#Billion Dollar Bank Heist | Explore Tumblr Posts and Blogs

unichrome · 1 year

Text

The biggest heist that almost was

Let me tell you about the most insane bank heist that is going to sound like I'm just leaking the script for the next American hacking movie. The goal? Steal one billion USD. And it all began with an email and a printer, which as we all know is where problems usually start. Another weapon in this heist was... Weekends and time zones.

As usual, no prior computer science education needed.

What happened?

On the morning of February 5th 2016, a printer had stopped working in the central bank of Bangladesh (Bangladesh Bank). But it wasn't just any printer, it was the printer responsible for printing all the records of the multimillion transfers going in and out of the bank. When the poor employees finally won the printer battle and had it resume normal operation, they saw a very concerning account transfer in the records that was coming out. The bank had an USD account in the USA, at Federal Reserve Bank, with approximately 1 billlion Dollars in it, and the Federal Reserve Bank had received instructions to drain almost the entire amount. In the records that came out in the printer, the American bank had attempted to urgently message the Bangladesh bank regarding this transfer, but couldn't get through to them. This was because the hack had actually started the day before, Thursday 4th, at around 20:00 Bangladesh time, when the bank was closed. However, USA had just started their day, giving the American bank plenty of time to follow through with the instructions from the Bangladesh bank to drain their entire account while they were closed. And that wasn't the end of it, as weekends are from Friday to Saturday in Bangladesh, meaning that the Bangladesh bank headquarters in Dhaka wouldn't discover this withdrawal until Sunday morning. That's when they immediately tried to reach the American bank, which of course didn't work as over there it was Saturday evening, and the American weekend is from Saturday to Sunday, meaning that they wouldn't be reachable until Monday.

You see what I mean by the hackers using time zones and weekends, finding the perfect time for the American bank to execute their orders while Bangladesh discovers the withdrawal several days too late, and again several days too late for Americans to be reachable. But it didn't stop there with their timehacking.

The money had to go somewhere from the American bank, and it would be stupid to send it directly to the hackers own account without laundering the money first. So they had set up four different bank accounts in the Philippines, using fake names and credentials. Why the Philippines? Because the Lunar new year was on Monday the 8th, which is a holiday and holiday means no bank activities in either Bangladesh or the Philippines, buying the hackers even more time. As a final act, they messed with the printer responsible for printing transaction records, adding another few hours to their schedule. Moon and stars really aligned perfectly for this plan.

But how did they do it?

It all began one year prior, in January 2015, with an email sent to several employees at the Bangladesh Bank. The email seemingly contained a job application from a person who didn't actually exist, but who was very polite in his request for a position at the bank, with a link to his CV and cover letter. Naturally this link led to a document with a little surprise gift - malware. Since the heist happened, at least one of the recipients must have clicked the link, and successfully deployed a RAT - Remote Access Trojan, malware that lets you control a computer from the comfort of your own home, as well as a toolkit with various malware to move from computer to computer, avoiding discovery, and covering their tracks.

From there, the hackers slowly made their way through the bank offices network, one step at a time to avoid setting off alarms, looking for any computer that had control of the banks SWIFT setup. SWIFT lets banks transfer large amounts of money between themselves and other banks connected to SWIFT. And as soon as they found one of those computers, they stopped. They didn't need to hack SWIFT in the traditional sense of the word - since they operated in a bank computer, the SWIFT-software assumed they naturally had to be bank employees. However, one of the parts of the malware used in the heist was for manipulating the SWIFT system, as the hackers weren't physically there to press anything. Additionally, since they were laying dormant for the time to strike, they needed to keep an eye out for SWIFT updates that could detect any tampering with the system, and adapt accordingly.

Then they waited many months for the stars to align on February 4th, 2016.

There were 35 transfers made by the hackers from the American bank account, totaling almost 1 billion USD, but there were two of these tiny little seemingly insignificant details that prevented this from becoming the worlds largest bank heist in history. The hackers biggest enemy became this concept known as “words”.

The Philippine bank accounts were all located in the same RCBC Bank office on Jupiter Street in Manila. And this would be the hackers downfall, as USA had sanctions put on an Iranian cargo ship called Jupiter. Since the transactions went to a recipient that contained the word “Jupiter”, it created a security alert in the Federal Reserve Bank that the employees needed to investigate. When they saw what was going on, they managed to stop all but five of the initial 35 transactions, thus “only” roughly 100 million USD made it to the Philippines. The Bangladesh bank requested to reverse the transactions, but since the money was in the Philippines, they would need bureaucracy in form of a court order to reclaim the money, and we all know that's not a 5 minute project. It was when Bangladesh filed the court order in late February that the case became public (since court orders are public documents) and the news broke to the country.

Once in the RCBC bank accounts, the money arrived on Friday the 5th and was immediately moved again. First the 100 million was converted to local currency, and some of it was withdrawn in cash, while the rest was sent off to other hacker-controlled locations. And this is where the second tiny little detail cut off even more of the hackers precious payday. 20 million USD had been sent to Shalika Foundation, a charity organisation in Sri Lanka. But, once again the hackers worst enemy - words - decided to strike again. A typo was made in their transaction, sending the money to “Shalika Fundation”, and a bank employee who must have had their morning coffee spotted this typo and rejected the transfer and kept the funds frozen. This left the hackers with 80 million USD.

✨Now comes the money laundering!✨

There was a second reason for choosing the Philippines as deposit zone; gambling is legal and the casinos had no money laundering regulations imposed. The accomplices of the heist booked private rooms in two casinos located in Manila - Solaire and Midas - and proceeded to purchase tokens to gamble for with the stolen money. Since they played with a room consisting of their fellow accomplices, winning was not really much of a challenge. Then the tokens could be exchanged back to money that would now be clean. To avoid suspicion, they didn't gamble all of the money at once, but over the course of several weeks gambled away the dirty money to clean money.

Who was behind it?

It's normally difficult to pinpoint where the more sophisticated hacking groups come from. Oftentimes, they will leave false clues behind that points to another group so they will face more trouble instead of the group that did it. They may even place clues from several different groups, just to mess with the analysts. It's also quite common to simply “steal” a way of working from another group, or use a leaked/stolen tool from another group (criminals aren't safe from other criminals, especially not in this business) - there are new malware coming out all the time with code that is just a slight modification of a well-known malware actor that had their source code leaked or simply had hired the same programmer. Or they may leave no clues as to who was behind it. Attribution to the guilty part is usually the single most difficult mission in IT-security - often it's just pure guesswork with little to no solid evidence to back it up, if you're lucky there's circumstantial evidence.

This case was no different. The first clue came from the IP the bad guys used to connect to the Bangladesh bank from. It was located in Pyongyang, North Korea. But, as I mentioned, this is not a conclusive verdict, as the IP may simply be planted false evidence to throw the analysts off their track. After the heist, the hackers used a data-wiper to scrub as much of their malware off the bank systems, but they didn't succeed in deleting all of it, some of the tools were still present, including the wiper.

Due to the scale of this operation, it caught the attention of every single IT-security person and IT-security company worldwide, who all of course wanted to know who and how they did it. With the remaining malware, a joint effort was made, comparing malware code to other malware code for similarities. Some was found in Poland, after an analyst noted the similarities from another suspected North Korean hack. Some was found in another infamous North Korean hack targeting Sony Pictures. More and more signs pointed towards the same actor. Some were false leads, the hackers seemed to be wanting to implicate the Russians did it, but failed quite miserably at that, just sprinkling random Russian words into the malware and making it way too obvious it was a ruse.

You may not believe this, but the North Korean government has one of the most notorious hacking groups in the world, known as the Lazarus Group. Some of its more well-known adventures include an extremely data-destructive hack of Sony Pictures (as punishment for releasing “The Interview”), creation of the ransomware WannaCry which was used against many targets worldwide (including hospitals), and various attempts at gathering information from governments and government-affiliated corporations all over the world. And, of course, this heist.

Eventually, after months of collaboration all over the world, the final verdict fell on North Korea, and specifically one of their programmers. His name is Park Jin Hyok, and worked for Chosun Expo - a front company for the North Korean government, located in Dalian (China) who used the funds of the fake corporation gained from legitimate programming jobs from customers worldwide to create the malware and plan the heist with all of its expenses. Of course he wasn't the sole person involved in this project, but it's the only person we know was in it.

This particular heist had been meticulously planned for several years, and Park Jin Hyok had moved to Dalian, set up fake IDs and built a network of contacts there to avoid suspicion. However, he didn't manage to delete all of his online footprints, and became the number one suspect when his internet activities suddenly came from Pyongyang, North Korea.

Additionally, several Chinese business men - many associated with the casino industry in China's Macau territory - were also charged and arrested for assisting with setting up the gambling rooms and coordinating the money laundering process. One unknown Chinese business man managed to get away with 31 million USD of the 80 million that remained after the heist, and as you would expect, he was never to be seen again.

With the middlemen from China paid off, not much remained of the original 1 billion to North Korea. But the heist has fascinated the whole IT-security world nonetheless.

I remember when the news of this case dropped to the IT-security world, who all wanted to take part in the hunt. It was a very fun time, we were all sitting at the edge of our seats waiting for the next update. I hope it was at least somewhat exciting for you too to read about, and thank you for reading this long post! If you liked it, please consider reblogging as it motivates me to write more. You may also like malware stuff I've written about before, such as Stuxnet or just plain evil malware that is a threat to our daily lives.

As always my inbox is open if you have any questions.

#datatag #bangladesh #heist #lazarus #north korea #malware #security #Bank #Hacking #Cybersecurity

79 notes · View notes

unproduciblesmackdown · 11 months

Text

forgot i had the thought like if anyone's leaving b/c they're so totally to nice for this business why isn't it ben (ft. tuk as a duo) the person who's always been [hey this guy doesn't fit in here! he's too nice!!] thee most, as well as actually committed the whole time to Not bullying anyone around him

if ben & tuk had just left / stayed away then (a) maybe they were so loath to possibly have an episode without ben kim, speaking of the [s1 shit] priority put on the overall season. but it's a sacrifice that could be considered for the tradeoff of "why not give that [walking away b/c you just can't accept being So Mean]" which would of course also feel much more relevant for ben being told like "yeah you'd have to do what i did to step on tuk specifically, for example" versus rian who was just turning her own [is herself actually among the Constant Workplace Bullies] on tuk 4 min prior. and (b) then i guess we could have rian just standing there in the end too like oh right who are you again? and that also would've made it all the clearer like oops she's just become a generic employee who Could blend in with victor and dollar bill b/c she's just Another bully with Another slight variation in her style of being so, but that's a matter of like: yeah you made this bed now lie in it. she stopped having a chance to be a funny little guy of a tertiary rank & file character b/c she started to be an inconsistent plot device instead, & was never given the prominence to at least truly drive plots instead of staying that [plot device who just veers off in whatever direction another, truly prominent character's plot needs] like yeah you should've picked one for this character, or if not, had her leave at the end of s5. and if not, had her leave at the end of s6. and if not, well, here we are dealing with billions having to insist she's had an arc, as well as that she hasn't Already just been yet another employee with the bullying spirit completely suited to just stick around here forever

meanwhile billions seemed to focus not on "the thing about ben, & tuk, isn't that they don't fit in b/c way too much they're among the people who try not to be awful to everyone else whenever they feel like it" but instead focused on "the thing about ben & tuk is that [sound of luke bradford crashing their fake married bank heist moment] people think they're PUSSIES!!!!!!!!!!"

#winston billions #like Okay that they're just still around now #and lord feel free to have finally written rian leaving #truly a disappointment like sorry they didn't write a role either getting to be [funny little guy] &/Or [any actual prominence]#what a disaster. and really no affection left obviously for just this clear endpoint of rian still being a bully / presumably always will #get That moment outta here and give it to ben &/or tuk getting to also choose otherwise on their own terms perhaps #like again Fine I Guess they also can just stay b/c they always have...? too Nice to quit #but like there's people who Do have this actual conflict w/this workplace while w/rian it's so much less substantial/believable #can't stop now!! made this bed now just slowmo putting on sheet after sheet (ref to wretched 4x12 moment) Forever to avoid lying in it #fr like supposed to be like ''oh but they haven't left before; so why now'' well exact same question about rian then #''oh but rian's had all the confidence boosters like. learning what research is'' ben & tuk have had those too! all the more notably!

2 notes · View notes

mariacallous · 1 year

Text

A mention of North Korean hackers typically conjures images of either crippling cyberattacks or, more often, massive cryptocurrency heists. But a new report on the authoritarian state’s capabilities and tendencies paints a different picture.

The report, prepared by cyber-intelligence firm Recorded Future and shared exclusively with Foreign Policy, labels espionage as the predominant motive of North Korea’s cyberprogram. Recorded Future analyzed 273 cyberattacks over a 14-year period linked to North Korean state-sponsored groups and found that information collection was the primary motivation for more than 70 percent of them.

“The narrative seems to be that North Korea is a bunch of cybercriminals that are backed by a state, but they’re just pulling off all of this financially motivated cybercrime, and that is one aspect of their strategy,” said Mitch Haszard, a senior threat intelligence analyst at Recorded Future and lead author of the report.

“But what this report shows is that they’re still heavily focused on information collection, or cyber-espionage, and they conduct more of those operations than they do financially motivated or financial theft operations.”

Pyongyang predominantly seeks to use cyber-operations to either “gain insight into how its adversaries think” or “access to information on technologies” that will help it in a conflict with those adversaries, the report said. Government entities are the most frequent targets, followed by cryptocurrency, media, finance, defense, and nongovernmental organizations.

“North Korea’s leadership appears to be much more interested in learning about what others think of them, gathering information that can help them develop nuclear and ballistic missile technology, and stealing money to fund their regime,” the report added.

However, North Korea’s obsession with cryptocurrency is unique, and the country’s cyber-operations are one of its biggest avenues to prop up its nuclear arsenal. Anne Neuberger, the White House’s cyber czar, said at an event in Washington last month that half of the regime’s missile program is funded by cryptocurrency and cyberheists.

“There aren’t really any other states or countries that are trying to steal cryptocurrency, so North Korea is unique in that perspective, but they still do a lot of things that other states do,” Haszard said.

The heists tend to make headlines, with North Korean hackers linked to thefts worth billions of dollars from cryptocurrency exchanges around the world in recent years, with two high-profile attacks on exchanges in Estonia and California so far this year. Beyond crypto, North Korea has been linked to larger and more disruptive global attacks, starting with the crippling of Sony Pictures just under a decade ago that put its cybercapabilities on the map. That was followed by a hack of Bangladesh’s central bank that compromised the global financial transfer system known as Swift, and a crippling of the United Kingdom’s National Health Service.

However, Haszard and his colleagues found that the vast majority of North Korea’s cyberactivity goes after targets much closer to home. Nearly 80 percent of the attacks for which geographic information is available took place in Asia, according to the report. Most of that is in its immediate neighborhood: South Korea accounted for just over 65 percent of the targets among the 29 countries where attacks took place. The United States is a distant second, at 8.5 percent, and no other country accounted for more than 3 percent of North Korean attacks.

Recorded Future found that Lazarus, the most notorious and high-profile hacking group linked to the authoritarian regime, tends to go after more global targets but is not the most common perpetrator of cyberattacks. That distinction belongs to a group called Kimsuky, which mainly targets Asian government and civil society entities and accounted for more than one-third of total attacks. According to multiple U.S. law enforcement agencies, Kimsuky hackers pose as South Korean journalists, exchanging emails with their targets on the pretext of setting up interviews before sending them a link or document embedded with malware. That malware, known as BabyShark, gives hackers access to the victims’ device and communications. “Kimsuky actors have also been known to configure a victim’s email account to quietly auto-forward all emails to another actor-controlled email,” a joint cybersecurity advisory by the FBI, National Security Agency, and South Korean authorities earlier this month said.

While Pyongyang has established its ability to disrupt critical infrastructure in the West and conduct ransomware attacks, it is increasingly less likely to conduct those types of attacks compared to other cyber-capable adversaries such as Russia and China. It prefers to go smaller, faster, and more frequently, deploying more basic techniques such as stealing passwords or phishing emails, which infect systems with viruses by fooling users into clicking on dodgy links.

“The thing that I see in my tracking of North Korean threat actors is an incredible amount of activity that is generally low-sophistication in nature,” Haszard said, adding that that’s likely a matter of strategy rather than ability. “They’re achieving a lot of success doing the kind of lowest-common-denominator cyberattacks. So if it were me, why would I change?”

3 notes · View notes

newspress24-blog · 2 years

Text

The Cashier in Dubai

Investigative report tracks tangled route for money flowing to offshore companies from Moldova.

Part One

Moldovan oligarch Vladimir Plahotniuc left his home country in 2019 to avoid corruption charges. But an investigation into his business affairs, supported by newspress24-blog, shows that money continued to flow into his pockets long after he fled.

Black Box Plus, the investigative show of Moldova’s independent Tv channel TV8, acquired documents showing that Plahotniuc profited from every document Moldova’s Public Services Agency (ASP) issued between 2014-2019. Black Box TV followed the traces left by the businessman Alexandru Vilcu and Vladimir Andronachi, a former lawmaker with the Democratic Party (PD).

Documents show that the money reached Plahotniuc via Garsų Pasaulis, the Lithuanian printing house that won the public procurements for supplying blank cards the ASP uses to issue Moldovan documents, including passports. The financial circuit leads to a network of offshore companies registered in Cyprus, Hong Kong and the United Arab Emirates (UAE).

In the summer of 2020, the scheme Plahotniuc built over the years was taken over by two Bulgaria-registered companies that appeared overnight.

These companies were the identical financial offshore vehicles through which Plahotniuc, former leader of the PD, raised alleged dividends from the auctions organised by the state telecom company Moldtelecom, the purchase of electricity from the breakaway region of Transnistria, the public-private partnership for hemodialysis services and the so–called heist of one billion US dollars from the Moldovan banking system.

The Lithuanian UAB (an acronym of uždaroji akcine bendrove, or private limited company) started supplying blank cards for Moldovan passports following tenders in 2014 and 2017. The main beneficiary of the Garsu Pasaulis company is Albert Mario Karaziwan, a Belgian citizen who owns Semlex Europe, an identification document and biometric device production company whose business practices have come under scrutiny. The Syrian-Belgium businessman has been targeted in several countries in criminal corruption cases and journalistic investigations by Reuters and OCCRP.

In 2014, Moldova’s minister of information and communications technology was Plahotniuc’s fellow party member Pavel Filip. The CRIS Registru state enterprise which in 2017 was re-organised as ASP, was headed by Sergey Railean, godfather of Filip's older son.

Between 2014 and 2021, ASP transferred 59.5 million euros to the Garsu Pasaulis company "for raw material, blank cards and personalisation services," according to documents obtained by Black Box.

ASP also paid the Lithuanian company a royalty fee for software developed for Moldova and used on three types of documents. For example, the royalty fee for each passport issued was 13.61 euros (14.49 US dollars). On October 22, 2021, prosecutors opened a criminal case against nine people from the Public Services Agency “targeted in a criminal case of abuse of office”. Prosecutors estimated that the state lost around 41 million euros (43.6 million dollars) in the case.

A LONG AND TANGLED PATH

A note from the Moldovan service for the Prevention and Combating of Money Laundering obtained by Black Box shows that more than 24 million euros (25.54 million dollars) did not stop in the company's accounts in Vilnius but ended up in Cyprus and the UAE.

“Of the 135 payments made throughout this period [2014-2019], I can tell you that the final beneficiary is obvious. At least, from what the criminal investigation bodies say, it is clear that the actual beneficiary is Vladimir Plahotniuc,” said ASP director Mircea Esanu.

Sergey Railean, the ASP former director under whose mandate the two contracts with Garsu Pasaulis were signed, said that he knew nothing about benefits for Plahotniuc.

"The tender took place according to the procedures. Therefore, nothing was outside the law," Railean said.

Told that Black Box reporters had established money transfers from Garsu Pasaulis to offshore companies affiliated with Plahotniuc, Railean was asked if he knew anything about it.

"No, absolutely not. Now it is a criminal case. The file must be completed after the trial,"he said. “[…] We did not order any software."

Railean added that ASP paid royalty fees to Garsu Pasaulis "because that was the contract".

On May 5, 2022 the Moldovan anti-corruption prosecutor's office announced that Railean had the status of accused in the so-called passport affair.

Filip, who held the post of prime minister in 2016-2019, did not answer the phone calls or requests for comment.

In May 2018, during a TV show broadcast by Prime, one of Plahotniuc's TV stations, Filip hinted that the state signed a more advantageous contract with Garsu Pasaulis than the previous one agreed in 2011 with a French company.

In 2011, Garsu Pasaulis had in fact tried to win a tender, but its application failed as it did not meet ASP’s criteria. A key condition was that applicants had experience manufacturing electronic passports for at least three European countries, as established by a decision of the Supreme Court of Justice. Garsu Pasaulis did not meet this requirement.

Garsu Pasaulis replied via e-mail that the company won the tenders and successfully delivered blank passport cards for ASP.

“As for the exact details of other commercial contracts, we cannot provide any details as confidentiality commitments bind us,” Andrius Lukosevicius, director of Garsu Pasaulis’ printing security department, wrote. “However, we can confirm that we have never had and do not currently have commercial or other relations with Mr Plahotniuc and [Romanian businesswoman] Mrs Ileana-Mihaela Burcea.”

The passport cash headed south, to the UAE firm Prime Union Solutions FZ LLC. Between January 1, 2018 and July 30, 2019 itreceived transfers for over 4.7 million euros ( five million dollars) from Garsu Pasaulis. The money continued to flow into Plahotniuc's coffers even after he fled Moldova in June 2019 when his name was linked to the disappearance of over a billion dollars - nearly one-eighth of Moldova's GDP - from the country's biggest banks between 2012 and 2014.

Employees at the Moldovan Money Laundering Prevention and Combating Service obtained information from their colleagues in Dubai and stated that the company's majority shareholders were the Romanian citizen Ileana-Mihaela Burcea and the company Inter Gnathonize Limited.

Between October 29, 2018, and July 30, 2019, a total of seven million euros (about 7.4 million dollars) were credited into Prime Union Solutions’ UAE bank account, largely sent from Garsu Pasaulis. The money then traveled to Burcea’s private account in UAE and six other offshore companies.

In liaison with UAE and Cyprus’ authorities, Moldova’s law enforcement agencies determined that Garsu Pasaulis transferred another 19.6 million euros (20.8 million dollars) to another Cyprus offshore company, Gnathonize Limited, also connected to Burcea.

The Cypriot firm opened a bank account in July 2014, four months after Garsu Pasaulis won the Moldova tender. The Lithuanian firm was the main contributor to the account until August 2018. After that, the money was transferred to the company Prime Union INC LTD in Hong Kong and marked as a "dividend payment".

Part Two

Documents from the Hong Kong public registry show that Burcea was one of Prime Union’s shareholders and in 2014-2019 the director. In 2020, Burcea requested the closing of the company. In 2018, over 600,000 euros (639,000 dollars) were transferred from one of Prime Union’s bank accounts to another offshore in Gibraltar.

In addition, 1.5 million euros (1.6 million dollars) arrived in Burcea`s personal account in the UAE and almost 800,000 euros (852,600 dollars) were directed to Recon Business Data Service, a company registered in Dubai led by Burcea. The company was closed in December 2019.

Burcea’s lawyer Cristina Savulescu declined to comment on the financial transfers from Garsu Pasaulis to her client. She also did not comment on Burcea’s connection with Plahotniuc. Savulescu said that any association of her client with an alleged criminal case was damaging to her client's image.

"The judicial procedure in any criminal case, from the time of notification to the competent bodies until the time of sending a particular person to court, is non-public and confidential, meaning that third parties cannot know the content of the carried-out procedures," Savulescu said.

Documents obtained by Black Box with the support of the OCCRP network of investigative journalists show that Plahotniuc used the same infrastructure of offshore companies to take yet more funds out of Moldova.

The former politician used the offshore network for the money obtained from other auctions organised by state enterprises including Moldtelecom, Moldova’s largest telecommunication operator, gas supplier Energocom and the health ministry for dialysis-related services.

The UAE’s Recon Business Data Services, connected to Burcea, was also involved in the financial circuit of money leaked by Plahotniuc from another scheme related to Moldtelecom, concerning public tenders won by Bass Systems SRL in PD`s ruling period.

Between March 2017 to January 2019 the Chisinau-based IT company delivered technical equipment and services for Moldtelecom worth about 41 million euros (43.6 million dollars). Out of this amount, eight million euros (8.5 million dollars) and six million dollars followed the same route to the UAE through Recon Business Data Services.

OFFSHORE ACCOUNTS

Another document obtained from the Moldovan service for the Prevention and Combating of Money Laundering shows that the Dubai-based company made several transactions to two offshores used by Plahotniuc: the UAE-based Vanguard International LTD and Vanguard International Group, registered in Samoa.

Both companies appeared in Plahotniuc's wealth statements in 2018. However, in the document submitted to Moldova’s Central Electoral Commission on the eve of the February 24, 2019 parliamentary elections, the oligarch declared 4.5 million euros (4.78 million dollars), over 11 million lei (around 585,000 dollars) and 347,000 dollars as dividends obtained from the Dubai-based Vanguard International Ltd.

Moldovan prosecutors established the origin of the money collected by Plahotniuc as "dividends".

Vanguard International LTD received 8.2 million euros (8.72 million dollars) and 2.5 million dollars from UAE-registered RECON SPC LIMITED from December 2017 to May 2019.

Burcea and another Romanian citizen, Silviu Tutuianu, were behind the company in different periods. Almost the entire amount came from the other similarly named firm, the Dubai-based Recon Business Data Service.

Plahotniuc also collected "dividends" worth 1.7 million euros (1.80 million dollars) and almost 350,000 US dollars through another offshore company, TGME INVESTMENTS SPC LTD, managed by Tutuianu.

All these companies were liquidated between the end of 2019 and the beginning of 2020, after Plahotniuc fled Moldova. The Moldovan anti-corruption prosecutor's office opened a case for the purchase of equipment and services by Moldtelecom from SRL Bass Systems. The prosecutors confirmed that Burcea was interviewed in this criminal case, but did not disclose her status.

Burcea also managed a company that benefited from transfers from Plahotniuc’s Cyprus-registered Asia Pacific Textile Limited. This had transactions with the Cypriot offshore Melopmania Limited, the founder of BB-Dializa, a company which managed the dialysis services for the Moldovan health ministry.

BB Dializa also benefited from legal services from Cyprus-registered Kinanis offshore, founded by Burcea. The company also provided secretarial and legal services for Assentis Holdings Limited, one of the founders of Bass Systems SRL.

Asia Pacific Textile LTD received money from the Energokapital shell company. Between 2014 and 2016, the firm was used by Plahotniuc and Evgheni Shevciuk, former leader of Moldova’s breakaway region of Transnistria, to sell the electricity produced by the Russian-owned Moldgres Power Plant to Moldovan consumers.

The Black Box team tracked Energokapital's connections with Plahotniuc and the involvement of former DP deputy Vladimir Andronachi in the company's management.

Moldova’s service for the Prevention and Combating of Money Laundering established the connection between Burcea and two other offshore companies involved in looting a billion dollars from the country’s banking system: Sharp Prospects Limited and Lazomar Trading Limited, registered in Hong Kong and Cyprus respectively.

According to an international independent financial audit named the Kroll report, the Lazomar company received 5.6 million dollars in transfers to a Cypriot bank account. The Kroll report was commissioned by the National Bank of Moldova to investigate the theft that ravaged the country’s banking system.

Plahotniuc did not respond to requests for comment. His lawyer Lucian Rogac said that the former politician pleaded not guilty in the case generically called "blank passport cards".

"An indictment was presented to us. Other evidence to prove guilt was not shown by the prosecution. The only comment I can give you is that my client pleads not guilty to the charges," Rogac said.

In September 2022 Plahotniuc received an arrest warrant in absentia regarding the "blank passport cards" case, alongside Vladislav Zara, former director of the civil registry ASP, ex-PD deputy Andronachi and businessman Alexandru Vilcu. All of them have fled the country. According to Moldova’s ministry of justice, Plahotniuc is currently in Northern Cyprus.

0 notes

rmlnewstimes · 2 years

Text

The Cashier in Dubai

Investigative report tracks tangled route for money flowing to offshore companies from Moldova.

Part One

Moldovan oligarch Vladimir Plahotniuc left his home country in 2019 to avoid corruption charges. But an investigation into his business affairs, shows that money continued to flow into his pockets long after he fled.