Details about how suspected cybercriminals, Ramon Abbas (aka Hushpuppi) and Olalekan Ponle (aka Woodberry or Mark Kain), perpetrated frauds amounting to over $435m (N168bn) have emerged.
These were contained in separate affidavits attested to by Special Agents with the United States Federal Bureau of Investigation, Andrew Innocenti and Ali Sadiq, who were both recruited by the FBI in 2015.
The affidavit signed by Innocenti was attested to before Judge Rozella Oliver of the US District Court, Central District of California on June 25 while Sadiq’s affidavit was attested to before Judge Young Kim of the US District Court, Northern District of Illinois Eastern Division also on June 25.
The two FBI agents, in the affidavits, detailed how the suspected cyber criminals connived with others across the world, defrauding millions of people in business email compromise schemes, laundering the proceeds of their crimes and living an opulent lifestyle in Dubai, the United Arab Emirates.
Hushpuppi, Woodberry, and their accomplices were on June 10 arrested at their luxury Palazzo Versace apartment by officials of the Dubai Police and Interpol for a series of crimes such as money laundering, fraud, hacking of websites and accounts, impersonation and banking fraud.
The suspects reportedly scammed over 1.9 million persons in a fraudulent scheme worth $435million (N168billion). Thirteen luxury cars, estimated at N3.7billion, 21 laptops, 47 smartphones, 15 storage devices and five hard disk containing data were recovered from the house where they were arrested.
Last Thursday, the Dubai Police handed over Hushpuppi and Woodberry to the FBI and the suspects were extradited to the US.
Hushpuppi appeared in a US court on Friday and faced criminal charges of conspiring to launder hundreds of millions of dollars from BEC frauds and other scams, including schemes targeting a US law firm, a foreign bank, and an English Premier League soccer club.
Meanwhile, in an affidavit, Innocenti, who is currently assigned to the High-Tech Organised Crime Squad, Los Angeles Field Office of the FBI, unfolded how the messages found on the iPhones of two of Abbas’ co-conspirators showed that he was involved in multiple BEC frauds.
The FBI agent’s affidavit revealed that the bureau worked with Apple, Google, Instagram, and Snap to track Abbas’ financial transactions and locate his Dubai residence.
According to him, “Analysis of Abbas’ co-conspirator 1’s iPhone and other online accounts showed that co-conspirator 1 operated and tasked money mule crews for a number of fraudulent schemes, including BEC schemes and cyber-heists. The analysis also showed that co-conspirator 1 communicated with the UAE phone number +971543777711 (phone number 1) about multiple fraudulent schemes and money laundering.
“As described below, phone number 1 was one of the phone numbers Abbas used during 2019 and 2020. Based on my review (pursuant to federal search warrants obtained in this District) of data from co-conspirator 1’s iPhone and from an online account connected to that phone (the “Online Account”), other law enforcement personnel’s review of that digital data and from discussions with the United States Secret Service (“USSS”) and FBI personnel, I know the following:
“Co-conspirator 1’s iPhone listed Phone Number 1 (+971543777711) with the contact name ‘Hush.’ The phone also contained a contact for Snapchat username ‘hushpuppi5,’ which listed the Snapchat contact name ‘The Billionaire Gucci Master!!!’
“Searches of Phone Number 1 and the contact name ‘Hush’ in co-conspirator 1’s iPhone revealed messaging conversations between ‘Hush,’ using Phone Number 1, and co-conspirator 1.”
The FBI agent further revealed how he was able to trace Hushpuppi to his Dubai residence via his Instagram account.
He said, “The Instagram profile claimed that the user was a real estate developer and listed the user’s Snapchat account as ‘Hushpuppi5,’ which is the same Snapchat account name that was saved in co-conspirator 1’s iPhone.
“Based on records from Instagram received in June 2020, the Instagram account was subscribed with the name ‘RAY,’ the email address ‘rayhushpuppi@gmail.com,’ and the verified phone number +971502818689 (‘Phone Number 2’). The Instagram account was created on October 10, 2012, and recent account history from 2020 showed logins from Internet Protocol (‘IP’) addresses located in the UAE.
“Based on subscriber records from Snap Inc., the Snapchat account ‘Hushpuppi5’ used the phone number +971565505984 (‘Phone Number 3’) and the email address rayhushpuppi@gmail.com (i.e., the same email as the Instagram account). The Snapchat account used the display name ‘The Billionaire Gucci Master!!!,’ which was the same Snapchat contact name saved in co-conspirator 1’s phone for the Snapchat account ‘Hushpuppi5.’”
The US Department of Justice on Friday said if convicted of conspiracy to engage in money laundering, Abbas faced a statutory maximum sentence of 20 years in federal prison.
Similarly, in the affidavit filed by Sadiq against Ponle, aka Woodberry, the suspect was alleged of wire fraud conspiracy and BEC frauds.
The agent said between January 2019 and September 2019, Ponle conspired with others to engage in BEC schemes to defraud several US-based companies.
He said, “Proceeds from BEC schemes, ranging from hundreds of thousands of dollars to millions of dollars, were then wired by unwitting employees to the bank accounts opened by Ponle’s mules. Ponle then instructed the mules to convert the proceeds to Bitcoin and to send the proceeds of the BEC schemes to a bitcoin wallet that he owned and operated.”
Sadiq revealed that Ponle was tracked based on messaging conversations with one of his money mules in the US, simply identified as Individual B.
He said, “‘Mark Kain’ contacted Individual B using the telephone number (323) 985-4088. Based on my review of chat transcripts from online messaging applications between Ponle and Individual B and a second money mule, Individual A, ‘Mark’ instructed Individual B and Individual A to send money to the bitcoin wallet 16AtGJbaxL2kmzx4m W5ocpT2ysTWxmacWn (“the 16AtGJ BTC Wallet”) on at least nine occasions. Records obtained from Bitpay, a processor of cryptocurrency transactions, indicated that between approximately September 18, 2015, and November 29, 2016, the 16AtGJ BTC wallet made five purchases associated with the Gmail account hustleandbustle@gmail[.]com (the ‘hustle Gmail account’).
“Based on my review of records from Apple, Subject Account 1 contained several identity documents and photographs of Ponle. These included a photo of a Nigerian passport with a photo of an individual named Olalekan Jacob Ponle, born in May 1991 in Lagos, Nigeria, a photo of a United Arab Emirates visa with a photo of an individual named Olalekan Jacob Ponle with the profession, ‘marketing.’”