised before Tymoshchuk and his co-conspirators were able to deploy the ransomware. Subsequently, from July 2020 through October 2021, Tymoshchuk is alleged to have been one of the administrators of the Nefilim ransomware strain. Tymoshchuk and the other Nefilim administrators provided other Nefilim ransomware affiliates, including co‑defendant Artem Stryzhak, who was extradited from Spain and faces charges in the Eastern District of New York, with access to the Nefilim ransomware in exchange for 20 percent of the ransom proceeds extorted from Nefilim victims. In September 2022, as part of an international coordinated effort against LockerGoga and MegaCortex ransomware, decryption keys associated with those ransomware variants were made available to the public via the “No More Ransomware Project,” an initiative to empower ransomware victims to decrypt encrypted computers without paying a ransom. These decryption keys enabled compromised victim companies and institutions to recover data previously encrypted with LockerGoga and MegaCortex ransomware. Tymoshchuk is charged with two counts of conspiracy to commit fraud and related activity in connection with computers, three counts of intentional damage to a protected computer, one count of unauthorized access to a protected computer, and one count of transmitting a threat to disclose confidential information. The FBI is investigating this case. Trial Attorney Brian Z. Mund of the Justice Department’s Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorneys Alexander F. Mindlin and Ellen H. Sise for the Eastern District of New York are prosecuting the case. The Justice Department’s Office of International Affairs provided critical assistance, as did the FBI’s Legal Attachés, authorities in France, Czech Republic, Germany, Lithuania, Luxembourg, Netherlands, Norway, Switzerland, and Ukraine, and Europol and Eurojust via ICHIP The Hague. CCIPS investigates and prosecutes cybercrime in coordination with domestic and international law enforcement agencies, often with assistance from the private sector. Since 2020, CCIPS has secured the conviction of over 180 cybercriminals, and court orders for the return of over $350 million in victim funds. Concurrent with the unsealing of the superseding indictment, the U.S. Department of State’s Transnational Organized Crime (TOC) Rewards Program is offering a rewards totaling up to $11 million for information leading to the arrest and/or conviction or location of Tymoshchuk or his conspirators. Anyone with information on these malicious cyber actors, or associated individuals or entities, should contact the FBI via phone at +1-917-242-1407 or by email at TymoTips@fbi.gov . If you are in the United States, you can also contact your local FBI field office. If outside the United States, you can visit the nearest U.S. embassy. More information about the TOC reward offer is located on the State Department website . An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.


title: Dominican National Pleads Guilty to Dealing Fentanyl

component: USAO - Massachusetts

body_text: BOSTON – A Dominican national unlawfully residing in Lawrence pleaded guilty yesterday in federal court in Boston to drug distribution charges. Hector Santana Guzman, a/k/a “DJ Black,” 34, pleaded guilty to two counts of distribution of and possessing with intent to distribute fentanyl. United States District Judge Patti B. Saris scheduled sentencing for Dec. 10, 2025. During an investigation of the transnational criminal organization 18th Street Gang, Santana Guzman met with a cooperating witness on two dates in June 2024 to sell fentanyl. On June 6, 2024, Santana Guzman sold approximately 50 grams of powder fentanyl to a cooperating witness. Later, on June 25, 2024, Santana Guzman again sold approximately 70 grams of powder fentanyl. The charge of distribution of and possession with intent to distribute fentanyl provides for a sentence of up to 20 years in prison, at least three years and up to a lifetime of supervised release and a fine of up to $1 million. Sentences are imposed by a federal district court judge based upon the U.S. Sentencing Guidelines and statutes which govern the determination of a sentence in a criminal case. United States Attorney Leah B. Foley; Ted E. Docks, Special Agent in Charge of the Federal Bureau of Investigation, Boston Division; and Bryan DiGirolamo, Acting Special Agent in Charge of the Bureau of Alcohol, Tobacco, Firearms & Explosives made the announcement today. Valuable assistance was provided by the Massachusetts State Police; U.S. Immigration and Customs Enforcement, Enforcement and Removal Operations; Suffolk County and Middlesex County District Attorney’s Offices; and the Boston, Chelsea, Everett, Falmouth, Lynn, Medford, Nantucket and Revere Police Departments. Assistant U.S. Attorney Fred Wyshak of the Organized Crime & Gang Unit is prosecuting the case. This effort is part of an Organized Crime Drug Enforcement Task Forces (OCDETF) operation. OCDETF identifies, disrupts, and dismantles the highest-level criminal organizations that threaten the United States using a prosecutor-led, intelligence-driven, multi-agency approach. Additional information about the OCDETF Program can be found at https://www.justice.gov/OCDETF .


title: Ransomware Administrator Charged with Cybercrimes for Deploying “Lockergoga,” “Nefilim,” and “Megacortex” Ransomware Strains Against Hundreds of Victims

component: USAO - New York, Eastern

body_text: BROOKLYN, NY – Earlier today, a superseding indictment was unsealed charging Volodymyr Tymoshchuk, also known as “deadforz,” “Boba,” “msfv,” and “farnetwork,” a Ukrainian national, for his role in international ransomware schemes. Tymoshchuk is not in U.S. custody. Joseph Nocella, Jr., United States Attorney for the Eastern District of New York; Matthew R. Galeotti, Acting Assistant Attorney General of the Justice Department’s Criminal Division; Christopher Raia, Assistant Director in Charge, Federal Bureau of Investigation, New York Field Office (FBI); and FBI Special Agent in Charge Christopher J.S. Johnson, Springfield, Illinois Field Office, announced the superseding indictment. “Tymoshchuk is a serial ransomware criminal who targeted blue-chip American companies, health care institutions, and large foreign industrial firms, and threatened to leak their sensitive data online if they refused to pay,” stated United States Attorney Nocella. “For a time, the defendant stayed ahead of law enforcement by deploying new strains of malicious software when his old ones were decrypted. Today’s charges reflect international coordination to unmask and charge a dangerous and pervasive ransomware actor who can no longer remain anonymous.” “Volodymyr Tymoshchuk is charged for his role in ransomware schemes that extorted more than 250 companies across the United States and hundreds more around the world,” stated Acting Assistant Attorney General Galeotti. “In some instances, these attacks resulted in the complete disruption of business operations until encrypted data could be recovered or restored. This prosecution and today’s rewards announcement reflects our determination to protect businesses from digital sabotage and extortion and to relentlessly pursue the criminals responsible, no matter where they are located.” “Volodymyr Tymoshchuk repeatedly used ransomware attacks to target hundreds of companies in the United States and around the globe in attempts to extort victims. Today’s announcement should serve as warning, cyber criminals may believe they act with impunity while conducting harmful cyber intrusions, but law enforcement is onto you and will hold you accountable,” stated FBI Assistant Director in Charge Raia. “The FBI along with our law enforcement partners will continue to scour the globe to bring to justice any individual attempting to use the anonymity of the internet to commit crime.” “The criminals behind Nefilim ransomware may believe they can profit from extortion and data leaks, but they are wrong. The FBI is actively pursuing them to disrupt their operations and bring them to justice. We urge all organizations to report these attacks immediately—because every report helps us dismantle these networks and ensure cybercriminals are held accountable,” stated Springfield, Illinois Special Agent in Charge Johnson. As alleged in the superseding indictment, between December 2018 and October 2021, LockerGoga, MegaCortex, and Nefilim ransomware were used to encrypt computer networks in countries around the world, including against victims in the Eastern District of New York and across the United States, France, Germany, the Netherlands, Norway, and Switzerland. These ransomware attacks caused tens of millions of dollars of losses, resulting both from damage to victim computer systems and from ransomware payments to the perpetrators. The ransomware attacks would lock up a victim’s computer files, and only if the victim paid the ransom demand the perpetrators would send a decryption tool that enabled the victim to decrypt and regain access to those files. The LockerGoga and Mega Cortex Ransomware Variants Tymoshchuk and his co-conspirators initially gained unauthorized access to victim networks in various ways, including through use of hacking tools to identify security vulnerabilities, perform brute-force password cracking attacks, and retrieve stored password credentials. At times, the co-conspirators also purchased compromised access credentials to victim networks. Tymoshchuk and his co-conspirators then used additional hacking tools to explore the victim networks, obtain persistent remote access, move laterally (i.e., access other systems within each computer or network) and escalate privileges (i.e., gain greater authority over the computer or network). After gaining sufficient access to the victims’ networks, the co-conspirators deployed either LockerGoga or MegaCortex ransomware. Between approximately July 2019 and June 2020, Tymoshchuk and his co‑conspirators compromised the networks of more than 250 victim companies in the United States and hundreds of other companies around the world. Many of these extortion attempts failed due to the vigilance of law enforcement officials, who notified victims that their networks had been compromised before Tymoshchuk could deploy ransomware. In September 2022, as part of an international coordinated effort, decryption keys associated with LockerGoga and MegaCortex ransomware were made available to the public via the “No More Ransomware Project.” These decryption keys enabled compromised victim companies and institutions to recover data previously encrypted with LockerGoga and MegaCortex ransomware. The Nefilim Ransomware Variant From approximately July 2020 through October 2021, Tymoshchuk was one of the administrators of Nefilim ransomware, a “ransomware as a service” enterprise that provided ransomware tools to affiliates in turn for a percentage of the extortionate payments they collected. Among Tymoshchuk’s affiliates was his co‑defendant Artem Stryzhak, who paid Tymoshchuk 20 percent of the ransom proceeds he collected. In exchange, Tymoshchuk gave Stryzhak access to the Nefilim ransomware “panel,” an online platform for Nefilim affiliates to access the ransomware. Tymoshchuk at times described his preferred ransomware targets as companies located in the United States, Canada, or Australia with more than $100 million in annual revenue. In one exchange with Stryzhak in or about July 2021, Tymoshchuk encouraged him to target companies in these countries with more than $200 million in annual revenue. Tymoshchuk researched companies to target, using online databases to gather information about the victim companies’ net worth, size, and contact information. After gaining sufficient access to the victims’ networks, Tymoshchuk and his co-conspirators stole data in furtherance of their scheme to extort ransom payments from them. Nefilim ransom notes typically threatened the victims that unless they came to an agreement with the ransomware actors, the stolen data would be published on publicly accessible “Corporate Leaks” websites, which were maintained by Nefilim administrators. The charges in the superseding indictment are allegations and the defendants are presumed innocent unless and until proven guilty. Stryzhak, who was extradited from Spain in April 2025 to the Eastern District of New York, is awaiting trial. Concurrent with the unsealing of the superseding indictment, the U.S. Department of State’s Transnational Organized Crime (TOC) Rewards Program is offering a reward of up to $11 million for information leading to the leading to the arrest and/or conviction or location of Tymoshchuk or his conspirators. Anyone with information on these malicious cyber actors, or associated individuals or entities, please contact the FBI via phone at +1-917-242-1407 or by email at TymoTips@fbi.gov . If you are in the United States, you can also contact the local FBI field office. If outside the United States, you can visit the nearest U.S. embassy. More information about this TOC reward offer is located on the State Department website . The government’s case is being handled by the Office’s National Security and Cybercrime Section. Assistant United States Attorneys Alexander F. Mindlin and Ellen H. Sise, along with Trial Attorney Brian Mund of the Justice Department’s Computer Crime and Intellectual Property Section, are in charge of the prosecution, with assistance from Paralegal Specialist Rebecca Roth. T he Justice Department’s Office of International Affairs provided critical assistance in this case, as did the FBI’s Legal Attachés abroad and authorities in France, Czech Republic, Germany, Lithuania, Luxembourg, Netherlands, Norway, Romania, Switzerland, and Ukraine, as well as Europol and Eurojust via the Criminal Division’s International Computer Hacking and Intellectual Property (ICHIP) The Hague. The Defendants : VOLODYMYR VIKTOROVYCH TYMOSHCHUK (also known as “deadforz,” “Boba,” “msfv,” and “farnetwork”) Age: 28 Kiev, Ukraine ARTEM ALEKSANDROVYCH STRYZHAK Age: 35 Barcelona, Spain E.D.N.Y. Docket No. 23-CR-324 (PKC) 23-cr-324_-_superseding_indictment.pdf


title: Defendant Charged with Threatening to Murder a Federal Judge

component: USAO - Minnesota

body_text: MINNEAPOLIS – Robert Phillip Ivers, age 72, was charged by complaint with threatening to assault and murder a federal judge, announced Acting U.S. Attorney Joseph H. Thompson. Ivers was previously convicted federally of threatening to kill a federal judge. “At a time when Minnesota is reeling from acts of violence, the last thing we need is someone spreading fear into our churches, libraries, and courts,” said Acting U.S. Attorney Joseph H. Thompson. “Ivers’s threats are bone chilling. After the past few months, we are not taking chances. When someone threatens our community, we believe them, and we will act swiftly to protect Minnesotans.” According to the complaint, on September 3, 2025, law enforcement responded to the Wayzata Library in Wayzata, Minnesota, based on a report of a man printing off copies of a manifesto entitled, “How to Kill a Federal Judge.” This man was Robert Ivers. Law enforcement learned that Ivers showed the manifesto to library staff including a page of the manifesto that talked about killing children and had a picture of a gun on it. Ivers also gave library staff a three-page “flyer” advertising his manifesto before he left the library. The flyer stated that the manifesto “is designed to teach extremists on how to plan, train, hunt, stalk and kill anyone including judges, their family members, politicians and more!” It also advertised that the “harsh reality is that judges are going to die.” In investigating the case, law enforcement learned that, on August 28, 2025, Ivers had been reported for concerning behavior at an Episcopal church in Minnetonka, Minnesota. Ivers attended multiple services and told church members that he planned to attend upcoming church events on September 7 (a family picnic and potluck), September 11 (a blessing of children going back to school, with state legislators in attendance), and September 14 (an annual baptism service). Church staff searched Ivers online and discovered his history included past threats of violence, a felony conviction, and racist commentary. Church staff then contacted law enforcement. On the evening of September 3, 2025, the Wayzata Police Department located Ivers and arrested him. During his transport, Ivers claimed that he was having a heart attack. Law enforcement transferred Ivers to the hospital from the jail. Ivers was subsequently released from the hospital later that night. Law enforcement searched Ivers’s vehicle and found, among other things: (1) a photo of the former Pope with crosshairs centered on his head; (2) twenty copies of a spiral bound printed book titled, “How to Kill a Federal Judge” by Robert Ivers; (3) multiple copies of flyers advertising the contents of the book; (4) lists of federal judges; (5) a copy of the Anarchist Cookbook ; (6) a white foam box containing a toy replica firearm, a box of Co2 cartridges, and a container of pellets; and (7) a box of fireworks. On September 5, 2025, Wayzata Police Department re-arrested Ivers. Following his arrest, Ivers was interviewed. Ivers admitted to showing a copy of his manifesto to library staff. Law enforcement asked Ivers if he thought his book would have scared anybody. In response, Ivers shouted: “It was supposed to!” Ivers’s manifesto is 236 pages long. The cover page is entitled, “How to Kill a Federal Judge” and features a photo of a man holding a rifle. In his manifesto, Ivers focused on the perceived wrongs done to him by the judicial system. He discussed these wrongs—and his anticipated revenge—at length. The manifesto contains various types of writings and many disturbing sketches, apparently drawn by Ivers. The manifesto also contains handwritten threats to kill, including threats to kill judges, as well as their children and pets. Ivers made clear his purpose was to instill fear. He wrote, “If this book doesn’t instill fear in you then your already dead.” Many names appear in the manifesto, including the names of federal judges. Ivers fixated on Federal Judge A, who presided over his federal trial, and Federal Judge B, who Ivers was previously convicted of threatening to kill. In the manifesto, Ivers threatens to kill Federal Judge A. Ivers has a long history of threatening judges and others. In 2019, Ivers was convicted at trial of threatening to kill Federal Judge B, a federal judge in Minnesota, in United States v. Robert Ivers , 18 CR 90. “Threats of violence directed at federal judges not only undermine the integrity of our legal system but also pose a grave risk to the principles of justice and democracy,” said Special Agent in Charge Alvin M. Winston Sr. of FBI Minneapolis. “The FBI and our law enforcement partners consider all threats of violence against judges, or any public servants, with grave seriousness. These actions will not be tolerated. As this chilling case confirms, we are fully committed to protecting judges who devote themselves to our communities and legal system.” Ivers will make his initial appearance this afternoon in federal court. The United States will request that he be detained during the pendency of his federal case. This case is the result of an investigation conducted by the FBI, the Wayzata Police Department, and the Bureau of Criminal Apprehension, with assistance from the United States Marshals Service. The U.S. Attorney’s Office also thanks the Hennepin County Attorney’s Office for its quick action and important partnership in this case. Assistant U.S. Attorney Melinda A. Williams is prosecuting the case. A complaint is merely an allegation, and the defendant is presumed innocent until proven guilty beyond a reasonable doubt in a court of law.


title: Worksite Enforcement Operation Leads to Five Criminal Arrests and More than 50 Administratively Detained Aliens

component: USAO - New York, Northern

body_text: SYRACUSE, NEW YORK – Federal law enforcement officers detained 57 illegally present aliens at their place of illegal employment in Cayuga County, New York, on September 4. Five of them have been charged by criminal complaint with illegally reentering the United States after a prior removal. They are: Alex Ben Chipin, a/k/a Alex Ben-Chiping, a/k/a Alex Bing-Chiping, a/k/a Antonio Lopez-Mendez, age 39, of Guatemala; Argentina Juarez-Lopez, age 50, of Guatemala; Luis Jom-Morales, age 27, of Guatemala; Gregorio Baldemar Ramirez-Perez, age 45, of Guatemala; and Francisco Salvardo-Mora, age 22, of Mexico. Each defendant is charged separately. The charges in the complaints are merely accusations. The defendants are presumed innocent unless and until proven guilty. The remaining 52 aliens were detained administratively pending immigration proceedings. The announcement was made by Acting United States Attorney John A. Sarcone III; Special Agent in Charge Erin Keegan, Homeland Security Investigations (HSI), Buffalo Field Office; Acting Chief Patrol Agent James P. D’Amato, United States Border Patrol, Buffalo Sector; and Harry Chavis, Special Agent in Charge of the Internal Revenue Service, Criminal Investigation (IRS-CI), New York Field Division Acting United States Attorney John A. Sarcone III said, “These defendants face charges arising out of one of the largest worksite enforcement actions in recent history. Employers across the Northern District of New York must understand that they risk criminal investigation if they are employing non-citizens who are not authorized to work in the United States. Across Upstate and Central New York, there are hard-working Americans in need of well-paying jobs, especially in Cayuga County where unemployment is relatively high. Our worksite enforcement actions will ensure that those jobs go to people who are authorized to work in the United States, and not to aliens who illegally re-enter our country after prior deportations.” Erin Keegan, Special Agent in Charge, HSI Buffalo, stated, “Today’s announcement underscores the continued coordination of law enforcement partners with the goal of uncovering possibly dangerous or abusive business practices and, in turn, protecting the public from labor exploitation. While this continues to be an active and ongoing criminal investigation, HSI remains committed to protecting the rights of workers and upholding U.S. laws, including by identifying and addressing exploitation in the workplace, ensuring compliance with labor and immigration laws, and safeguarding the integrity of our nation's workforce.” Harry T. Chavis, Special Agent in Charge of IRS-CI New York, stated, “IRS-CI has a long history of collaborating with our law enforcement partners, and worksite enforcement operations are no different. Businesses are expected to apply good employment practices in hiring their workforce in accordance with U.S. laws and reporting payroll and other related financials appropriately. IRS-CI will continue to use their financial expertise in furthering these types of investigations.” The charges filed against the five defendants listed above carry a maximum term of 2 years in prison, a fine of up to $250,000, and a term of supervised release of up to 1 year. A defendant’s sentence is imposed by a judge based on the particular statute the defendant is convicted of violating, the U.S. Sentencing Guidelines and other factors. HSI, Border Patrol, and IRS-CI are investigating the cases with investigative and/or operational assistance from various agencies including U.S. Customs and Border Protection, U.S. Immigration and Customs Enforcement, the United States Marshals Service, the Oswego County Sheriff’s Office, and the Madison County Sheriff’s Office. Assistant U.S. Attorney Michael F. Perry is prosecuting the cases.


title: Colorado Man Pleads Guilty to Sending Threats to Kill Cayuga County Man

body_text: SYRACUSE, NEW YORK – Jerry Gordon, age 56, of Colorado, pled guilty Friday to transmitting a threat in interstate commerce to injure another person. Acting United States Attorney John A. Sarcone III and Craig L. Tremaroli, Special Agent in Charge of the Albany Field Office of the Federal Bureau of Investigation (FBI), made the announcement. Gordon admitted that from April 22, 2025, to April 25, 2025, he sent four threatening text messages to a man in Aurora, New York. In the text messages Gordon told the victim to get his affairs in order before Friday April 25, 2025, as he was going to “drink your blood from the chalice that I will make out of your heart.” Gordon was arrested by FBI agents as he was getting off a plane in Syracuse, on April 25, 2025, after law enforcement became aware of the threats. Acting U.S. Attorney John A. Sarcone III stated: “Vile threats to kill the citizens of our district will not be tolerated. Local, state and federal agents, working together, quickly responded to the impending threat and apprehended the defendant as he was getting off the plane having traveled from Colorado to Syracuse to attack the victim.” FBI Special Agent in Charge Craig L. Tremaroli stated: “This case demonstrates the FBI’s unwavering commitment to working with our partners to swiftly investigate, intercept, and bring to justice anyone who threatens our citizens with disturbing acts of violence.” At sentencing before United States District Judge Elizabeth C. Coombe on November 24, 2025, Gordon will face a maximum term of 5 years in prison, a fine of up to $250,000, and a term of supervised release of up to 3 years. A defendant’s sentence is imposed by a judge based on the particular statute the defendant is convicted of violating, the U.S. Sentencing Guidelines, and other factors. The FBI investigated the case with assistance from the New York State Police, Syracuse Regional Airport Authority Police Department, Syracuse Police Department, Cornell Police Department, Tompkins County Sherriff’s Office, United States Marshals Service, Cayuga County District Attorney’s Office, Federal Air Marshal Service, and the Oneida County Sherriff’s Office. Assistant U.S. Attorney Geoffrey J. L. Brown is prosecuting the case.


title: Mexican National With Felony Conviction Charged For Illegally Reentering The United States

component: USAO - Nevada

body_text: LAS VEGAS – A Mexican national made his initial court appearance on Monday to face charges of illegally reentering the United States after previously being removed from the country. Felipe De Jesus Jauregui-Acosta, 43, is charged with one-count of deported alien found in the United States. A preliminary hearing is scheduled for September 22, 2025, before United States Magistrate Judge Brenda N. Weksler. According to allegations contained in the criminal indictment and statements made during court proceedings, Jauregui-Acosta is a citizen and national of Mexico who was previously deported and removed from the United States on October 5, 2008, and reentered the United States illegally. U.S. Immigration and Customs Enforcement (ICE) recently identified Jauregui-Acosta after he was arrested by Las Vegas Metropolitan Police on May 4, 2025, for Resist Public Officer with Deadly Weapon not Firearm, Assault Deadly Weapon on First Responder, Battery Deadly Weapon on First Responder, and Use Posses Drug Paraphernalia. On July 3, 2025, Jauregui-Acosta was convicted of Resisting Public Officer with Use of a Dangerous Weapon. If convicted, Jauregui-Acosta faces the maximum statutory penalty of two years in prison, a one-year term of supervised release, a $250,000 fine, and a $100 special assessment. Acting United States Attorney Sigal Chattah for the District of Nevada and Salt Lake City Acting Field Office Director Jason Knight made the announcement. The ICE Salt Lake City, Las Vegas Sub-Office investigated the case; and the United States Attorney’s Office for the District of Nevada is prosecuting the case. Members of the public can report crimes and suspicious activity by dialing 866-DHS-2-ICE (866-347-2423) or completing the online tip form . An indictment is merely an accusation, and a defendant is presumed innocent unless and until proven guilty. ###


title: Defendant Charged In Over $50 Million Ponzi Scheme And Related Investment Fraud

body_text: United States Attorney for the Southern District of New York, Jay Clayton, and Assistant Director in Charge of the New York Field Office of the Federal Bureau of Investigation (“FBI”), Christopher G. Raia, announced the unsealing of an Indictment charging PAUL REGAN with conspiracy, securities fraud, and wire fraud. The charges in the Indictment arise from a scheme to defraud retail investors in projects called Next Level Holdings (“Next Level”) and Yield Wealth Ltd. (“Yield”) by misrepresenting how those companies would use investors’ money and the protections investors would have against losses. REGAN’s fraudulent scheme tricked over 300 people to invest more than $60 million in the Next Level and Yield investment products. When the fraud was eventually exposed, REGAN’s investors were left with over $50 million in losses. REGAN was arrested in the Southern District of Florida on September 4, 2025, and ordered detained following his removal from the Republic of Colombia. The case has been assigned to U.S. District Judge Valerie E. Caproni. “As alleged, Paul Regan promised high returns but, in reality, he simply used money from new investors to pay off old investors, keeping the fraud going until pointed questions were asked,” said U.S. Attorney Jay Clayton. “There is no place in our markets for scammers, particularly those who prey on Main Street investors. The women and men of the Southern District are committed to putting these scammers out of business permanently.” “Paul Regan allegedly defrauded over 300 investors of more than $60 million through false promises of protected investments and guaranteed returns while using these deposits to quietly repay other entities,” said FBI Assistant Director in Charge Christopher G. Raia. “This alleged scheme was shrouded in deceit to entice hundreds of clients before ultimately betraying their confidence and their savings. The FBI will continue to investigate all widespread schemes exploiting the wallets of victims, regardless of where the defendant may be located.” According to the allegations in the Indictment unsealed on September 4, 2025, in Manhattan federal court: [1] From at least 2022 through December 2024, REGAN and a team of salesmen and associates defrauded hundreds of retail investors by offering investment products through two entities, Next Level and Yield, based on false and misleading statements. REGAN and his co-conspirators misrepresented how Next Level and Yield would use investors’ money and what protections investors would have against losses. These misrepresentations fraudulently induced over 300 people to invest more than $60 million in the Next Level and Yield investment products. When REGAN’s fraud was eventually exposed, REGAN closed Next Level and Yield, leaving investors with over $50 million in losses. Next Level Notes REGAN advertised himself as the Chief Executive Officer of Next Level and claimed that Next Level was in the business of providing capital and operational support to mining operations in Colombia. In exchange for this support, Next Level supposedly received precious metals at discounted prices, which Next Level sold at a profit. In at least in or about mid-2022, REGAN and others began using Next Level to sell what REGAN called “Next Level Holdings Principal & Interest Protected Guaranteed Note[s]” (the “Next Level Notes”). REGAN sold Next Level Notes himself and recruited independent salespeople to sell Next Level Notes using information and sales techniques that REGAN and others working at Next Level provided. According to marketing materials that REGAN circulated to investors and salespeople, investors who purchased Next Level Notes were guaranteed to receive double-digit returns, with no risk of loss, through Next Level’s precious-metals business. For example: Next Level’s marketing materials represented that investors who made a minimum investment of $50,000 could purchase a Next Level Note with a term of three, five, seven, or 10 years. Each Note came with a contractually guaranteed double-digit annual yield—typically between 12% and 15% depending on the duration of the Note; Next Level’s marketing materials represented that each Next Level Note came with a “noncancelable indemnity or surety bond backed by an insurance company that guarantee[d] that principal and interest will be paid in compliance with the contractual agreement or promissory note.” This meant that holders of Next Level Notes “[could not] lose their principal investment and also serve[d] as a guarantee that [investors] will receive the interest offered in our enhanced annuity note offering in full.” The Next Level marketing materials that REGAN circulated also made representations about how Next Level would use investor funds and how it planned to protect investors from losses. With respect to returns, the marketing materials represented that Next Level had a successful track record in “gold and precious metals trade finance operations,” and that Next Level would use investor funds to finance mining operations and generate returns from selling precious metals. As for protections, the marketing materials represented that Next Level would obtain for investors “full insurance protections” from a handful of companies, including a Colombian entity (“Company-1”) and an American reinsurance company (“Company-2”). The marketing materials said that this insurance was designed to offer noteholders “ultimate safety and peace of mind for your retirement portfolio in these very uncertain times.” Next Level issued each investor who purchased a Next Level Note a “Fully Insured Secured Promissory Note,” which set forth the terms of the investment (including the principal amount and interest rate) and included an “Unconditional Loan Guarantee,” representing that Next Level would provide the investor “with a noncancelable surety bond, or other like insurance policy or product to serve as an unconditional guarantee for the Holder that he shall receive payment of both principal and interest on this note.” Consistent with that representation about insurance, Next Level also sent investors two insurance-related documents: the first was a document titled a “Surety Bond Contract,” purportedly from Company-1, which guaranteed that Company-1 would pay the noteholder the full amount of principal and interest Next Level owed under the note, in the event Next Level did not pay. The second was a document titled a “Reinsurance Cover Note,” purportedly from Company-2, which guaranteed that Company-2 would also insure the noteholder up to the full amount of principal and interest payments required under the terms of the note. Between 2022 and late 2024, Next Level sold approximately 300 Next Level Notes to investors, including to at least one investor located in the Southern District of New York. In total, the investors in Next Level Notes sent more than $45 million to business entities under the control of REGAN. Yield Term Deposits In or about early 2024, REGAN and others launched a new business venture called Yield, which REGAN advertised as an alternative to traditional banks that could offer investors higher returns on their savings and greater protections. In or about March 2024, REGAN began using Yield to sell what he called “Mega High Yield Term Deposit[s]” and “Super High Yield Term Deposit[s]” (collectively, the “Yield Term Deposits”). As with Next Level Notes, REGAN sold Yield Term Deposits himself and recruited independent salespeople to sell Yield Term Deposits using information and sales techniques that REGAN and others working at Yield provided. Much like with Next Level Notes, REGAN circulated marketing materials to investors and salespeople, claiming that investors in Yield Term Deposits were guaranteed to make significant returns with no risk. For example: yield marketing materials described Yield as “revolutionizing the banking industry with Enhanced Term Deposits, offering yields up to 10.5% APY and security through insurance coverage up to $10 million.” The materials went on to explain that investors could invest in Yield Term Deposits, with terms of between five and 10 years. Investors would receive guaranteed interest payments each year, with rates ranging up to 10.5% per year, depending on the term of the deposit and other payment options the investor selected. The marketing materials represented that interest payments and investors’ principal would be fully insured, stating that “[y]our APY is 100% guaranteed and insured” and that Yield Term Deposits “offer[] additional insurance on deposits up to $10 million, ensuring unparalleled security for your savings”; similarly, Yield’s website advertised Yield as a new, digital bank that gave investors access to better interest rates and protections than traditional financial institutions. The website allowed investors to calculate returns they would receive from different Yield Term Deposits and touted that Yield Term Deposits were backed by insurers who “provid[e] our depositors the ultimate in insurance protection for both . . . principal and interest”; Yield’s website claimed that Yield would generate returns for investors through a “diverse portfolio that spans multiple industries, including the lucrative sectors of mining and rare minerals.” REGAN separately represented to investors and people selling Yield Term Deposits that Yield would also use investor funds to make investments in plans related to the Affordable Care Act. Yield sent investors who purchased Yield Term Deposits a “Subscription Agreement” and a “Limited Partnership Agreement,” through which the investors purchased units in either the Mega High-Yield Term Deposit LP or the Super High-Yield Term Deposit LP. The agreements represented, among other things, that investors would receive “an annual percentage yield of no less than” between 5.5% and 8.5%, depending on the type of investment. Over the course of 2024, Yield sold approximately 85 Yield Term Deposits, totaling more than $15 million deposited by investors. The Defendant Defrauded Investors The promises that REGAN and others made to investors about how Next Level and Yield would use their money and protect their investments were materially false and misleading. When REGAN promoted Next Level Notes and Yield Term Deposits, a core component of that pitch was that Next Level and Yield would use investors’ money to generate significant returns, including through precious-metals operations and investments related to the Affordable Care Act. Those claims were false and misleading. In reality, REGAN and his co-conspirators ran Next Level and Yield like a Ponzi scheme, using money obtained from earlier investors to pay later investors and to pay commissions to salespeople. Meanwhile, Next Level and Yield made no meaningful investments in either precious-metals operations or investments related to the Affordable Care Act. Instead, REGAN and his co-conspirators misappropriated investor money, which included using investor funds for personal payments and sending large sums of money to entities that did not generate returns for Next Level or Yield, let alone investors. Another important representation that REGAN made when marketing Next Level Notes and Yield Term Deposits was that investors would have insurance to guarantee promised interest payments and prevent them from losing their investments. Those representations were also false and misleading. Next Level did not obtain insurance for the vast majority of noteholders and did not maintain insurance for any of them. Specifically, between in or about 2022 up to and including late 2023, Next Level obtained authentic surety bonds from Company-1 and reinsurance from Company-2 for approximately 70 Next Level Notes, with a total investment value of approximately $7.75 million. Next Level then stopped paying to maintain that coverage and did not purchase any surety bonds or reinsurance for the more than 200 Next Level Notes it issued over the course of 2024. Instead, Next Level sent the investors who purchased those notes forged surety bonds and forged reinsurance paperwork. REGAN and his co-conspirators also furthered this fraudulent scheme by sending investors and salespeople forged letters that appeared to come from a senior executive at Company-1 and represented that Company-1 would insure more than $100 million of Next Level Notes. Similarly, notwithstanding the representations that Yield Term Deposits had insurance to guarantee interest payments and protect up to $10 million of principal, Yield did not purchase or maintain insurance for Yield Term Deposits. Investors Suffered Significant Losses On or about August 30, 2024, a news outlet published an article about Yield and REGAN expressing skepticism about Yield. REGAN responded to the article by holding a videoconference with salespeople, in which REGAN claimed that the article was false and misleading and urged salespeople to continue selling Yield Term Deposits. In or about November 2024, Next Level and Yield closed, leaving investors with over $50 million in losses. * * * REGAN, 48, of New York, New York, is charged with one count of conspiring to commit securities fraud and wire fraud, which carries a maximum sentence of five years in prison; one count of securities fraud, which carries a maximum sentence of 20 years in prison; one count of wire fraud, which also carries a maximum sentence of 20 years in prison; and one count of aggravated identity theft, which carries a mandatory term of two years in prison. Mr. Clayton also thanked the U.S. Securities and Exchange Commission, which has filed a civil enforcement action, the Justice Department’s Office of International Affairs, the Criminal Division’s Narcotic and Dangerous Drug Section’s Office of Judicial Attaché in Bogotá, Colombia and the authorities of the Republic of Colombia for their assistance. This case is being handled by the Office’s Securities and Commodities Fraud Task Force. Assistant U.S. Attorneys Thomas S. Burnett and Maggie Lynaugh are in charge of the prosecution. The charges contained in the Indictment are merely accusations, and the defendant is presumed innocent unless and until proven guilty. u.s._v._regan_indictment.pdf [1] As the introductory phrase signifies, the entirety of the text of the Indictment and the description of the Indictment set forth in this release constitute only allegations, and every fact described should be treated as an allegation.


title: U.S. Attorney Remarks – News Conference, September 9, 2025

body_text: ALBANY, NEW YORK – We are here to announce that on September 4, federal law enforcement officers conducted a major worksite enforcement operation in Cayuga County, New York, detaining 57 people unlawfully present in this country. Among those detained, five have been criminally charged for illegally reentering the United States after prior removal — a felony offense that undermines the security of our borders and the safety of our communities. Each defendant is charged separately. The charges in the complaints are merely accusations. The defendants are presumed innocent unless and until proven guilty. Last week’s operation enforced our immigration laws, but it also struck a blow for fairness and opportunity for hard-working, able-bodied Americans who deserve access to all of the well-paying jobs in their communities, some of which suffer from relatively high unemployment rates. I am not here to comment on the specific employer whose offices were the subject of last week’s operation. What I will say, more broadly, is that employers that knowingly hire unauthorized workers are breaking the law and also contributing to a system that harms our economy, jeopardizes public safety, and devalues the hard work of lawful employees. To employers across the Northern District of New York: heed this warning. We will aggressively pursue criminal investigations against those who violate our laws by employing non-citizens without authorization. There will be consequences. The bad old days of turning a blind eye are over. We recognize the contributions that lawful immigrants make to our communities. But illegal reentry after deportation is a flagrant violation of federal law — and it will not be tolerated. Nor will we tolerate the greed of those employers that knowingly hire illegal aliens. We will continue to work in close coordination with our partners at Homeland Security Investigations, the Border Patrol, the IRS, Immigration and Customs Enforcement, and other agencies to identify violators and hold them accountable. You can expect to see federal law enforcement at more worksites, going forward. We owe it to the American people to enforce our immigration laws fairly, firmly, and without exception.