Gary Warner
Birmingham
I Research Malware, Terrorism & Social Networks of Criminals for DarkTower and Intelligence For Good!
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Gary Warner
After having a short discussion with Gemini about Chinese Money Laundering, I could tell we weren't quite connecting on my Mandarin-assistance requests, so I shared an example post from a Telegram "Crime-as-a-Service" group that was part of a Chinese Guarantee Syndicate. For context, these posts were made in the Tudou Guarantee Syndicate's group dedicated to services wanted or provided, with 63,024 subscribers as of today.
Looping back to the movie Groundhog Day
There are a lot of films that can be described as a cult classic these days. Chances are if it’s a movie that’s over five years old then there is a good chance someone will describe it as an ‘underrated gem’, to the point that it’s become a bit of a buzz word you can slap on anything and call a day. However when it comes to the movie Groundhog Day, there are few better words I would use to describe the movie than a true cult classic.
A simple guide to getting into the swing of things
With Christmas firmly behind us and the new year finally in full effect, countless students have returned to the classroom, and if you’re anything like me, it’s been a rough adjustment period. All of it can feel a bit overwhelming, and the stress of knowing it’s all coming out of your wallet can make it hard to look at things objectively. However, there are ways to help make your return or arrival on campus easier on your psyche, most of which are easier than you would think.
Our APWG eCrimes Paper on Tech Support Scam Facebook Groups
My colleague Raghavendra Cherupalli will be at APWG eCrime next month sharing a paper based on our research into the Facebook Groups where illicit Indian Call Centers share "Crime-as-a-Service" offerings with one another.
SMS Pools and what the US Secret Service Really Found Around New York
Last week the United Nations General Assembly kicked off in New York City. On the first day, a strange US Secret Service press conference revealed that they had seized 300 SIM Servers with 100,000 SIM cards. Various media outlets jumped on the idea that this was some state-sponsored sleeper cell waiting to destroy telecommunication services around New York.
Microsoft DCU's Takedown of RaccoonO365
When I saw the name of the Microsoft Digital Crime Unit's latest target, "RaccoonO365" I probably reacted to it differently than most. With the help of a friend in Lagos, we've been watching the money launderers and things have reached a point that they now refer to what we previously called "Business Email Compromise" or BEC as "O365 Jobs." Microsoft DCU is famous for doing massive takedowns of the infrastructure used by cyber criminals via Civil action in the US courts.
Indian Call Center Scammers partner with Chinese Money Launderers
When we see 25 Chinese arrests, it might be tempting to think this is all Chinese Organized Crime, but those who actually watch the videos will realize that's not the case. The referenced videos are from late 2020 and early 2021 and each started with Scammer Payback (Pierogi) responding to a refund scam.
On 08SEP2025, the District of Columbia's Attorney General filed a lawsuit against Athena, a "Bitcoin ATM machine" provider with 4100+ BTMs installed. Athena charges as much as a 26% fee when someone deposits cash to buy cryptocurrency. More importantly, the lawsuit claims that 93% of all deposits into Athena “BTMs” in the DC area were made by scam victims.
Chinese Guarantee Syndicates and the Fruit Machine
When I was speaking to a group of Bank Security people in New York City yesterday, I mentioned "machine rooms" -- which are rooms full of Apple iPhones that are used to send iMessage phishing spam. Someone in the audience asked "Where would they get that many phones?" The kids like to use the acronym "IYKYK" (If You Know You Know).I learn new IYKYK phrases in Chinese Telegram every day. Today's new favorite phrase?
In Nigeria, scammers who specialize in Romance Scams and BEC are called "Yahoo Boys." In Ghana, the term for the same activity is "Sakawa." Several Ghanaian headlines are talking about this case with headlines such as "Multimillion dollar Sakawa" or "Sakawa Chairman Busted" or "Sakawa Kingpin Bows to Extradition!" On 08AUG2025 the US Attorney's office in the Southern District of New York announced the extradition of four Ghanaian scammers who stole more than $100 Million via Romance Scams and...
Here we have another cautionary tale about off-shoring customer service when faced with the reality of Call Center Scams that commit fraud via Tech Support Scams and Government Impersonation. In this case, FirstIdea, an Indian company is charged with committing fraud against at least 100 victims from Australia and the UK.
$50 Million in BEC Losses
The Eastern District of New York has announced charges against four men for their roles in a Business Email Compromise (BEC) and romance scams.
Millions and Millions of Fraud Domains: China attacks Illegal Gambling and Telecom Fraud
Last week I was reviewing a publication by the United Nation Office on Drugs and Crime published in January 2024, titled "Casinos, Money Laundering, Underground Banking, and Transnational Organized Crime in East and Southeast Asia: A Hidden and Accelerating Threat." (URL to the UNODC report: UNODC: Casinos, Money Laundering, Underground Banking ...
BEC Scammers Adventures on the Run
Last week the case of Valentine FOMBE was finally brought to a close. FOMBE was sentenced to 144 months in Federal prison and ordered to pay $325,856 in restitution to victims of Business Email Compromise scams that he conducted from 2016 to 2018. The various court documents present nearly as many puzzles as the sentence answers. Chief among them, what happened to the co-conspirators? and why have they not also been sentenced?
Maryland Busts $9.5 Million #BEC Money Laundering Ring
Three indictments have been unsealed in Maryland that document an extensive network of shell companies that were used to wash at least $9.5 Million in funds from at least fifteen #BEC (Business Email Compromise) cases across the country. In the first indictment, those charged (with an example address from their respective shell companies): Adanegbe Gift Osemwenkhae - 8304 DEBORAH ST, CLINTON, MD 20735 (this property is listed as owned by Kat Osemwenkhae, who uses the email kateivie@yahoo.
Identification Documents: an Obsolete Fraud Countermeasure
When I'm talking to bankers and other fraud fighters, I often mention how easy it is for a criminal to obtain a Drivers License bearing any information they desire. I was reminded of this again as I saw the sentencing of Desmond Nkwenya from Brookhaven, Georgia this week.
Classic Baggie: Part Three - the Romance Scam Victims
If you are just joining us, we are reviewing the court transcripts of a Business Email Compromise / Romance Scam Money Laundering case. Part One reveals "Classic Baggie: A Delaware BEC Case calls him the leader of an International Criminal Organization" and Part Two was called "Classic Baggie: Part 2 - How to run a Money Laundering Operation." Today, we'll share the stories of three of the romance scam victims in this case. I would normally address them by their surnames as Mr. X or Mrs.
Book Review: The Crypto Launderers: Crime and CryptoCurrencies
The Crypto Launderers: Crime and Cryptocurrencies from the Dark Web to DeFi and Beyond - by David Carlisle I wish I had a way to review this book without having first read last year’s “Tracers in the Dark.” While Tracers talked about the people involved in investigating various crypto-based crimes and those early researchers who made the tracing process possible, Carlisle tells many of the same stories, but in a less engaging way.
Classic Baggie: Part 2 - How to run a Money Laundering Operation
In Part 1 of this story Classic Baggie: A Delaware BEC Case calls him the leader of an International Criminal Organization the prosecutor in the case of Olugbenga Lawal has given his opening arguments, where he calls Classic Baggie the leader of an international criminal enterprise. On the first day of the trial, before selecting the jury, an FBI Agent specializing in Transnational Organized Crime is brought in before the judge.
Classic Baggie: A Delaware BEC Case calls him the leader of an International Criminal Organization
The U.S. Attorney's office in Delaware charged Olugbenga Lawal with being a major money launderer for a Nigerian-based international criminal organization that specialized in Business Email Compromise (#BEC) and Romance Scam. Lawal was charged with receiving more than $3 million USD (that would be more than ₦2,8 Billion!) and sending funds to Nigeria both through money transfer, but also buy purchasing and shipping more than $600,000 in vehicles.
Vietnam's Massive CAPTCHA crackers vs. Microsoft DCU
Earlier this month, Microsoft's Digital Crimes Unit was featured in a WIRED article by Lily Hay Newman - Microsoft’s Digital Crime Unit Goes Deep on How It Disrupts Cybercrime. In part, the article discusses MS-DCU's case against the hackers that they call Storm-1152. According to DCU, Storm-1152 used their CAPTCHA-cracking capabilities to assist other criminals in the massive creation of Microsoft email accounts, such as Hotmail and Outlook accounts. How many?
The Grey Album, by The Black Dog
Sometimes, things "just happen". For months, we’d been working away on various projects and then, without really thinking about it, The Black EP just happened. It seemingly appeared from nowhere. We’d been talking about the old days; making music with friends and dodgy kit, renting small practice rooms and using makeshift recording studios. It was such a common thing back then, you could pick a dusty space in a half-derelict building for as little as £25 a month.
Watching a Crypto Investment Scam WhatsApp Group
Watching a Crypto Investment Scam WhatsApp Group If your online accounts are like mine, almost every day I'm "force joined" to a new Telegram group where a crypto investment scammer tries to tell everyone how great their scam investment site is. This week, I started getting added to WhatsApp Crypto Investment Scams. I thought I'd share the experience with you, in case you were curious.
SIM Swapping, Crypto Theft, and Sentencing in the United States
SIM Swapping, Crypto Theft, and Sentencing in the United States As you know from the title of my blog, "CyberCrime & Doing Time," I'm very interested in cybercrime and the criminal justice system. This week I've been looking at SIM Swapping cases and wanted to share what I learned from reading the sentencing memos sentencing transcript for Ricky Handschumacher.
The new DOJ Law Enforcement Crypto Reports (TL;DR)
TL;DR? Good news! I read them for you! On 15SEP2022, the Department of Justice released their report "The Role of Law Enforcement in Detecting, Investigating, and Prosecuting Criminal Activity Related to Digital Assets" (66 pages).
Chidozie Collins Obasi - COVID Fraud & Work at Home Scams
Chidozie Collins Obasi - COVID Fraud & Work at Home Scams During the COVID-19 crisis, the New York State Department of Health was responsible for buying and allocating ventilators to hospitals in the State of New York. Two of their hospitals will be relevant in this case.
Three UK-based Nigerian BEC Scammers Used Construction Intelligence Service to Target Victims
On 10AUG2022 three Nigerians were extradited from the UK to the US to face charges related to their roles in conducting Business Email Compromise (BEC) attacks against a number of US-based businesses. 43-year old Oludayo Kolawole John Adeagbo, 40-year old Donald Ikenna Echeazu, and 42-year old Olabanji Egbinola were brought to North Carolina to face their charges, although some of their crimes were also charged in Texas and their victims are across the United States and the world.
Please stop calling all Crypto Scams "Pig Butchering!"
Lately there has been a media-driven craze in the fraud community to call every crypto-investment scam "Pig Butchering." I hope you will join me in canceling that term after you read this article. The term "Pig Butchering" comes from the Chinese term 杀猪盘 (Shā zhū pán or "butchering plate.") While the term has been used in Chinese media since at least 2018, it really became famous after the courageous actions of a human trafficking victim who was caught up in the game.
Nigerian Money Transfer Company Linked to Romance Scam Money Laundering
On July 7, 2022, the US Attorney for the Northern District of Texas announced that Ping Express had been found guilty. Prior to this, their CEO Anslem Oshionebo*, their COO Opeyemi Odeyale (now imprisoned at the Danbury Federal Correctional Institute, 60177-177), their IT Manager Aleoghena Okhumale (now imprisoned at the Fort Worth FMC), and Olufemi Sadiq (now imprisoned at the Pollock FCI) were arrested on March 10, 2020. What was Ping Express?
That Job Your Co-Worker Emailed You About? Yeah ... No.
That Job Your Co-Worker Emailed You About? Yeah ... No. My niece, Anna, is a school teacher in the Birmingham Public School system. Another teacher in the system got phished and the phisher sent an email to a bunch of other teachers, offering them a summer job as an administrative assistant, earning $500 weekly for working only 8 hours. Tempting? The email had a link to a Google Form with the job application.
Russia's Invasion of Ukraine and CISA/FBI's New Era of Transparency
BLUF: Bottom Line Up Front I want to start this post with the most important thing right up top: The CISA.gov/Shields-Up page starts with this statement. PLEASE take it seriously, and escalate to your top management: "Russia’s invasion of Ukraine could impact organizations both within and beyond the region, to include malicious cyber activity against the U.S. homeland, including as a response to the unprecedented economic costs imposed on Russia by the U.S. and our allies and partners.
BEC Still #1, but Investment Fraud passes Romance Scams
The number of complaints increased by 7% to 847,376 from 2020 to 2021, however the reported losses increased by 64% year over year to $6.9 Billion! For several years, the #1 Cybercrime type has been Business Email Compromise followed by the #2 of Romance Scam. But this year, we had a change! The criminals have discovered how many people don't understand investing in cryptocurrency and have turned Investment Scams into a new money factory.
Chinese Call Center "Runner" Pleads Guilty in Georgia
This week the Department of Justice received a guilty plea from Jianjie Liu, a Chinese citizen living in Texas. https://www.justice.gov/usao-ndga/pr/chinese-national-pleads-guilty-money-laundering-scheme In Call Center Frauds, there are many roles to be played.
Online Shopping Reminder: If It Looks Too Good To Be True ...
That's the ad they saw on Facebook. "Due to special reasons" the company has decided to "sell the last batch of laptops." If you click the Shop Now button, it takes you to the website "maxwellplaceonhudson[.]com" Now, I'm not saying that everyone who re-uses an image is a scammer, but John J. Rogers and MaxwellPlaceHudson are using a photo from a 2019 Mainichi News article in Japan about the fact that computers were piling up in warehouses in China. Doesn't that look familiar?
To the Black Axe: #GardaWillGetYou
You may recall from July that I am very impressed with the Garda National Economic Crime Bureau (GNECB) in Ireland.
AT&T Free Msg: You know you shouldn't click ... so we did it for you!
If you live in the United States and have an AT&T phone, you are almost certainly receiving SMS messages that look something like this: AT&T Free Msg: August bill is paid. Thanks, MARY! Here's a little gift for you: n9cxr[.]info/dhmxmcmBTQ (from +1 (718) 710-0863) or AT&T Free Msg: August bill processed. Thanks, Mary! Here's a little something for you: l4bsn[.]info/C2Lx3oggFi (from +1 (332) 220-7291) or AT&T Free Msg: Latest bill is paid.
The Taliban Leadership: By the Sanctions
The Taliban announced the leadership of their new Afghan government this week. As expected, there were many familiar names to those who follow terrorism sanctions. What does this mean for financial organizations who do business with Afghanistan? Probably too early to tell. This will likely be "a living document" as we update it with new information as we have time to integrate it. Our first pass it to provide UN Sanctions designations where possible.
Hushpuppi Pleads Guilty: Sentence Estimate? 11-14 Years
On July 27, 2021, Ramon Olorunwa Abbas, also known as Hushpuppi, decided that his best plan would be to avoid spending the rest of his life in prison was to plead guilty. I've actually never seen a plea agreement with so much redacting, but we can still see SOME of what he is pleading to in the 29 page plea agreement that was posted today on PACER, the Public Access to Court Electronic Records.
Levashov Walks. Russian Spam King gets slap on the wrist
The US government and the White House like to talk tough on Ransomware. If you listen to Joe Biden, fighting Ransomware is a top priority of the US Government. He's spent time convincing the G7, NATO, and the EU to take pledges about how earnestly they want to fight Ransomware, a judge in Connecticut has decided that spammers who distribute Ransomware should walk free.
Nations come together to condemn China: APT31 and APT40
On Monday (19JUL2021) President Biden announced that the US and its allies were joining together to condemn and expose that China was behind a set of unprecedented attacks exploiting vulnerabilities in Microsoft Exchange servers conducted earlier this year.
Operation Skein: The Irish Garda Target Nigerian BEC Criminals
It seems nearly every week that the Garda National Economic Crime Bureau (the GNECB) announces a new arrest in Operation SKEIN.
Say $6 Trillion Again ... I DARE you: Examining the roots of a total BS Marketing Number
Would you like to see someone's head explode? Observe what happens when I'm researching a topic and I see a headline like this AVG story which claims "Ransomware is set to cause $6 trillion in damages by 2021." Wow. Makes you want to run right out and buy cybersecurity products, doesn't it? Fear, Uncertainty, and Doubt, the marketing department's dream formula! AVG's Marketing Department can't help themselves You really can't fault the marketing folks at AVG though ...
PPP Fraud or How to Use the CARES Act to Go To Prison
If you are one of the thousands of people who fraudulently filed for a Paycheck Protection Program or PPP Loan under the CARES Act, pay attention! This blog post is going to explain why you should return the money and turn yourself in. The CARES Act provided $349 Billion in forgivable loans that a business could use to cover payroll, mortgage interest, rent, lease, or utilities during the trying times of the pandemic.
Microsoft Exchange: Patching Too Late If Already Compromised
On March 2, 2021, Microsoft accused a Chinese APT group which they name Hafnium of compromising 30,000 Exchange servers. They announced four security vulnerabilities, known as 0-days, which refers to the fact that attackers had a reliable means of exploiting the vulnerability for which there was no patch.
The Complete Soldier Romance Scam Support Site
Yesterday we were reviewing a Work From Home "Mystery Shopper" scam, and ended by pointing out some of the scam shipping companies hosted on the same IP address. But still on our same IP address, we hit a gold mine! The complete Romance Scam with an Imaginary Soldier support site! The webpage is: usmdept.com ... you know? the US Military Department? This website has EVERYTHING an imaginary soldier might need in order to extract funds from his Romance Scam victim! Let's start with the basics.
Mystery Shoppers Challenge Gift Card Warnings
Have you ever seen those spam messages claiming they have a great job for you as a Mystery Shopper?
Phone Company Insiders Helped Global Sim-Swapping Gang Steal Millions in Cryptocurrency
This week law enforcement agencies around the world made press releases about the arrest of SIM Swapping criminals. The UK's National Crime Agency says "eight men have been arrested in England and Scotland as part of an investigation into a series of SIM swapping attacks, in which criminals illegally gained access to the phones of high-profile victims in the US.
Major Nigerian Phishing and BEC Actors, SSGToolz and CeeCeeBossTMT, Arrested by Nigerian Police and Interpol
An Interpol headline on November 25, 2020 announces "Three arrested as INTERPOL, Group-IB and the Nigeria Police Force disrupt prolific cybercrime group" however the article does not name the suspects.
CyberCrime & Doing Time
The list of the Top 15 Threats is an annual list from ENISA, with only slight changes in positions for the various threats since last year. Malware remains in the Number 1 spot, and Web-based attacks remains Number 2. Phishing actually increased from 4th to 3rd position. Spam also rose this year, from 6th to 5th position.
The ENISA Cybersecurity Threat Landscape
ENISA, the European Union Agency for CyberSecurity, met on October 6, 2020 to review their current recommendations and get any last minute changes. On October 20, 2020, they released a huge batch of reports that many folks seem to have not seen. We wanted to take a moment to give you the guided tour and strongly recommend the consumption of these report. Each publication is available "flip book" style on the ENISA website, and also as a downloadable PDF.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Gary
Contact Gary, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack