#Billion Dollar Bank Heist | Explore Tumblr posts and blogs

unichrome · 1 year ago

Text

The biggest heist that almost was

Let me tell you about the most insane bank heist that is going to sound like I'm just leaking the script for the next American hacking movie. The goal? Steal one billion USD. And it all began with an email and a printer, which as we all know is where problems usually start. Another weapon in this heist was... Weekends and time zones.

As usual, no prior computer science education needed.

What happened?

On the morning of February 5th 2016, a printer had stopped working in the central bank of Bangladesh (Bangladesh Bank). But it wasn't just any printer, it was the printer responsible for printing all the records of the multimillion transfers going in and out of the bank. When the poor employees finally won the printer battle and had it resume normal operation, they saw a very concerning account transfer in the records that was coming out. The bank had an USD account in the USA, at Federal Reserve Bank, with approximately 1 billlion Dollars in it, and the Federal Reserve Bank had received instructions to drain almost the entire amount. In the records that came out in the printer, the American bank had attempted to urgently message the Bangladesh bank regarding this transfer, but couldn't get through to them. This was because the hack had actually started the day before, Thursday 4th, at around 20:00 Bangladesh time, when the bank was closed. However, USA had just started their day, giving the American bank plenty of time to follow through with the instructions from the Bangladesh bank to drain their entire account while they were closed. And that wasn't the end of it, as weekends are from Friday to Saturday in Bangladesh, meaning that the Bangladesh bank headquarters in Dhaka wouldn't discover this withdrawal until Sunday morning. That's when they immediately tried to reach the American bank, which of course didn't work as over there it was Saturday evening, and the American weekend is from Saturday to Sunday, meaning that they wouldn't be reachable until Monday.

You see what I mean by the hackers using time zones and weekends, finding the perfect time for the American bank to execute their orders while Bangladesh discovers the withdrawal several days too late, and again several days too late for Americans to be reachable. But it didn't stop there with their timehacking.

The money had to go somewhere from the American bank, and it would be stupid to send it directly to the hackers own account without laundering the money first. So they had set up four different bank accounts in the Philippines, using fake names and credentials. Why the Philippines? Because the Lunar new year was on Monday the 8th, which is a holiday and holiday means no bank activities in either Bangladesh or the Philippines, buying the hackers even more time. As a final act, they messed with the printer responsible for printing transaction records, adding another few hours to their schedule. Moon and stars really aligned perfectly for this plan.

But how did they do it?

It all began one year prior, in January 2015, with an email sent to several employees at the Bangladesh Bank. The email seemingly contained a job application from a person who didn't actually exist, but who was very polite in his request for a position at the bank, with a link to his CV and cover letter. Naturally this link led to a document with a little surprise gift - malware. Since the heist happened, at least one of the recipients must have clicked the link, and successfully deployed a RAT - Remote Access Trojan, malware that lets you control a computer from the comfort of your own home, as well as a toolkit with various malware to move from computer to computer, avoiding discovery, and covering their tracks.

From there, the hackers slowly made their way through the bank offices network, one step at a time to avoid setting off alarms, looking for any computer that had control of the banks SWIFT setup. SWIFT lets banks transfer large amounts of money between themselves and other banks connected to SWIFT. And as soon as they found one of those computers, they stopped. They didn't need to hack SWIFT in the traditional sense of the word - since they operated in a bank computer, the SWIFT-software assumed they naturally had to be bank employees. However, one of the parts of the malware used in the heist was for manipulating the SWIFT system, as the hackers weren't physically there to press anything. Additionally, since they were laying dormant for the time to strike, they needed to keep an eye out for SWIFT updates that could detect any tampering with the system, and adapt accordingly.

Then they waited many months for the stars to align on February 4th, 2016.

There were 35 transfers made by the hackers from the American bank account, totaling almost 1 billion USD, but there were two of these tiny little seemingly insignificant details that prevented this from becoming the worlds largest bank heist in history. The hackers biggest enemy became this concept known as “words”.

The Philippine bank accounts were all located in the same RCBC Bank office on Jupiter Street in Manila. And this would be the hackers downfall, as USA had sanctions put on an Iranian cargo ship called Jupiter. Since the transactions went to a recipient that contained the word “Jupiter”, it created a security alert in the Federal Reserve Bank that the employees needed to investigate. When they saw what was going on, they managed to stop all but five of the initial 35 transactions, thus “only” roughly 100 million USD made it to the Philippines. The Bangladesh bank requested to reverse the transactions, but since the money was in the Philippines, they would need bureaucracy in form of a court order to reclaim the money, and we all know that's not a 5 minute project. It was when Bangladesh filed the court order in late February that the case became public (since court orders are public documents) and the news broke to the country.

Once in the RCBC bank accounts, the money arrived on Friday the 5th and was immediately moved again. First the 100 million was converted to local currency, and some of it was withdrawn in cash, while the rest was sent off to other hacker-controlled locations. And this is where the second tiny little detail cut off even more of the hackers precious payday. 20 million USD had been sent to Shalika Foundation, a charity organisation in Sri Lanka. But, once again the hackers worst enemy - words - decided to strike again. A typo was made in their transaction, sending the money to “Shalika Fundation”, and a bank employee who must have had their morning coffee spotted this typo and rejected the transfer and kept the funds frozen. This left the hackers with 80 million USD.

✨Now comes the money laundering!✨

There was a second reason for choosing the Philippines as deposit zone; gambling is legal and the casinos had no money laundering regulations imposed. The accomplices of the heist booked private rooms in two casinos located in Manila - Solaire and Midas - and proceeded to purchase tokens to gamble for with the stolen money. Since they played with a room consisting of their fellow accomplices, winning was not really much of a challenge. Then the tokens could be exchanged back to money that would now be clean. To avoid suspicion, they didn't gamble all of the money at once, but over the course of several weeks gambled away the dirty money to clean money.

Who was behind it?

It's normally difficult to pinpoint where the more sophisticated hacking groups come from. Oftentimes, they will leave false clues behind that points to another group so they will face more trouble instead of the group that did it. They may even place clues from several different groups, just to mess with the analysts. It's also quite common to simply “steal” a way of working from another group, or use a leaked/stolen tool from another group (criminals aren't safe from other criminals, especially not in this business) - there are new malware coming out all the time with code that is just a slight modification of a well-known malware actor that had their source code leaked or simply had hired the same programmer. Or they may leave no clues as to who was behind it. Attribution to the guilty part is usually the single most difficult mission in IT-security - often it's just pure guesswork with little to no solid evidence to back it up, if you're lucky there's circumstantial evidence.

This case was no different. The first clue came from the IP the bad guys used to connect to the Bangladesh bank from. It was located in Pyongyang, North Korea. But, as I mentioned, this is not a conclusive verdict, as the IP may simply be planted false evidence to throw the analysts off their track. After the heist, the hackers used a data-wiper to scrub as much of their malware off the bank systems, but they didn't succeed in deleting all of it, some of the tools were still present, including the wiper.

Due to the scale of this operation, it caught the attention of every single IT-security person and IT-security company worldwide, who all of course wanted to know who and how they did it. With the remaining malware, a joint effort was made, comparing malware code to other malware code for similarities. Some was found in Poland, after an analyst noted the similarities from another suspected North Korean hack. Some was found in another infamous North Korean hack targeting Sony Pictures. More and more signs pointed towards the same actor. Some were false leads, the hackers seemed to be wanting to implicate the Russians did it, but failed quite miserably at that, just sprinkling random Russian words into the malware and making it way too obvious it was a ruse.

You may not believe this, but the North Korean government has one of the most notorious hacking groups in the world, known as the Lazarus Group. Some of its more well-known adventures include an extremely data-destructive hack of Sony Pictures (as punishment for releasing “The Interview”), creation of the ransomware WannaCry which was used against many targets worldwide (including hospitals), and various attempts at gathering information from governments and government-affiliated corporations all over the world. And, of course, this heist.

Eventually, after months of collaboration all over the world, the final verdict fell on North Korea, and specifically one of their programmers. His name is Park Jin Hyok, and worked for Chosun Expo - a front company for the North Korean government, located in Dalian (China) who used the funds of the fake corporation gained from legitimate programming jobs from customers worldwide to create the malware and plan the heist with all of its expenses. Of course he wasn't the sole person involved in this project, but it's the only person we know was in it.

This particular heist had been meticulously planned for several years, and Park Jin Hyok had moved to Dalian, set up fake IDs and built a network of contacts there to avoid suspicion. However, he didn't manage to delete all of his online footprints, and became the number one suspect when his internet activities suddenly came from Pyongyang, North Korea.

Additionally, several Chinese business men - many associated with the casino industry in China's Macau territory - were also charged and arrested for assisting with setting up the gambling rooms and coordinating the money laundering process. One unknown Chinese business man managed to get away with 31 million USD of the 80 million that remained after the heist, and as you would expect, he was never to be seen again.

With the middlemen from China paid off, not much remained of the original 1 billion to North Korea. But the heist has fascinated the whole IT-security world nonetheless.

I remember when the news of this case dropped to the IT-security world, who all wanted to take part in the hunt. It was a very fun time, we were all sitting at the edge of our seats waiting for the next update. I hope it was at least somewhat exciting for you too to read about, and thank you for reading this long post! If you liked it, please consider reblogging as it motivates me to write more. You may also like malware stuff I've written about before, such as Stuxnet or just plain evil malware that is a threat to our daily lives.

As always my inbox is open if you have any questions.

#datatag #bangladesh #heist #lazarus #north korea #malware #security #Bank #Hacking #Cybersecurity

79 notes · View notes

unproduciblesmackdown · 1 year ago

Text

forgot i had the thought like if anyone's leaving b/c they're so totally to nice for this business why isn't it ben (ft. tuk as a duo) the person who's always been [hey this guy doesn't fit in here! he's too nice!!] thee most, as well as actually committed the whole time to Not bullying anyone around him

if ben & tuk had just left / stayed away then (a) maybe they were so loath to possibly have an episode without ben kim, speaking of the [s1 shit] priority put on the overall season. but it's a sacrifice that could be considered for the tradeoff of "why not give that [walking away b/c you just can't accept being So Mean]" which would of course also feel much more relevant for ben being told like "yeah you'd have to do what i did to step on tuk specifically, for example" versus rian who was just turning her own [is herself actually among the Constant Workplace Bullies] on tuk 4 min prior. and (b) then i guess we could have rian just standing there in the end too like oh right who are you again? and that also would've made it all the clearer like oops she's just become a generic employee who Could blend in with victor and dollar bill b/c she's just Another bully with Another slight variation in her style of being so, but that's a matter of like: yeah you made this bed now lie in it. she stopped having a chance to be a funny little guy of a tertiary rank & file character b/c she started to be an inconsistent plot device instead, & was never given the prominence to at least truly drive plots instead of staying that [plot device who just veers off in whatever direction another, truly prominent character's plot needs] like yeah you should've picked one for this character, or if not, had her leave at the end of s5. and if not, had her leave at the end of s6. and if not, well, here we are dealing with billions having to insist she's had an arc, as well as that she hasn't Already just been yet another employee with the bullying spirit completely suited to just stick around here forever

meanwhile billions seemed to focus not on "the thing about ben, & tuk, isn't that they don't fit in b/c way too much they're among the people who try not to be awful to everyone else whenever they feel like it" but instead focused on "the thing about ben & tuk is that [sound of luke bradford crashing their fake married bank heist moment] people think they're PUSSIES!!!!!!!!!!"

#winston billions #like Okay that they're just still around now #and lord feel free to have finally written rian leaving #truly a disappointment like sorry they didn't write a role either getting to be [funny little guy] &/Or [any actual prominence]#what a disaster. and really no affection left obviously for just this clear endpoint of rian still being a bully / presumably always will #get That moment outta here and give it to ben &/or tuk getting to also choose otherwise on their own terms perhaps #like again Fine I Guess they also can just stay b/c they always have...? too Nice to quit #but like there's people who Do have this actual conflict w/this workplace while w/rian it's so much less substantial/believable #can't stop now!! made this bed now just slowmo putting on sheet after sheet (ref to wretched 4x12 moment) Forever to avoid lying in it #fr like supposed to be like ''oh but they haven't left before; so why now'' well exact same question about rian then #''oh but rian's had all the confidence boosters like. learning what research is'' ben & tuk have had those too! all the more notably!

2 notes · View notes

mariacallous · 1 year ago

Text

A mention of North Korean hackers typically conjures images of either crippling cyberattacks or, more often, massive cryptocurrency heists. But a new report on the authoritarian state’s capabilities and tendencies paints a different picture.

The report, prepared by cyber-intelligence firm Recorded Future and shared exclusively with Foreign Policy, labels espionage as the predominant motive of North Korea’s cyberprogram. Recorded Future analyzed 273 cyberattacks over a 14-year period linked to North Korean state-sponsored groups and found that information collection was the primary motivation for more than 70 percent of them.

“The narrative seems to be that North Korea is a bunch of cybercriminals that are backed by a state, but they’re just pulling off all of this financially motivated cybercrime, and that is one aspect of their strategy,” said Mitch Haszard, a senior threat intelligence analyst at Recorded Future and lead author of the report.

“But what this report shows is that they’re still heavily focused on information collection, or cyber-espionage, and they conduct more of those operations than they do financially motivated or financial theft operations.”

Pyongyang predominantly seeks to use cyber-operations to either “gain insight into how its adversaries think” or “access to information on technologies” that will help it in a conflict with those adversaries, the report said. Government entities are the most frequent targets, followed by cryptocurrency, media, finance, defense, and nongovernmental organizations.

“North Korea’s leadership appears to be much more interested in learning about what others think of them, gathering information that can help them develop nuclear and ballistic missile technology, and stealing money to fund their regime,” the report added.

However, North Korea’s obsession with cryptocurrency is unique, and the country’s cyber-operations are one of its biggest avenues to prop up its nuclear arsenal. Anne Neuberger, the White House’s cyber czar, said at an event in Washington last month that half of the regime’s missile program is funded by cryptocurrency and cyberheists.

“There aren’t really any other states or countries that are trying to steal cryptocurrency, so North Korea is unique in that perspective, but they still do a lot of things that other states do,” Haszard said.

The heists tend to make headlines, with North Korean hackers linked to thefts worth billions of dollars from cryptocurrency exchanges around the world in recent years, with two high-profile attacks on exchanges in Estonia and California so far this year. Beyond crypto, North Korea has been linked to larger and more disruptive global attacks, starting with the crippling of Sony Pictures just under a decade ago that put its cybercapabilities on the map. That was followed by a hack of Bangladesh’s central bank that compromised the global financial transfer system known as Swift, and a crippling of the United Kingdom’s National Health Service.

However, Haszard and his colleagues found that the vast majority of North Korea’s cyberactivity goes after targets much closer to home. Nearly 80 percent of the attacks for which geographic information is available took place in Asia, according to the report. Most of that is in its immediate neighborhood: South Korea accounted for just over 65 percent of the targets among the 29 countries where attacks took place. The United States is a distant second, at 8.5 percent, and no other country accounted for more than 3 percent of North Korean attacks.

Recorded Future found that Lazarus, the most notorious and high-profile hacking group linked to the authoritarian regime, tends to go after more global targets but is not the most common perpetrator of cyberattacks. That distinction belongs to a group called Kimsuky, which mainly targets Asian government and civil society entities and accounted for more than one-third of total attacks. According to multiple U.S. law enforcement agencies, Kimsuky hackers pose as South Korean journalists, exchanging emails with their targets on the pretext of setting up interviews before sending them a link or document embedded with malware. That malware, known as BabyShark, gives hackers access to the victims’ device and communications. “Kimsuky actors have also been known to configure a victim’s email account to quietly auto-forward all emails to another actor-controlled email,” a joint cybersecurity advisory by the FBI, National Security Agency, and South Korean authorities earlier this month said.

While Pyongyang has established its ability to disrupt critical infrastructure in the West and conduct ransomware attacks, it is increasingly less likely to conduct those types of attacks compared to other cyber-capable adversaries such as Russia and China. It prefers to go smaller, faster, and more frequently, deploying more basic techniques such as stealing passwords or phishing emails, which infect systems with viruses by fooling users into clicking on dodgy links.

“The thing that I see in my tracking of North Korean threat actors is an incredible amount of activity that is generally low-sophistication in nature,” Haszard said, adding that that’s likely a matter of strategy rather than ability. “They’re achieving a lot of success doing the kind of lowest-common-denominator cyberattacks. So if it were me, why would I change?”

3 notes · View notes

nsfwhiphop · 2 days ago

Text

(Second Draft Version) Incoming Text for Jessica ‘Simply Jess’ Marquez (@iamjessmarquez) and Chloë Sevigny (@chloessevigny):

Dear Jessica and Chloë,

Dialogue between Prince Angelo, Jessica, and Chloë:

Prince Angelo: “So, tell me, have you received any phone calls from my envious haters?”

Chloë: “Oh, plenty! They hate you so much it’s practically an obsession. I’m honestly tired of it. They don’t even realize how much they’re making you look good by going on and on.”

Jessica: “I know, right? They go out of their way to talk about you but can’t even prove anything real. It’s funny—they only make you look even better by failing to back up their wild theories.”

Prince Angelo: “Exactly. I’m handsome, and my haters are, well...let’s just say not as blessed. Why else would they be so hung up on me? Only insecure people feel the need to prove something.”

Jessica: “They don’t get it—they’re giving you free publicity every time they go on about you to people who’ve never even met you. It’s like free ads! They think they’re slandering you, but all they’re really doing is making you look better.”

Prince Angelo: “It’s hilarious. My envious haters are so uneducated. If they understood what they were doing, they’d realize that their slander has given me billions in free advertising.”

Chloë: “You know, for a 5-minute Super Bowl ad in 2024, companies are paying around $70 million! A 30-second spot alone costs $7 million. Yet here you are, getting way more reach than that—for free—just from your haters’ non-stop talk.”

Prince Angelo: “Exactly! I’ve let them slander me freely for the last 12 months, and it’s all worked in my favor. People expect proof of their accusations, but when they can’t provide any, they only boost my reputation. In the end, people aren’t stupid—they can see who’s in the wrong.”

Chloë: “They’re so clueless. Every time they slander you, they actually make you look even more respectable in people’s eyes. It just proves you’re smarter than all of them. They’ll eventually have to back up their accusations, and when they can’t, guess who comes out on top? The smartest prince they’ve ever known.”

Jessica: “They might be able to slander you, but can they prove anything? We’re all waiting. If they can’t show any proof, it’s checkmate for Prince Angelo, the ultimate chess player.”

Prince Angelo: “Exactly. Checkmate, idiots!”

Jessica: “You know, it’s been a year since all this started in November 2023. I remember getting so many calls from people they’d convinced to think badly of you, but now? They still haven’t proven a single thing. You look more innocent than ever, and they’re the ones who look guilty.”

Prince Angelo: “Yep, they thought they were bringing me down, but they didn’t realize that I was letting them do it. I stayed silent, knowing they had nothing. And now, a year later—November 2024—where’s their proof? Nowhere. They’ve humiliated themselves, and I’ve enjoyed billions of dollars’ worth of free publicity, just like a Super Bowl ad. My envious haters never realized they were actually promoting me to powerful people around the world.”

Jessica: “Billions in free advertising? That’s a bank robbery if you ask me.”

Chloë: “Exactly! It’s like the perfect heist. They spent the whole year promoting you for free without even realizing it. You pulled off the smartest publicity stunt ever.”

Prince Angelo: “I feel like Bugs Bunny after outsmarting Sam! My envious haters are clueless. Every time they slander my name, they’re actually working for me. Now everyone knows my name, and I didn’t even have to lift a finger. They’ve been advertising for me all this time. It’s like I stole billions in publicity right under their noses.”

My envious haters wonder why I never seek revenge? Simple—I’ve stolen billions in free advertising through their slander. Their own words paid for my fame. So, who’s the smartest and who’s the dumbest? I think we know the answer.

P.S.:

Synopsis of the Dialogue Between Prince Angelo, Jessica, and Chloë:

In this dialogue, Prince Angelo speaks with Jessica and Chloë about the ironic benefit he's gained from his critics' constant attempts to defame him. Jessica and Chloë reveal that his critics' attempts to tarnish his reputation have actually increased his visibility, functioning like free, high-profile advertising. They discuss how critics’ baseless accusations have only bolstered Angelo's image, as their lack of proof leads people to see him more positively. Chloë compares the value of this unintended promotion to costly Super Bowl ads, suggesting that Angelo has received billions in publicity without spending a dime. Angelo celebrates his critics' failure, likening the scenario to a well-played chess game where he ends up victorious by simply allowing his detractors to undermine themselves.

Synopsis #2:

In this fictional dialogue, Prince Angelo converses with Jessica and Chloë about the unintended advantage he gains from his critics. Jessica and Chloë express their frustration with the constant calls they receive from people obsessed with criticizing Angelo. Ironically, they recognize that this slander only enhances his public image, functioning like free, high-profile advertising. Chloë highlights how the critics' accusations—unsupported by evidence—end up portraying Angelo positively, as others see through the baseless claims. They liken this to the value of a Super Bowl ad, suggesting that Angelo has saved billions in publicity costs thanks to his critics’ actions. Angelo describes this dynamic as a strategic game, in which his patience allows his critics to undermine themselves, proving him “the undisputed chess player” of the situation.

0 notes

24global-news · 2 years ago

Text

The Cashier in Dubai

Investigative report tracks tangled route for money flowing to offshore companies from Moldova.

Part One

Moldovan oligarch Vladimir Plahotniuc left his home country in 2019 to avoid corruption charges. But an investigation into his business affairs, supported by newspress24-blog, shows that money continued to flow into his pockets long after he fled.

Black Box Plus, the investigative show of Moldova’s independent Tv channel TV8, acquired documents showing that Plahotniuc profited from every document Moldova’s Public Services Agency (ASP) issued between 2014-2019. Black Box TV followed the traces left by the businessman Alexandru Vilcu and Vladimir Andronachi, a former lawmaker with the Democratic Party (PD).

Documents show that the money reached Plahotniuc via Garsų Pasaulis, the Lithuanian printing house that won the public procurements for supplying blank cards the ASP uses to issue Moldovan documents, including passports. The financial circuit leads to a network of offshore companies registered in Cyprus, Hong Kong and the United Arab Emirates (UAE).

In the summer of 2020, the scheme Plahotniuc built over the years was taken over by two Bulgaria-registered companies that appeared overnight.

These companies were the identical financial offshore vehicles through which Plahotniuc, former leader of the PD, raised alleged dividends from the auctions organised by the state telecom company Moldtelecom, the purchase of electricity from the breakaway region of Transnistria, the public-private partnership for hemodialysis services and the so–called heist of one billion US dollars from the Moldovan banking system.

The Lithuanian UAB (an acronym of uždaroji akcine bendrove, or private limited company) started supplying blank cards for Moldovan passports following tenders in 2014 and 2017. The main beneficiary of the Garsu Pasaulis company is Albert Mario Karaziwan, a Belgian citizen who owns Semlex Europe, an identification document and biometric device production company whose business practices have come under scrutiny. The Syrian-Belgium businessman has been targeted in several countries in criminal corruption cases and journalistic investigations by Reuters and OCCRP.

In 2014, Moldova’s minister of information and communications technology was Plahotniuc’s fellow party member Pavel Filip. The CRIS Registru state enterprise which in 2017 was re-organised as ASP, was headed by Sergey Railean, godfather of Filip's older son.

Between 2014 and 2021, ASP transferred 59.5 million euros to the Garsu Pasaulis company "for raw material, blank cards and personalisation services," according to documents obtained by Black Box.

ASP also paid the Lithuanian company a royalty fee for software developed for Moldova and used on three types of documents. For example, the royalty fee for each passport issued was 13.61 euros (14.49 US dollars). On October 22, 2021, prosecutors opened a criminal case against nine people from the Public Services Agency “targeted in a criminal case of abuse of office”. Prosecutors estimated that the state lost around 41 million euros (43.6 million dollars) in the case.

A LONG AND TANGLED PATH

A note from the Moldovan service for the Prevention and Combating of Money Laundering obtained by Black Box shows that more than 24 million euros (25.54 million dollars) did not stop in the company's accounts in Vilnius but ended up in Cyprus and the UAE.

“Of the 135 payments made throughout this period [2014-2019], I can tell you that the final beneficiary is obvious. At least, from what the criminal investigation bodies say, it is clear that the actual beneficiary is Vladimir Plahotniuc,” said ASP director Mircea Esanu.

Sergey Railean, the ASP former director under whose mandate the two contracts with Garsu Pasaulis were signed, said that he knew nothing about benefits for Plahotniuc.

"The tender took place according to the procedures. Therefore, nothing was outside the law," Railean said.

Told that Black Box reporters had established money transfers from Garsu Pasaulis to offshore companies affiliated with Plahotniuc, Railean was asked if he knew anything about it.

"No, absolutely not. Now it is a criminal case. The file must be completed after the trial,"he said. “[…] We did not order any software."

Railean added that ASP paid royalty fees to Garsu Pasaulis "because that was the contract".

On May 5, 2022 the Moldovan anti-corruption prosecutor's office announced that Railean had the status of accused in the so-called passport affair.

Filip, who held the post of prime minister in 2016-2019, did not answer the phone calls or requests for comment.

In May 2018, during a TV show broadcast by Prime, one of Plahotniuc's TV stations, Filip hinted that the state signed a more advantageous contract with Garsu Pasaulis than the previous one agreed in 2011 with a French company.

In 2011, Garsu Pasaulis had in fact tried to win a tender, but its application failed as it did not meet ASP’s criteria. A key condition was that applicants had experience manufacturing electronic passports for at least three European countries, as established by a decision of the Supreme Court of Justice. Garsu Pasaulis did not meet this requirement.

Garsu Pasaulis replied via e-mail that the company won the tenders and successfully delivered blank passport cards for ASP.

“As for the exact details of other commercial contracts, we cannot provide any details as confidentiality commitments bind us,” Andrius Lukosevicius, director of Garsu Pasaulis’ printing security department, wrote. “However, we can confirm that we have never had and do not currently have commercial or other relations with Mr Plahotniuc and [Romanian businesswoman] Mrs Ileana-Mihaela Burcea.”

The passport cash headed south, to the UAE firm Prime Union Solutions FZ LLC. Between January 1, 2018 and July 30, 2019 itreceived transfers for over 4.7 million euros ( five million dollars) from Garsu Pasaulis. The money continued to flow into Plahotniuc's coffers even after he fled Moldova in June 2019 when his name was linked to the disappearance of over a billion dollars - nearly one-eighth of Moldova's GDP - from the country's biggest banks between 2012 and 2014.

Employees at the Moldovan Money Laundering Prevention and Combating Service obtained information from their colleagues in Dubai and stated that the company's majority shareholders were the Romanian citizen Ileana-Mihaela Burcea and the company Inter Gnathonize Limited.

Between October 29, 2018, and July 30, 2019, a total of seven million euros (about 7.4 million dollars) were credited into Prime Union Solutions’ UAE bank account, largely sent from Garsu Pasaulis. The money then traveled to Burcea’s private account in UAE and six other offshore companies.

In liaison with UAE and Cyprus’ authorities, Moldova’s law enforcement agencies determined that Garsu Pasaulis transferred another 19.6 million euros (20.8 million dollars) to another Cyprus offshore company, Gnathonize Limited, also connected to Burcea.

The Cypriot firm opened a bank account in July 2014, four months after Garsu Pasaulis won the Moldova tender. The Lithuanian firm was the main contributor to the account until August 2018. After that, the money was transferred to the company Prime Union INC LTD in Hong Kong and marked as a "dividend payment".

1 note · View note

newspress24-blog · 2 years ago