Former Air Force intelligence officer charged with espionage

Monica Witt is accused of spying in a forthcoming indictment that will be unsealed Wednesday, the Department of Justice said.

A former U.S. Air Force intelligence agent has been charged with espionage, with the Department of Justice alleging the officer defected to Iran in order to help recruit assets from the U.S. intelligence community.

In an indictment unsealed Wednesday, the DOJ says Monica Witt was recruited by Iran as part of a program that targets former U.S. intelligence officers and others who have held security clearances. She was first contacted during her participation in conferences held by a group known as “New Horizon,” which promoted anti-U.S. propaganda, the indictment says.

After defecting in 2013, she is alleged to have told the Iranian government about what the DOJ called a “highly classified intelligence collection program.” Witt is also alleged to have revealed the identity of a U.S. intelligence officer.

Additionally, four members of Iran’s Islamic Revolutionary Guard Corps (IRGC) have been charged with “computer intrusions and aggravated identity theft” aimed at members of the U.S. intel community.  Witt is alleged to have assisted the IRGC in efforts to identify, track, and neutralize U.S. counterintelligence agents.

According to the indictment, Witt and four Iranian citizens — Mojtaba Masoumpour, Behzad Mesri, Hossein Parvar and Mohamad Paryar — targeted U.S. government employees on the internet via malicious campaigns. The five defendants worked together to send spearphishing messages to a variety of targets, with the hopes the recipients would download malware that would give the attackers access to their devices.

One January 2015 incident uncovered in the U.S. government’s investigation shows how unsophisticated these attempts turned out to be:

On or about January 9, 2015, the Cyber Conspirators, using the account, sent an email to USG Agent 2 that stated: “Hello my dear . . . invitation card sent to you by email I got this pretty card accept me as a kind friend.” This email contained a spoofed link that, on its face, purported to take a recipient to a “pretty card”. Had USG Agent 2 clicked the “pretty card” link, USG Agent 2’s computer would have been directed not to a greeting card, but to a server controlled by the Cyber Conspirators. The Cyber Conspirators sent the “pretty card” email to USG Agent 2 utilizing covert tracking software, so that when USG Agent 2 opened the email, the tracking software allowed the Cyber Conspirators to confirm that USG Agent 2 had opened the email via a US Department of Defense computer network located in Kabul.

Witt has been charged with three counts of delivering national defense information to representatives of a foreign government. The four co-conspirators have been charged with computer intrusion, conspiracy to commit computer intrusion, aggravated identity theft, and aiding and abetting.

All five defendants are currently believed to be in Iran. One of the co-conspirators, Behzad Mesri, was charged in November 2017 with stealing unreleased television scripts and episodes from HBO, as well as personal financial information and passwords belonging to company employees.

According to a resume still posted online, Witt managed, directed, and conducted investigations for criminal, fraud, and counterintelligence cases for the Air Force’s Office of Special Investigations from November 2003 to March 2008. She then spent time as a contractor for Booz Allen Hamilton and Lorton, Virginia-based Chenega Federal Systems.

At one point, Witt was a highly coveted missing person on the FBI’s “missing persons” list. She has seen been moved to the bureau’s Most Wanted List.

In a separate announcement, the U.S. Treasury sanctioned New Horizon and Net Peygard Samavat Company, an Iranian-based IT company that provided support for the computer-led missions.

You can read the full indictment below.

[documentcloud url=”http://www.documentcloud.org/documents/5736497-2019-02-12-Witt-Indictment-Unsealed-0.html” responsive=true]

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure