www.404media.co
The shed-sized post office opposite a Baptist Church 40 miles outside of Louisville, Kentucky, was an unlikely starting point for one of the most significant undercover FBI operations in recent years. Inside that post office on September 17, 2021, sat a package that had arrived a few days earlier. On the face of it that package and others like it shipped over the coming months were not suspicious. They often contained childrens books. Nestled in those, though, was an envelope. Then another envelope inside that. And inside that, thousands of dollars of cash.This money came from ElonmuskWHM, one of the biggest online money launderers and who advertised on the dark web site White House Market (WHM). For nearly a year by that point, ElonmuskWHM had been a crucial cog in the underground economy. Criminals came to ElonmuskWHM when they needed to cash out their ill-gotten cryptocurrency, bypassing the legitimate banking system that ordinarily kept tabs on their customers and gave information to law enforcement. So the FBI wanted to shut ElonmuskWHM down.The FBI eventually identified ElonmuskWHM as Anurag Pramod Murarka, a 30 year-old Indian national who authorities arrested after luring him to the country by approving his travel visa application. More extraordinarily, the FBI then took over ElonmuskWHMs money laundering operation and ran it themselves for nearly a year, Gabrielle Dudgeon, public affairs specialist at the U.S. Attorneys Office for the Eastern District of Kentucky, which prosecuted the case,told 404 Media. With criminals believing they were interacting with the real ElonmuskWHM, the FBI then investigated the launderers customers, including drug traffickers and hackers.Do you know anything else about this case? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404. Otherwise, send me an email at joseph@404media.co.As part of the investigation into ElonmuskWHM, both before and after the account takeover, investigators linked the money launderer to drug traffickers in Miami; a robbery at knife point in San Francisco, and numerous multi-million dollar hacking cases. During this window of time, the FBI investigated an alleged member of the notorious Scattered Spider hacking collective, which was responsible for the MGM Resorts hack and has caused hundreds of millions of dollars of damage. In this operation, rather than following the money, the FBI would become the money, potentially giving criminals tens of thousands of dollars in an effort to learn their real identities.A 404 Media review of hundreds of pages of court documents, ElonmuskWHMs online posts, and other research reveals the contours of that FBI operation for the first time. It solidifies the idea that the FBI is willing to provide criminals with the infrastructure needed for their schemes, sometimes for extended periods of time, if it provides an avenue to investigate them. The FBI previously secretly ran an encrypted phone company for drug traffickers and inserted a backdoor into it; started its own cryptocurrency to catch financial scammers; and ran a dark web child abuse site for around two weeks to deliver malware to its visitors. Running one of the largest money launderering services available on the open criminal market was just one of the latest examples.ElonmuskWHMs trail gave investigators a window into a part of the criminal world that is ordinarily completely invisible, with cryptocurrency now married to a centuries old underground banking system, making it easier than ever for criminals to move and access their funds globally. The FBI also went to extreme, and likely unconstitutional, steps to unmask ElonmuskWHM, including demanding Google turn over identifying information about everyone who watched a certain YouTube video over an eight day period.NOOB BITCHElonmuskWHMs business started in around October 2020, according to a 404 Media review of his posts on the dark web forum Dread, where customers of drug marketplaces would gather and coordinate.Cash BY Mail with 100% escrow and anonymity, ElonmuskWHM wrote. The service was simple enough: send your cryptocurrency to ElonmuskWHM via a dark web marketplace (with his fee), and ElonmuskWHM would then send you cash in the mail. For dirty fundscryptocurrency sourced from criminal activityElonmuskWHM charged a 20 percent fee.Initially, Dread users accused him of being a fed or a scammer. He got into constant fights with other members, and called one a noob BITCH.Despite the scepticism, some people clearly needed that service enough to send cryptocurrency to ElonmuskWHM. The following month, they wrote they had $30,000 worth of orders. By January, he was up to 200 sales, then 450, and eventually was calling himself the biggest cash by mail provider on White House Market, one of the sites he advertised on.A photo posted to Instagram and ElonmuskWHM's profile picture on Telegram.This services utility in the criminal underworld cannot be overstated. Companies who allow the trading of cryptocurrency for fiat in the United States have to be registered with the government as a money transmitting business. Those companies, in turn, are legally required to collect identifying information about their users, much in the same way as an ordinary bank. This is an issue for criminals because if they sign up to more legitimate exchanges such as Binance or Coinbase, they will need to provide their ID. And those exchanges will hand over that information to the authorities if presented with a court order.ElonmuskWHM offered an anonymous alternative, no ID needed. Perfect for hackers who have built a stockpile of cryptocurrency but have no way to actually cash it out. Hardly any business accepts Bitcoin or its more anonymous cousin Monero. These people need cash.Soon ElonmuskWHM crossed 500 sales. Later, he said he had moved millions; doing multiple continents. He offered to move cash to any country in Europe, and said he could move $100,000 overnight in the U.S. if needed.One of his messages on Dread said: Fuck LE, fuck the LAW.In April 2021, an FBI employee discovered ElonmuskWHMs adverts on various sites, according to court records. In August, the FBI roped in the United States Postal Inspection Service (USPIS) and the two agencies met about investigating ElonmuskWHM. Joshua Smith, a U.S. Postal Inspector, then arranged for the P.O. Box in Waddy, Kentucky, to receive cash mailed by ElonmuskWHM. If the authorities ordered cash from ElonmuskWHM, the packages and undercover conversations with the launderer might provide clues on his identity. These purchases were relatively small, $1,800 here, $2,000 there, with the cash sometimes arriving inside the torn pages of a book with those pages then taped together at the edges, and those placed inside multiple sealed envelopes, according to court records.While posing as a drug trafficker, the FBI performed so many undercover buys over so many months that the digital underground started to shift around the agency and money launderer. First White House Market went down in November 2021, after the owners decided to close up shop. Then Dark0de Reborn, a cybercrime forum ElonmuskWHM was on, closed the following February. The FBI moved to communicating with ElonmuskWHM more directly; he had accounts on Telegram and the encrypted messaging app Wickr. On Telegram, the launderers profile picture was of a Batman phone case.One of the undercover buy drop-off locations via Google Street View.In those chats, ElonmuskWHM said drugs were how most of his clients made their money, and let slip that his richest clients are hackers. Some of those hackers, the FBI learned, were involved in cryptocurrency thefts and computer intrusions. By analyzing the blockchain, investigators found that nearly $90 million worth of cryptocurrency moved through ElonmuskWHMs network, according to court records. He eventually boasted he had made approximately $30 million over just a few years, and said he could move up to $1 million a week. He owned a Mercedes.ElonmuskWHM started to let more personal details out too. The undercover FBI employee and ElonmuskWHM started discussing geographic information systems (GIS), basically a wide-ranging discipline of how computers can analyze or visualize geographic data. Think drones, construction, building interiors. The launderer revealed he had a history of working in the field, including with aerial drones, and that he once had been the CEO of a GIS company before selling that business to someone else around three years earlier.ElonmuskWHM sent the undercover FBI employee a YouTube video called Indoor AR navigation for malls, airports and retail stores. Keeping the conversation going, the FBI responded with a couple more videos. Ep. 01: ArcGIS Indoors was a five minute demo of a GIS tool. Drone mapping simplified with Site Scan for ArcGIS, another. Around that time, each video the FBI sent to ElonmuskWHM had been viewed around 2,000 and 1,400 times respectively.Screenshots of the YouTube videos the FBI sent to ElonMuskWHM.Knowing that ElonmuskWHM probably clicked on those links, U.S. authorities secretly made an audacious demand to Google: tell us what IP addresses were used to access these videos over a week-long period. Then if any of those IP addresses were linked to a Google account, in turn hand over that users name, address, payment information, message logs, and information about any other related accounts too. That legal demand was later reported by Forbes, and multiple experts said the order was unconstitutional because it had the potential to turn ordinary YouTube viewers into suspects because they watched a particular video.It is not clear if Google returned the requested data. Google acknowledged a request for comment but then stopped replying to emails asking if the tech giant provided the authorities with the information.THE MULESWith all of the undercover buys the FBI started to get an idea of where this money was coming from, and by extension, who in ElonmuskWHMs organization might be shipping it. One came from Tarrytown, New York. The third was sent from Elmsford, New York, again. Then another from Tarrytown. Others from White Plains and Irvington, also in New York. A pattern emerged. Whoever was shipping this money in some cases used the same locations again and again.They traced the likely shipment to a man in his early-twenties in Westchester County, New York, the county where many of the earlier packages had been shipped from. 404 Media has learned the real name of this person but is not naming them for their safety because they became a confidential human source and cooperated with law enforcement, and will instead refer to them as Eric.The FBI watched as Eric stepped out of his home and then delivered two parcels to a U.S. Post Office. Investigators determined those packages were supposed to ship to the USPIS post box in Kentucky the authorities had been using for the undercover buys. This time, the controlled buy was for $70,000, according to court records.A month later, authorities arrested Eric at his home where he lived with at least one parent. While clearing out the apartment, law enforcement asked the mans father where the suspect was. Once the officials called out his name, Eric emerged from his bedroom. Investigators found around $600,000 inside. While the FBI had been ordering mostly a couple thousand dollars at a time, it was clear that ElonmuskWHMs team was moving much higher amounts.Eric explained he met people around three times a week and received between $100,000 to $300,000 to move each time. Much of the money in New York came from people who owned lawful businesses, like convenience stores, and who wanted to send money back to India.Screenshots of images included in the court records.This underground banking system is known generally by the Arabic name hawala. Its Chinese equivalent is called Fei-Chien. Indian versions are known as Hundi or Angadia. People have moved money like this for hundreds and hundreds of years, before banks existed and still use it today. In the United States if members of such a system dont follow the countrys strict regulations on money transmitting services, they are most likely breaking the law. Many hawala customers are not hackers or drug traffickers. But ElonmuskWHMs business intersected with that system and brought criminals cash in. ElonmuskWHM essentially stuck cryptocurrency onto that existing, centuries old process. Rather than moving cash from one place to another, it became about exchanging cryptocurrency for cash instead.Rather than prosecute Eric immediately, the U.S. authorities decided to use him as a way in. He flipped, hoping for a lower sentence, and agreed to continue engaging in cash pickups and drops so the FBI could get a better understanding of how exactly this launderering worked and identify other people in the ring.Wearing a hidden camera, Eric performed around another 80 cash pickups, moving a total of more than $15 million from February to September, according to court records. Across Queens and the Bronx, convenience stores, bodegas, gas stations, and grocery parking lots, the FBI saw men of Indian descent with shopping bags full of cash moving around the city. Sometimes these men were asked by others if they needed to move money back to India, then fell into moving cash for the network, according to court records. The FBI then used cellphone data to see that some of these men were going out of state to New Jersey, Georgia, Pennsylvania, Massachusetts, and South Carolina. ElonmuskWHMs mules were all over the country.The New York money launderering ring court documents do not mention ElonmuskWHM. But it is clear these people are ElonmuskWHMs money mules: the records say the investigation started in April 2021 when the FBI identified a cash-in-the-mail vendor on the dark web (the same time as the FBI found ElonmuskWHM); the records say the vendor told an undercover officer in an online chat that their businesss customers included drug dealers and hackers (as ElonmuskWHM had done); and a partial WhatsApp number in the New York documents is the same as one in documents in ElonmuskWHMs case, 404 Media found. The Southern District of New York declined to comment.That number was one part of the puzzle that pinpointed who ElonmuskWHM really was. Through a flurry of pen traps and court orders; search warrants with Apple, Binance, and Uber; and a review of U.S. visa applications, investigators learned that ElonmuskWHMs real identity was Anurag Pramod Murarka, a man at the time in his late twenties with a one-third ownership stake in a land surveying company in India.Up until then, Murarkas previous visa applications to come to the United States had been denied. Now, the State Department approved it because the agency knew Murarka would be arrested after arriving in the country., court records say. Murarkas lawyer later said his client came to the United States in part to seek medical treatment for a rare medical condition after getting treatment in Egypt and Europe, according to court records.BECOME THE MONEYAfter arresting Murarka on September 30, 2023, the FBI made the decision to run ElonmuskWHMs operation themselves. A post from ElonmuskWHMs account on Dread, written nearly a month after the arrest, defends himself as not being a fed:Day one I start on whm , I hear same shit as todayNow I m infact tired of defending itGo to my first post 3 years back and same shitI m fed blah-blah-blah[]3 years + multiple markets + 1000s of trades + 100% positive feedbackand I m still here working my ass off and still have clients who love me and happy with my serviceDudgeon from the U.S. Attorneys Office told 404 Media that the FBI controlled the ElonmuskWHM persona for approximately eleven months. She said that the FBI investigated any criminal actor that used the criminal money laundering services of the ElonmuskWHM persona, including narcotics traffickers, hackers, and actors engaged in other criminal activity.Court documents say authorities linked ElonmuskWHMs services to drug trafficking prosecutions including one in Miami, Florida, a robbery at knife point investigation in San Francisco, California, and numerous computer hacking investigations, including some that derived multiple millions of dollars in criminal proceeds. Dudgeon told 404 Media that connections to customers were made both prior to and after the account takeover.One case in which a hacker used the services of an online money launderering service secretly run by the FBI was Remington remi Ogletrees. Authorities identified Ogletree after investigating Scattered Spider, a loose-knit collection of hackers notorious for their prolific social engineering skills and aggressive tactics. Scattered Spider emerged from the nebulous online community known as the Com, where around a thousand people coalesce on Telegram and Discord and often engage in physical violence against one another or members of the public. The FBI has designated Scattered Spider as a top three cyber threat, behind only China and Russia. Ogletree allegedly took part in compromises targeting telecom and financial businesses, according to court records.Two days after the FBI searched Ogletrees residence as part of that investigation on February 23, 2024, Ogletree contacted a money launderering service on Telegram, the court records say. At the time, Ogletree was apparently unaware that the Cash Service was part of an undercover FBI operation, the records add. Ogletree first told the launderer he needed $50,000 in cash, then upped the request to $75,000, according to the records. Ogletree sent cryptocurrency to the launderer, along with a physical address to deliver the money to.The Cash Service provided a USPS tracking number and mailed $75,000 (the value of any cryptocurrency Ogletree sent minus a fee) to Ogletrees Fort Worth Residence, the documents read. In other words, this undercover FBI operation provided tens of thousands of dollars to a suspect linked to a known-violent community of hackers, with him only being arrested nearly a year later in November 2024. Later, authorities said in court records that ElonmuskWHM, by providing money laundering services, enhanced the motivation [of criminals] to commit crimes, eased the path to success for these crimes, and facilitated the victimization of more people and businesses. For a year, the FBI arguably did much the same.The FBI also found that Ogletree had previously used the money launderering service multiple times in 2023, with Ogletree allegedly saying he had moved around $80,000 through the service, according to the court records. At one point, Ogletree flashed a large bundle of cash on Snapchat, according to a photo included in the records.Screenshot of a Ogletree court record.Ogletrees court records do not mention ElonmuskWHM specifically. 404 Media obtained screenshots in which people in the Com discussed ElonmuskWHM. Another message said one person used a laundering service and suggested they were caught shortly after.Dudgeon declined to comment on the Ogletree case, saying we cannot comment on an ongoing investigation. She also declined to point to any other prosecutions that have come about from the undercover running of ElonmuskWHM, saying the United States cannot comment on ongoing investigations.Murarka was sentenced in January to 121 months in prison, according to an announcement from the U.S. Attorneys Office for the Eastern District of Kentucky. In a sentencing memorandum, prosecutor Kathryn Dieruf said Murarka was the founder and leader of a vast conspiracy that spanned the United States and emanated from India, which was designed to operate as a bank for the criminal underworld operating on the dark net. In so doing, the Defendant ran one of the largest and most successful darknet crypto-for-cash operations, laundering more than $24 million in cryptocurrency [in] just under two years.The USPIS, FBI, and lawyers representing Murarka and Ogletree did not respond to multiple requests for comment. Ogletree did not respond either.Using the internet, the defendant provided his assistance to countless other criminals as they tried to conceal their stolen money and illegal drug proceeds, Carlton S. Shier, IV, United States Attorney for the Eastern District of Kentucky, said in that announcement. This case highlights the global scope of cybercrime, as well as the demand for diligence and collaboration in fighting money launderinga devastating second layer of criminal conduct. The dedicated work of our law enforcement partners has now held him accountable; and we remain committed in our collaborative efforts to combat this destructive criminal activity.Michael E. Stansbury, Special Agent in Charge, FBI, Louisville Field Office, said in the announcement: the FBI will leverage every advantage against criminal networks that cause damage to our communities, to apprehend these malicious actors, seize the proceeds of their crimes, and expose their network of co-conspirators.Even if that means launderering money for hackers.