The Investigative Journal’s daily survey of federal enforcement activity, drawn from Justice Department press releases and court filings. All charges described below are allegations unless a plea or judgment is noted; every defendant is presumed innocent until proven guilty in a court of law.
The Justice Department’s enforcement docket this week spans state-sponsored cyber theft, cartel-linked money laundering, a federal hate-crime prosecution in Manhattan, health care fraud, consumer protection, and environmental reporting fraud. The lead item: a 14-count superseding indictment unsealed Tuesday in the Southern District of New York charging 17 Iranian nationals with running one of the largest academic data theft campaigns ever prosecuted — much of it, prosecutors say, on behalf of Iran’s Islamic Revolutionary Guard Corps (IRGC). Here is what moved, what it means, and what The Investigative Journal is watching next.
17 Iranians Charged in IRGC-Directed Cyber Theft of 31 Terabytes from U.S. Universities
A superseding indictment unsealed August 18 charges 17 members of the Mabna Institute, an Iran-based company that prosecutors allege was founded in 2013 for the express purpose of stealing access to non-Iranian scientific resources. According to the indictment, the defendants penetrated computer systems at 144 U.S. universities and 178 foreign universities, at least 42 U.S. companies, at least five U.S. federal and state agencies, and two non-governmental organizations — including the U.S. Department of Labor, the Federal Energy Regulatory Commission, the States of Hawaii and Indiana, the United Nations, and UNICEF — exfiltrating more than 31 terabytes of academic data and intellectual property. Filings indicate the campaign targeted more than 100,000 professor email accounts worldwide and compromised roughly 8,000 of them.
The case, assigned to U.S. District Judge Jesse M. Furman, expands a 2018 indictment that named nine of the defendants; eight are newly charged. Prosecutors allege the newly charged defendants were involved in, among other things, the 2017 hack of Home Box Office (HBO) — for which defendant Behzad Mesri was separately charged with attempting to extort the network for approximately $6 million in Bitcoin — and password-spray attacks on private companies and government entities that cost victims more than $20 million in investigation and remediation. The indictment also describes a commercial resale operation: stolen research was allegedly sold inside Iran through two websites, Megapaper.ir and Gigapaper.ir, linked to defendant Abdollah Karima. According to DOJ, U.S. universities had spent more than $3.4 billion to procure and access the kind of data the defendants took.
The significance is twofold. First, the State Department’s Rewards for Justice program simultaneously announced a reward of up to $10 million for information on the location of five of the defendants — a signal that Washington views the Mabna network as an ongoing threat, not a historical one. Second, as U.S. Attorney Jamie McDonald put it, the charges come “more than eight years after making the original indictment public,” a statement of prosecutorial persistence toward state-sponsored hackers who remain beyond the reach of extradition. An indictment is merely an allegation, and all 17 defendants are presumed innocent.
Chinese National Sentenced to 15 Years for Laundering Cartel Drug Proceeds
Jianfei Lu, 31, of China, was sentenced August 18 in the Western District of North Carolina to 15 years in prison and ordered to forfeit $25 million for his role in a Chinese money laundering organization (CMLO) that DOJ says laundered more than $92 million in illicit funds — much of it drug proceeds moving through Mexico — in under two years. According to court documents, Lu personally picked up and deposited more than $20 million in bulk cash into shell-company accounts, coordinated directly with U.S.-based drug traffickers, dispatched other couriers, and procured fake driver’s licenses that couriers used to make deposits at major U.S. banks. Lu pleaded guilty in July 2025, admitting knowledge of and involvement in laundering between $25 million and $65 million.
Assistant Attorney General A. Tysen Duva called Chinese money laundering networks “a key enabler to the Mexican cartels” — a framing worth taking seriously. The case, brought under the Homeland Security Task Force initiative established by Executive Order 14159, reflects the Department’s stated strategy of attacking cartel finance rather than only cartel product. The detail that fake identification was used to move eight-figure sums through major U.S. banks raises compliance questions that extend well beyond this defendant.
Federal Hate-Crime Charges Filed Over Attack at Manhattan’s Central Synagogue
Larry Montes, 46, of the Bronx, was charged by federal complaint August 18 with two counts of committing hate crimes and one count of destruction of religious property resulting in bodily injury, stemming from an August 14 disruption of a Friday night Shabbat service attended by roughly 375 people. The complaint alleges Montes shouted at worshippers, damaged two ceremonial silver candlesticks, punched a female congregant with a closed fist, and spat on and headbutted a security guard while directing a racial slur at him. Filings further allege that in a recorded, Mirandized post-arrest interview, Montes made explicitly antisemitic statements and characterized his actions as racially and religiously motivated.
Montes is in state custody and will be presented in Manhattan federal court at a later date. The hate-crime counts each carry a maximum of 10 years in prison; the religious-property count carries up to 20. The charges are allegations, and Montes is presumed innocent. The federal filing — four days after the incident, with the Civil Rights Division consulting — indicates the Department’s willingness to move quickly on antisemitic violence at houses of worship rather than leaving such cases solely to state prosecutors.
Operation Gold Rush Notches Its 16th Conviction in Record Medicare Fraud Case
Eldar Zarbavel, 45, of Pepper Pike, Ohio, pleaded guilty to laundering approximately $3.4 million in health care fraud proceeds for a Russia-based transnational criminal organization — the network behind Operation Gold Rush, which DOJ describes as the largest health care fraud case it has ever prosecuted. According to charging documents, Zarbavel opened Northeast Ohio bank accounts for Royce Medical Supply LLC, a Florida durable medical equipment company through which the organization submitted $1.42 billion in false claims to Medicare and other insurers between July 2022 and July 2024. Regulators suspended reimbursement on nearly all of those claims, but some were paid, and filings indicate Zarbavel moved roughly $3.4 million of the proceeds in mid-2024.
Zarbavel is the 16th of 35 charged individuals to be convicted in the Gold Rush investigation. He faces up to 20 years at his December 16 sentencing. The case detail that should draw the most scrutiny: charging documents allege the organization circumvented bank internal controls “and in some cases coordinated directly with associates employed at the banks” — an insider dimension whose full scope has not yet been publicly detailed.
Amazon Agrees to $2.25 Million Penalty Over Identity-Theft Records
On the civil side, a federal court in the District of Columbia entered a stipulated order requiring Amazon.com Inc. to pay a $2.25 million civil penalty to resolve allegations, referred by the Federal Trade Commission, that the company violated the Fair Credit Reporting Act by failing to give identity theft victims records of transactions made in their names — or failing to produce them within the statute’s 30-day window. Under the order, Amazon must provide such records free of charge within 30 days of a verified request and post a notice on its website telling victims how to ask.
The penalty is modest by Amazon’s scale, but the injunction has teeth: it creates enforceable, ongoing obligations around a consumer right that is little known and, according to the government’s complaint, was poorly honored. The settlement resolves allegations only; Amazon did not admit liability.
Kentucky Charcoal Producer Admits Falsifying Clean Air Act Data
Nicholas Upchurch, 46, owner of Rebel Smoke, a charcoal production company in Burkesville, Kentucky, pleaded guilty August 18 to fabricating air-emissions data. According to court documents, emissions from the company’s wood-to-charcoal kilns were supposed to be routed through pollution-control equipment; Upchurch admitted falsifying compliance data submitted to the Commonwealth of Kentucky under the facility’s air permit. The falsification count carries up to two years in prison and a $250,000 fine. Sentencing has not been scheduled.
Small case, meaningful signal: EPA’s Criminal Investigation Division built the case, and the Energy and Natural Resources Division is prosecuting an individual owner — not just the company — for paperwork fraud. Self-reported compliance regimes only work when false reporting carries personal criminal exposure.
Colombian National Admits Seven-Year Trade-Based Laundering Scheme
Andrelio Castaño Rojas, 55, of Colombia, pleaded guilty August 17 in the Eastern District of Virginia to a money laundering conspiracy that ran from January 2018 through March 2025. According to court documents, Rojas opened U.S. bank accounts for two of his U.S. companies, routed drug proceeds into them through wires and bulk cash deposits, then converted the money into consumer electronics exported to Colombia — a classic trade-based laundering pattern that converts dirty dollars into clean goods. Sentencing is set for January 22, 2027; he faces up to 20 years.
On TIJ’s Radar
Three threads from this week’s docket warrant deeper investigation. First, the bank-insider allegations in Operation Gold Rush: charging documents state the Russia-based organization “in some cases coordinated directly with associates employed at the banks,” yet the institutions and employees involved remain largely unnamed in public filings. With 19 charged defendants still awaiting resolution, the insider dimension of the largest health care fraud case in DOJ history deserves sustained attention. Second, the Mabna Institute’s resale economy: Megapaper.ir and Gigapaper.ir allegedly sold stolen American research to Iranian universities and institutions for years — a documented commercial market for pirated U.S. intellectual property whose customers, revenues, and sanctions exposure remain unexplored in public reporting. Third, the recurring appearance of fake identification and shell accounts at “major U.S. banks” in both the Lu and Gold Rush cases suggests compliance gaps that neither prosecution has yet forced into full public view. TIJ will follow all three.
Editorial note: This digest is based on Justice Department press releases and court filings linked above. Indictments and complaints contain allegations only; defendants are presumed innocent unless and until proven guilty. Counsel for the charged defendants are not identified in the DOJ releases cited, and their responses were not available at publication. The Investigative Journal welcomes comment from any party named in this report.
Sources
- DOJ: 17 Iranians Charged with Conducting Massive Cyber Theft Campaign (Aug. 18, 2026)
- DOJ: Prolific Chinese Money Launderer Sentenced to 15 Years (Aug. 18, 2026)
- DOJ: New York City Man Charged with Federal Hate Crimes (Aug. 18, 2026)
- DOJ: Kentucky Man Pleads Guilty to Falsifying Clean Air Act Reports (Aug. 18, 2026)
- DOJ: Colombian National Pleads Guilty to Money Laundering Conspiracy (Aug. 17, 2026)
- DOJ: Amazon Agrees to $2.25 Million FCRA Settlement (Aug. 14, 2026)
- DOJ: Ohio Man Pleads Guilty to Laundering Health Care Fraud Proceeds (Aug. 14, 2026)
- DOJ: Operation Gold Rush national takedown announcement