Justice Department officials on efforts to disrupt “criminal Russian activity” 4/06/22 Transcript

United States Attorney General Merrick Garland: (00:00)
.. Director Adams. Today, we are announcing several actions the Justice Department has taken to disrupt and prosecute criminal activity associated with the Russian regime. The first action we are announcing today is the unsealing of an indictment charging Russian oligarch, Konstantin Malofeev with sanctions violations. As indictment charges, the Treasury Department previously identified Malofeev as one of the main sources of financing for Russians promoting separatism in Crimea and for providing material support for the so-called Donetsk People’s Republic. After being sanctioned by the United States, Malofeev attempted to evade the sanctions by using co-conspirators to surreptitiously acquire and run media outlets across Europe.

We are also announcing the seizure of millions of dollars from an account at a US financial institution, which the indictment alleges constitutes proceeds traceable to Malofeev’s sanctions violations. The Justice Department will continue to use all of its authorities to hold accountable Russian oligarchs and others who seek to evade US sanctions.

The second action we are announcing today is a disruption of a global botnet controlled by the Russian military intelligence agency, commonly known as the GRU. The Russian government has recently used similar infrastructure to attack Ukrainian targets. Fortunately, we were able to disrupt this botnet before it could be used. Thanks to our close work with international partners, we were able to detect the infection of thousands of network hardware devices, we are then able to disable the GRU’s control over those devices before the botnet could be weaponized.

Today’s announcements are part of a series of actions that the Justice Department has recently taken to disrupt and prosecute criminal activity associated with Russia. Yesterday, together with our German law enforcement partners, we seized the Russia affiliated Hydra darknet market, the world’s largest illegal marketplace on the dark web. We also filed criminal charges against a Russian national who we alleged administered the markets technical infrastructure.

And on the day before that, again, with our international partners, we seized the Tango, a super yacht owned by Viktor Vekselberg, another sanctioned oligarch with close ties to the Russian regime. On that same day, we obtained seizure warrants targeting the assets of several additional sanctioned Russian nationals.

The Justice Department will continue to work alongside our international partners to hold accountable those who break our laws, threaten our national security and harm our allies. Our message to those who continue to enable the Russian regime through their criminal conduct is this, it does not matter how far you sail your yacht, it does not matter how well you conceal your assets, it does not matter how cleverly you write your malware or hide your online activity, the Justice Department will use every available tool to find you, disrupt your plots and hold you accountable.

Finally, I cannot close without acknowledging the horrible images that all of us have seen coming out of Ukraine, particularly from Bucha this week. We have seen the dead bodies of civilians, some with bound hands, scattered in the streets. We have seen the mass graves. We have seen the bombed hospital, theater and residential apartment buildings. The world sees what is happening in Ukraine. The Justice Department sees what is happening in Ukraine. This department has a long history of helping to hold accountable those who perpetrate war crimes. One of my predecessors, Attorney General Robert Jackson, later served as a chief American prosecutor at the Nuremberg trials. Today, we are assisting international efforts to identify and hold accountable those responsible for atrocities in Ukraine, and we will continue to do so. I’m now going to turn over the program to Deputy Attorney General Monaco who will share more information about the indictment that was unsealed today.

Deputy Attorney General Lisa Monaco: (05:00)
Thank you, Mr. Attorney General. And good morning everyone, thank you all for joining us today. As the Attorney General said, we are here today because of actions the Department of Justice has taken today and in recent weeks, actions that make clear that the same Russian government struggling to defend its unprovoked and unjustified war in the Ukraine is also corrupt at its core. The world has watched with outrage as innocent Ukrainians continue to suffer at the hands of the Russian government, and for decades, the regime has been propped up by pervasive corruption. The corruption starts at the top with Vladimir Putin’s oligarch cronies who earned billions of dollars by committing crimes, often at the expense of the Russian people. The crimes these billionaires facilitate, in fact, facilitate Russia’s unprovoked aggression and fuel a life of luxury for the very few. The world watches in horror as Ukrainians are forced to flee their homes, schools, and hospitals and as they bury innocent civilians.

Last month the Attorney General asked me to establish a task force, Task Force KleptoCapture, to use the full range of the department’s authorities to hold accountable those oligarchs who enable the Russian regime, and to ensure that those same oligarchs feel the pain of the sanctions that have been levied on them in response to Russia’s aggression in Ukraine. That task force has been hard at work.

Earlier this week, our law enforcement partners in Spain, acting on our request and pursuant to a warrant issued by a United States court, seized a $90 million yacht named the Tango belonging to sanctioned Russian oligarch, Viktor Vekselberg. That yacht was subsequently searched by Spanish authorities accompanied by agents of the FBI and Homeland security investigations. Vekselberg was sanctioned in 2018 by the US Treasury Department as part of a sweet of sanctions imposed in response to Russia’s invasion of Crimea. Mr. Vekselberg defied these sanctions to finance his luxury lifestyle, including making payments through US banks for the support and maintenance of his yacht, a direct violation of the sanctions imposed on him. In seizing the Tango, the Department demonstrated our commitment to holding accountable corrupt Russian oligarchs, a commitment we are not finished honoring.

Today, charges have also been unsealed in the Southern District of New York against Konstantin Malofeev, a Russian national and a Russian oligarch. Malofeev is charged with conspiring to violate, and violating, United States sanctions. These are the first criminal charges brought by the Department of Justice against a Russian oligarch since Russia invaded Ukraine. Mr. Malofeev was designated as a result of the Crimea sanctions, which forbade him from conducting financial transactions with United States persons or with property in the United States. In the years since he was sanctioned, Mr. Malofeev is alleged to have flagrantly and repeatedly violated the sanctions imposed on him while attempting to establish media companies across Europe, media companies that would help spread pro-Kremlin misinformation. Mr. Malofeev further violated US sanctions in a scheme to transfer shares he owned in a Texas bank to a business associate in 2015.

Today, in addition to the criminal charges filed against Mr. Malofeev, we have seized that multimillion dollar investment. While the oligarchs provide some of the most ostentatious displays of Russian illicit finance, they are not the only ones whose financial misconduct is tied to Russia. Yesterday, the department of justice disrupted the Hydra Market, the world’s largest and longest running darknet marketplace. At the same time, the Department of Justice brought criminal charges against Dmitry Pavlov, a resident of Russia, for his role in operating and administering the servers used to run Hydra. Our partners at the German federal criminal police played a critical role in this operation and seized over 25 million dollars in Bitcoin from Hydra. And our partners at the Treasury Department announced sanctions on the cryptocurrency exchanges believed to have facilitated many of Hydra’s transactions.

As alleged, Hydra enabled users in mainly Russian speaking countries to buy and sell a staggering variety of illicit goods and services, including, illegal drugs, stolen financial information, fraudulent passports, and even hacking tools and hacking services. Transactions on HDRA were conducted in cryptocurrency. And last year, Hydra alone accounted for an estimated 80% of all darknet market related cryptocurrency transactions. Since 2015, the marketplace has received approximately 5.2 billion dollars in cryptocurrency. Let me say that again, Hydra alone accounted for an estimated 80% of all darknet market transactions, more than five billion dollars in cryptocurrency.

Working side by side with our German partners, whose assistance was critical to our efforts, as well as our law enforcement partners at the IRS and the US Postal Inspection Service here at home, the DEA and the FBI have ensured that cryptocurrency can no longer be used by these criminals to fuel their crimes. Taken together, these actions make clear that those who violate our laws should expect to face justice. As Russia and its aggression continues, we have our eyes on every yacht and jet, we have our eyes on every piece of art and real estate purchased with dirty money, and on every Bitcoin wallet filled with proceeds of theft and other crimes. Together with our partners around the world, our goal is to ensure that sanctioned Russian oligarchs and cyber criminals will not find safe haven. And now I’ll turn it over to Director Wray to discuss another tool employed by the FBI to address Russia’s aggression.

Director Christopher Wray: (12:18)
Thank you, Lisa. I’m pleased to be here today to help announce this series of actions countering threats originating from Russia. I want to focus for a few minutes on the FBI’s role in one of the actions the Attorney General mentioned and what it says about the FBI’s unique cyber capabilities and what we can accomplish together with the private sector. Today, we’re announcing a sophisticated court authorized operation disrupting a botnet of thousands of devices controlled by the Russian government before it could do any harm. We removed malware from devices used by thousands of mostly small businesses for network security all over the world, and then we shut the door the Russians had used to get into them.

Yesterday’s darknet take down struck a blow against Russian criminals and the ecosystem of cryptocurrency tumblers, money launderers, malware purveyors, and others supporting them. The botnet disruption we’re announcing today strikes a blow against Russian intelligence, the Russian government. The bot network we disrupted was built by the GRU, the Russians government’s military intelligence agency. And in particular, it was the unit in the GRU known to security researchers as Sandworm Team. This GRU team, Sandworm, had implanted a specific type of malware known as Cyclops Blink on thousands of WatchGuard Technologies Firebox devices, these secure appliances, mainly firewalls, that are typically deployed in home office environments and in small to midsize businesses. Sandworm strung them together to use their computing power in a way that would obfuscate who was really running the network to let them then launch malware or to orchestrate distributed denial of service attacks like the GRU has already used to attack Ukraine.

And I should note here, that the GRU’s Sandworm team has a long history of outrageous destructive attacks. The disruption of the Ukrainian electric grid in 2015, attacks against the Winter Olympics and the Paralympics in 2018, a series of disruptive attacks against the nation of Georgia in 2019 and in 2017, the NotPetya attack that devastated Ukraine, but also ended up hitting systems here in the US throughout Europe and elsewhere causing more than 10 billion dollars, that’s with a B, in damages, one of the most damaging cyber attacks in the history of cyber attacks.

With the court authorized operations we’re announcing to today, we’ve disrupted this botnet before it could be used. We were largely able to do that because we had close cooperation with WatchGuard. We’ve worked closely with WatchGuard to analyze the malware and developed detection tools and remediation techniques over the past several weeks. And our operation removed Russia’s ability to control these Firebox devices on the bot network and then copied and removed malware from the infected devices. Now, I should caution that as we move forward, any Firebox devices that acted as bots may still remain vulnerable in the future until mitigated by their owners. So those owners should still go ahead and adopt WatchGuard’s recommended detection and remediation steps as soon as possible.

We’re continuing to conduct a thorough and methodical investigation, but as we’ve shown, we are not going to wait for our investigations to end to act, we’re going to act as soon as we can with whatever partners are best situated to help to protect the public. This announcement today shows the value of the FBI’s technical expertise and unique authorities, both as a law enforcement agency and an intelligence service. That unique combination, both of which were essential to the success of this operation.

It also shows what we can accomplish with our partners to help companies like the thousands of mostly small businesses affected by this botnet hit by threats like these posed by the Russian government. Our partnership with the private sector was key here, WatchGuard enthusiastically cooperated with the FBI to figure out the source of the infection and to counter it. That kind of cooperation makes successes, like the one we’re announcing today, possible. And it’ll continue to be important going forward. The Russian government has shown that it has no qualms about conducting this kind of criminal activity and they continue to pose an imminent threat. And this global bot net disruption, in conjunction with the other actions discussed today, reflect an aggressive effort by the FBI and our partners to go on offense against Russian cyber threats wherever they appear.

I’d also like to commend our partners at the DEA, IRS and our foreign partners on the Hydra darknet take down, and all the men and women of the FBI involved with both of those operations, as well as the indictments and property seizures involving Russian oligarchs this week. I should emphasize that we will continue to rely on companies to work with us the way WatchGuard has so that we can protect our nation’s cyber security together.

For businesses, I would encourage you to have a cyber security plan and to include contacting your local FBI field office as an important part of that plan. And if you suspect a cyber intrusion, please contact your local FBI field office immediately. The more quickly we get involved, the more we can do to protect you. We are laser focused on disrupting the threat on preventing harm from dangerous adversaries. And sometimes that means making arrests, and other times, like both yesterday and today, that means taking adversaries capabilities off the field. No agency or business can do this alone, it takes everyone’s cooperation, and the FBI will be there to work with you on cyber threats from Russia or anywhere else.

Finally, I would like to thank and congratulate our FBI teams in a wide number of field offices, both here in the United States, and our legal attache offices overseas, for their work that has paid off this week, with seizing sanctioned assets here and in Spain, with the indictments that we’re announcing today and with the disruption of both criminal and hostile intelligence activities that we’re here to discuss this morning. Thank you.

Speaker 4: (19:38)
[inaudible 00:19:38] we’ll take some questions.

Speaker 5: (19:40)
Mr. Attorney General, you said the Justice Department has a long history of holding those accountable who commit war crimes. What role for the Justice Department do you contemplate in Ukraine?

Yesterday, I personally spoke with our chief justice department prosecutor in Paris who was meeting with the French war crimes prosecutor. The day before, criminal division prosecutors met with prosecutors from Eurojust and Europol to work out a play land for gathering evidence, with respect to Ukraine. And at the same time, the United States is, at the request of the Ukrainian prosecutor, assisting in the collection of information with respect to the atrocities that took place in Ukraine and that are still taking place.

Speaker 4: (20:31)
All right, Jake.

Jake: (20:34)
Mr. Attorney General, are you calling for a Nurnberg style trial, and would you be involved in that, number one? And on an off topic question, I know that you don’t comment on ongoing investigations, but would you confirm that you’re being briefed on the Hunter Biden investigation?

All right, on the second off topic question, we don’t comment about pending investigations, so that’s the best I can give you on that. On the former, I’m not calling for anything at this time, now we’re in the collection of evidence stage and that’s what we’re doing. We’re helping our European partners and our Ukrainian partners and our partners across the United States government, including the Department of State to collect the information on the atrocities that we have all seen in both photographs and video footage over this week. I can’t help but pain every one of us to watch that, but that’s what we will be doing, collecting that information for the purposes of investigation.

Speaker 4: (21:34)
[inaudible 00:21:34].

Speaker 7: (21:34)
The announcement today is about sanctions dating back to actions that happened in 2014. Does the Justice Department need to move faster to make these sanctions matter in what’s happening in Ukraine today? Do you need or want more authority in some fashion to move faster on sanctions?

Well, I hope you were going to conclude that we were moving awfully fast, given the number of things that we’ve announced today and we’ve announced before. Once sanctions are imposed, that freezes, then the violation of sanctions is attempting to move them, attempting to hide them, attempting to distribute them. So of course, we’re moving on the ones that have violated the sanctions rules. But we also have sanctions that the Treasury Department has imposed and anyone who attempts to violate those sanctions will be prosecuted, investigated, there will be seizures as soon as we can.

Speaker 4: (22:27)
Chris.

Chris: (22:28)
Mr. Attorney General, I’m wondering how much you’re seeing evasive activity by Russian oligarchs that you’re targeting at this point? What kind of specific steps are they taking the hide their assets? And then if I may, can you-

[inaudible 00:22:46] that one first. So I’m going to turn to the Deputy Attorney General and the director of the task force to answer that question.

Thanks very much. Well, as the Attorney General mentioned, the sanction’s activity, once those were imposed, that freezes the assets, and the criminal activity is in itself the evading of those sanctions, so seeking to move those assets. Now, I’m not going to disclose to you what we see in our investigations, but sufficed to say that we have sophisticated methods and a great deal of expertise that we’ve brought together with the KleptoCapture task force, whether it’s money laundering, tracing, sophisticated cryptocurrency tracing efforts, you name it, we’re bringing all of that to bear to go after the efforts to evade these sanctions using whatever means criminal actors use. I’ll ask Mr. Adams, if he’s got anything to add?

Mr. Adams: (23:40)
Thank you. I think as the indictments themselves lay out, the Department’s aware of a number of different typologies and processes by which people attempt to hide assets. There are obviously public reporting and very much public online Twitter feeds regarding the physical movement of ostentatious property that I think everybody’s aware of. The Department’s aware of those and other efforts, and we’ll continue to investigate evasion in all forms.

Chris: (24:09)
And Mr. Attorney General, if I may just do a quick follow up-

[crosstalk 00:24:12] go for it.

Chris: (24:14)
You mentioned that you’re helping to document the war crimes that are taking place, and that you’re helping your international partners. Can you be more specific on how you’re helping them? What specifically are you doing?

Well, I think I’ve told all I can tell right now. We’ve been meeting with Europol and Eurojust in Paris over this week. And as I said, our most senior Justice Department criminal division prosecutor has been meeting with the French war crimes prosecutor, and we’re working with the state department team on a multinational effort to support the Ukrainian prosecutor.

Speaker 4: (24:54)
Last question, [inaudible 00:24:54].

Speaker 10: (24:55)
Mr. Attorney General, can you first, identify the media organizations that you believe are linked to the oligarch? And then I have a second question.

I don’t know whether that was disclosed in the indictment, but I’ll leave it to…

Mr. Adams: (25:10)
The specific names are not disclosed in the indictment. Mr. Malofeev is obviously a public personality and you’ll find plenty of information of him on open source.

Speaker 10: (25:24)
And then, if I may, it’s been several weeks since the Department received a referral from Congress on Mark Meadows, and the House is poised to vote again on two referrals today. What do you say to those who may be losing confidence in the Department because it’s taking so long? And do you have concerns that congressional referrals become somewhat toothless if the Department doesn’t take enforcement action?

So the Meadows referral went to the United States Attorney for the District of Columbia, it’s been made quite public and we will follow the facts and the law wherever they lead. We don’t comment any further on investigations. Thanks.

Speaker 4: (25:57)
All right, thank you everybody.

Thanks, everybody.

Speaker 4: (25:58)
Thank you all.

Justice Department officials on efforts to disrupt “criminal Russian activity” 4/06/22 Transcript

Stay updated.