The BTA Bank Saga
NOT A SHORT READ. CONSIDER YOURSELF WARNED.
It has taken some time to reach the point of actually documenting research here in regards to BTA Bank. This site became active in Spring of 2020. Only now into June of 2021, has enough information has been obtained to cover this sorted tale in great detail.
There is no short read on this research page. This is a very lengthy and detailed review covering important events regarding BTA Bank, many involved persons, banks, companies, accusations of stolen billions being laundered using Trump-branded properties, private intelligence firms, and more. It covers a range of sixteen-plus years, chronologically walking through its history between 2005 to present day. This is still very much a work-in-progress with much more information to be added to this timeline in the weeks and months ahead. Even though some years may appear completed, additional information will likely be added to them in the future, also.
NOTE: There was also previous information on this page regarding the Kazakhstan government related to Hacking Team, NSO Group and the use of "Pegasus" which has now been moved to a different page. This related information is now here.
Main players names to know:
BTA Bank - one of the larger banks in Kazakhstan which had been doing business with many banks around the world including US and UK banks; formally known as Bank TuranAlem
Muhktar Ablyazov - former Chairman of BTA Bank 2005-2009; accused of stealing anywhere from $4 to $6 billion dollars after he fled Kazakhstan for London in 2009 while claiming political persecution because he was considered an opposition party to Kazakhstan President Nursultan Nazarbayev
Timur Kulibayev - Nazarbayev's current favorite son-in-law after his public falling out with Rakhat Aliyev, another son-in-law who had been publicly accused of murder and fled Kazakhstan
Kenes Rakishev - May be Timur's public guy representing his interests; successful businessman considered to be one of the richest people in Kazakhstan
Ron Wahib - worked previously in both the Bush Sr. and Clinton administrations; founded a private intelligence firm based in Switzerland, a subholding of an American investment firm, RJI Capital Holding
Arcanum Global - private intelligence company founded by Ron Wahid; BTA Bank was a client of Arcanum Global since at least 2009
Karim Massimov - Kazakh politician with more than 20-year political career which included positions such as Prime Minister, Minister of National Economy, and Minister of Transport; also named as potential successor to President Nazarbayev; published a book on artificial intelligence in 2019 titled 'The Next Master of the World: Artificial Intelligence'
Bulat Utemuratov - Kazakh billionaire named as defendant in a civil lawsuit filed against him by BTA Bank lawyers in November 2020
So here goes. From the very beginning, to the best of my understanding and research.
MUHKTAR ABLYAZOV BECAME CHAIRMAN BTA BANK
Mukhtar Ablyazov was reportedly appointed the Chairman of the Board of Directors at BTA Bank, or at this point in time, Bank TuranAlem, a bank which had a long history in Kazakhstan.
Thanks to Google Translate, this information written in Turkish magically became English so we could determine as of 2005, strategic partners of this bank were located in Moscow, Kiev, Minsk, Omsk, and Kazan. https://bta.kz/ru/press/news/2005/03/23/800/
However, while he was reportedly the Chairman by 2005, there are no good search results bringing up any type of public relations reporting with his name, etc. The same holds true for 2006 except for two obscure sites.
Since this doesn't seem to be a critical point to nail down, let's assume the media reporting he was the Chairman of this bank from 2005-2009 to be likely accurate. In 2005, we are still a couple of years away from the coming global financial crisis and BTA Bank is in pretty good shape.
FELIX SATER STARTED ADVISING SEMBOL CONSTRUCTION AND RIXOS DOING CONSTRUCTION PROJECTS IN KAZAKHSTAN
Also, 2005 was the first year Sater began advising the Chairman of Rixos and Sembol Construction, Fettah Tamince, who were working on various projects in Kazakhstan. This is where the story ends up rolling to the Khrapunov's, Viktor and Leila, and therefore on to Ablyazov.
To clarify, there is no established connection between his advising work for Sembol, Rixos, and Sater being introduced later to both the Khrapunovs and Ablyazovs, but this is the employment which puts him around what might be referred to as the Kazakhstan elite during this time frame.
SATER MET THE KHRAPUNOVS AND ATTENDED WEDDING
After approximately a year after Felix Sater has started advising Fettah Tamince, who appeared to have personally known the Kazakhstan President Nazarbayev, and through Tevfik Arif (the reported founder of Bayrock) Sater was introduced to the Khrapunov family.
As Viktor Khrapunov's wife, Leila, wrote on her own personal profile site, her husband held the following positions in Kazakhstan: mayor of Almaty 1997-2004, energy minister
In September of 2007, Viktor and Leila's son, Ilyas, married Muhktar Ablyazov's daughter, Madina. Through this public site she has created, her side of the story is told. She states the wedding was the catalyst to their political persecution by President Nazarbayev. These were two political families joining together who weren't exactly on favorable terms with him politically, and so per Leila, many were told not to attend the weddings (there were two different celebrations).
In her own words:
"The history of my family’s persecution by the Kazakhstan president, Nursultan Nazarbayev, goes back to the time of my son Iliyas Khrapunov’s wedding to the daughter of Nazarbayev’s political opponent, Madina Ablyazova, which took place on 16 September 2007, in the city of Almaty, the Republic of Kazakhstan.
One can say that after the wedding ceremonies, the first of which was held in Almaty, on 16.09.2007, attended by relations and friends of the bride and bridegroom’s parents, and the other, on 22.09.2007, in Switzerland’s Geneva, this time – for the newlyweds’ university coursemates, friends and other guests, the Ablyazov and Khrapunov families’ safe life came to an end.
As the wedding ceremony in Almaty was prepared and invitations sent out, Victor Khrapunov’s government colleagues invited to the ceremony started to call him, offering their apologies for not being able to attend, because they had received recommendations from Nazarbayev’s entourage that they had better not show up at the Khrapunov–Ablyazov’s wedding, for this could arouse Nazarbayev’s anger.
Still, the Almaty wedding was attended by several people from the government, representatives of president Nazarbayev’s family, those who could share their first-hand impressions with Nursultan Nazarbayev.
Bitter jokes circulated at the wedding, suggesting that the minister of emergency situations Victor Khrapunov should from now on be prepared for falling from the president’s grace because of his son-in-law, opposition politician and banker Mukhtar Ablyazv’s, views.
Indeed, after the wedding, Prime Minister Karim Masimov, beginning from early October 2007, started unfolding a plot within the government against the emergency situations minister Victor Khrapunov."
She pointed out Viktor was first position in “The Country’s Best Mayors” annual rankings for all seven years before Nazarbayev turned his focus on him due to his family marrying into the Ablyazov family.
ABLYAZOV TIMELINE 1998 - 2005
Ablyazov was already established to be anti-Nazarbayev prior to this date. To back up and provide additional background, here is a mini Ablyazov timeline:
1998 - as head of KEGOC, Ablyazov was named Minister for Energy, Industry, and Trade and described in RFERL reporting as "part of a younger generation that Nazarbaev, 20 years their senior, hoped to harness as he pushed his resource-rich nation into the 21st century. But within years, Ablyazov and the others had broken ranks, citing disenchantment with endemic corruption in Nazarbaev's inner circle. Launching a pro-reform opposition movement, they quickly drew the wrath of the regime," and he [Nazarbaev] thinks that he "provided them the space to become wealthy, to become well-known, to make a career in state service or in business, and they challenged him. When he pardoned Ablyazov in 2003 and allowed him to return to business in exchange for a promise not to be involved in politics and then found out that he was again involved in politics, of course Nazarbaev felt betrayed twice."
According to the State Department, this was the year Bank Turan Alem was purchased by private investors, one of which was more than likely Ablyazov.
According to Ablyazov's Wikipedia page, a loan was acquired to purchase the shares in a privatization auction for $72 million, but no citation was provided for this claim.
2001 - Ablyazov along with several others formed the Democratic Choice of Kazakhstan political group which made up a number of influential politicians and wealthy businessmen of the country who had grown disillusioned with the inner circles of President Nazarbayev. The movement adopted a strong anti-Nazarbayev stance and criticized the corruption and nepotism of the president and his clique
2002 - Ablyazov was jailed over accusations of financial fraud and political abuse
2003 - Nazarbayev pardoned Ablyazov but he had to agree to engage in only business and not political matters
2005 - Democratic Choice of Kazakhstan was disbanded before the country's presidential election
Given the picture this timeline portrays, it is not outside the realm of possibility Nazarbaev may have felt threatened by the announcement of the mayor's son marrying Ablyazov's daughter in 2007.
According to the lawsuit filed by BTA Bank and the city of Almaty against Felix Sater almost 12 years later, he attended one of these weddings in 2007. Based on the description of each event, it is unclear if he would have attended in Almaty or Geneva.
Based on what Leila wrote, it would seem they were told by people in Kazakhstan not to attend their wedding, and had warned Viktor Khrapunov to expect Nazarbayev's wrath.
Either way, by 2007, any number of people within their circle had whispered in their ears and by the fall (seemingly very closely following when the weddings were over in September), they had fled Kazakhstan to take refuge in Geneva, Switzerland.
SWISS DEVELOPMENT GROUP (SDG) FORMED
As the Khrapunovs were fleeing Kazakhstan, they were founding a company named SDG, Swiss Development Group. The company slogan was “It’s Good to be Swiss.” According to The Diplomat's reporting in July of 2018, SDG’s projects were "a high-end beach resort on the shores of Lake Geneva, a mall in the city center, and a luxury ski resort, while the family also snapped up a string of other properties in Switzerland and elsewhere."
According to this online registry page for Switzerland companies, July 2007 is when Swiss Development Group appears to have been registered. Specifically, July 27th which was only weeks before the first wedding event on Sept 16th. Around seven weeks before the wedding in Almaty.
Reporting in fall of 2017 by McClatchy led to multiple news agencies reporting the law firm Rudy Giuliani joined in 2005 which was renamed Bracewell & Guiliani, had set up an office in Kazakhstan sometime in 2007. Their reporting indicated an "investigation" they had completed which they stated showed "the developer, Bayrock Group, which partnered with the Trump Organization on at least three projects in the mid-2000s, was in business with the Khrapunov family."
According to their same reporting, "records show KazBay B.V. was 50 percent owned by Bayrock B.V. and its owner Tevfik Arif, and 50 percent owned by Helvetic Capital S.A., a Swiss company whose true owner, according to the documents, was Leila Khrapunova. She’s the former TV anchor and back in 2007 was the wife of Viktor Khrapunov, the former mayor of Kazakhstan’s largest city, Almaty, and an ex-energy minister."
What remains unclear is why this small $1.5 million venture didn't amount to an actual deal and why these records have never been publicly released to prove this claim made in their reporting on their investigation. Even in June of 2021, there are no public reports from this time period ~2007 discussing any proposed potential venture.
Interestingly, also within their article published a decade after these events allegedly took place, they also had linked to a 2007 press release which they reported "touted the law firm's role as international counsel for the offering of $1 billion in corporate debt to Bank TuranAlem, or BTA." This link is now broken.
McClatchy reported perhaps The New York Times article published in late 2007 may have been a contributing factor to the reason the KazBay deal fell apart, writing:
At this point in 2007, BTA Bank or Bank TuranAlem stakeholder equity significantly rose (132.3%) and their bank loan portfolio increased by 77.1%, and assets increased 47.7%.
BTA BANK UNDERGOES REBRANDING AMIDST START
OF LOOMING GLOBAL FINANCIAL CRISIS
On March 25th, 2008, the bank underwent a rebranding. A new name and new logo was announced. This move took place at a time when world financial markets were facing serious trouble.
Within the previous eight days, Bear Stearns had already been facing bankruptcy and the Federal Reserve had held their first emergency meeting in 30 years, agreeing to guarantee bad loans to facilitate its acquisition by JPMorgan Chase, and the Federal Reserve had cut the federal funds rate by 75 basis points, which had been its 6th cut in 6 months.
SAMRUK KAZYNA IS FORMED
Through a presidential decree, Kazakhstan President Nursultan Nazarbayev established the Samruk Kazyna Sovereign Wealth Fund, or SWF, by merging two older funds: the Kazyna Sustainable Development Fund and the Kazakhstan Holding Company for State Asset Management.
KAZATOMPROM OWNERSHIP TRANSFERRED TO SAMRUK KAZYNA
An excerpt from a cable leak regarding the transfer in ownership of Kazatomprom to Samruk Kazyna: "The recent decision of the government to move ownership of Kazatomprom to the newly-established Samruk-Kazyna National Welfare Fund and Samruk-Kazyna's recommendation that President Nazarbayev's son-in-law Timur Kulibayev (who is Deputy Chairman of Samruk-Kazyna's Management Board) be named Chairman of Kazatomprom's outside Board of Directors are indicators of the strategic importance the Kazakhstani leadership attaches to the development of Kazakhstan's civilian nuclear industry."
Much took place in 2009, so a review of this year's events is lengthy.
By 2009, both the Khrapunovs and Ablyazovs had fled from Kazakhstan.
NEW SAMRUK KAZYNA FUND PURCHASED 75.1% OF BTA BANK SHARES
By February of 2009, the Kazakhstan sovereign wealth fund (SWF) Samruk-Kazyna purchased 75.1% of BTA Bank's shares. This fund was created late in 2008 by presidential decree. It was dated October 17 and announced as established on November 3rd.
OLIGARCH ABLYAZOV ACCUSED OF LAUNDERING BILLIONS FROM BTA BANK
When this SWF Samruk Kazyna purchased the majority shares of BTA Bank in early 2009, an outside audit later reported billions of dollars were missing. Ablyazov was accused of laundering anywhere from $4 to $6 billion dollars over a complex web of shell companies across the world.
The New York Times in late November 2009 reported on the number of Western banks which had funneled billions to BTA between the years of 2003-2008, specifically naming Credit Suisse, Morgan Stanley, Royal Bank of Scotland, and ING.
"So many of these loans are now bust that many foreign banks are facing write-offs of as much as 80 percent of their value, prompting investigations into why the loans went so bad so fast, according to officials at Bank Turalem, which was taken over by the government earlier this year. Hoping to become the dominant bank in the region, BTA, as the bank is known, cast its eye well beyond Kazakhstan and lent billions of dollars to finance vast real estate projects in Russia and Ukraine, as well as offshore companies with vague business plans and no trading histories to speak of, according to executives at BTA who did not want to be identified because of the sensitivity of the matter. The money went to companies with names like Best Catch Trading and Sandown Holding, based in places as diverse as the Seychelles, the British Virgin Islands and England, that offered up little in the way of collateral, according to these executives.
Among other things, prosecutors in Kazakhstan and a team of international lawyers and accountants hired by Bank Turalem are investigating whether the foreign banks may have unwittingly financed a scheme by BTA’s former chairman, Mukhtar Ablyazov, to direct between $8 billion and $12 billion worth of BTA loans about half of the bank’s loan book to companies that he secretly controlled, according to lawyers representing BTA as well as prosecutors in Kazakhstan."
“BTA was one of the least transparent banks here, and there were a whole bunch of transactions prior to the seizure that indicated extremely lax banking,” said Michael Carter, the chief executive of Visor Capital, an investment bank based in Kazakhstan. “But Kazakhstan was very sexy at the time, and foreign banks were just shoveling in money, so much so that that banks here had more money than they knew what to do with.
Mr. Ablyazov, 46, a small, energetic man who made his first fortune importing cars from Lithuania, maintains that the loans that BTA made were legitimate. He claims that the $9 billion charge against profits that the bank declared after he left as well as the government takeover of the bank represent the final stage of a plot by President Nazarbayev to wrest BTA from him."
Last excerpt worth noting:
"What is not in dispute is that, even by the loose standards of the credit boom, few banks lent as aggressively as BTA. Between 2003 and 2007, the amount of its loans outstanding grew by an extraordinary 1,100 percent. Like many other banks in less developed countries, BTA relied heavily on foreign funds, as opposed to customer deposits, to propel its loan growth so much so that its ratio of loans to deposits peaked at 3.6 to 1 in 2007, one of the highest anywhere in the world.
Mr. Ablyazov maintains that BTA would have paid off its loans had he remained at the helm and that the enormous charge-off was a ploy by Mr. Nazarbayev to seize control of BTA and damage a political rival’s reputation."
Another point the Times made was one of Ablyazov's projects in particular was a "4,700-acre development outside Moscow in which BTA has a $1.5 billion credit exposure."
KAZAKHSTAN ON WORLD RADAR FOR NUCLEAR AMBITIONS
AND NAZARBAYEV SUCCESSOR
On October 6th of 2009, the Federation of American Scientists, or FAS, published their analysis regarding Kazakhstan titled 'Kazakhstan - Opening Up for Nuclear Cooperation.' In it they wrote, "The concerns of the international community regarding the Kazakhstan-Russian enrichment cooperation, in summary, focus on Kazakhstan's position as a country that may find it attractive to acquire enrichment technology, and Russia's ability to provide such technology in order to maintain clout in its traditional sphere of influence and retain a resource-rich neighbor. Alternatively, Kazakhstan may be tempted to acquire enrichment technology from China, which China will be tempted to provide to secure its relations with Kazakhstan vis-à-vis India. Moreover, in its desire to cultivate nuclear deals with multiple countries, Kazakhstan may be reaching out to cooperate with Iran as a regional power. Amidst Kazakhstan's ambitions, there is the additional complicating issue of power succession: Nazarbaev, the first President of Kazakhstan and approaching 70, has been successful leading the country since 1991, but leadership that will replace him remains unclear. With his grip on power, Nazarbaev has groomed some obedient parties and officials, but whether they will be able to retain his power and tight control, or pursue his nuclear agenda, is unclear and what direction the country will follow under the new leadership is uncertain."
It is likely even in 2009, as this above detailed, Kazakhstan's nuclear power and uranium enrichment ambitions, as well as their likelihood to soon have a new successor to replace Nazarbayev, were on the radar of various agencies and governments across the world who are expected to pay attention to such things.
FELIX SATER FINALLY FACED SENTENCING FOR ROLE
IN 1993-1996 STOCK SCAM
On October 23, 2009, Felix Sater finally faced his sentencing before Judge Leo Glasser for his role in the stock fraud scam which had occurred between 1993-1996. He was fined $25,000.
The sentencing transcript detailed then-current Democrat US State Attorney Todd Kaminsky of the Eastern District of New York describing Felix's level of cooperation with the US government as "extraordinary" and clearly stated to the Judge Felix had "not engaged in criminal activity since 1996." Kaminsky referred to four FBI agents who showed up in court to testify on Sater's behalf. Kaminsky also told the Judge Sater was "not going to appear before this court or any other court again in the context of a criminal case." Kaminsky explained he understood it as extrordinary to ask for a sentence of no jail and no probation time but it was warranted in Felix Sater's case.
These remarks made by Kaminsky underscore the lack of media publicity received regarding them after the media repeatedly and repeatedly insinuated Felix Sater was tied to Russian organized crime -- and would have been capable of colluding with Russia to elect Donald Trump.
Another telling statement made by Leslie Caldwell during his sentencing was "Time and time again all agents here, and numerous others who couldn't be here today, have told the government Felix Slater was one of the best cooperators we worked with. There was nothing he wouldn't do. No task was too big. He was really helpful and was the key to open a hundred different doors that they couldn't open prior to that time."
ABLYAZOV AND RON WAHID, ARCANUM FOUNDER, MET THIS YEAR
Due to Financial Times (FT) reporting which took place 8 years after this alleged meeting, they claimed the founder, Ron Wahid, of a private intelligence firm, Arcanum Global, had met with Ablyazov sometime in 2009. In late September of 2017, they reported Ablyazov had requested a meeting with Wahid at some point likely mid-to-late 2009 because as Ablyazov himself was quoted saying, "I saw the spies around me and I wanted to hire a group to counter what the spies were doing."
Ablyazov stated Wahid had sold Arcanum as "some sort of super service that has super resources at their disposal" but when Wahid was only able to provide documents Ablyazov had already obtained, Ablyazov wondered if Arcanum Global had already been hired by BTA Bank to spy on him.
Interestingly, their article also noted a previous client of Arcanum Global had been Nazarbayev's estranged son-in-law, Rakhat Aliyev. He had spectacularly fallen out of favor with Nazarbayev back in 2007. The New York Times in July 2007 had reported Aliyev at the "center of a palace feud and kidnapping scandal that has become a political sensation in Kazakhstan."
Wahid was described as a "portly man who travels by private jet, mixes with the glitterati, and says some of his staff enjoy 'above top secret' security clearance from the US government." People who joined his company included the former head of The Mossad, the late Meir Dagan. His industry's currency was described as "secrets" and services ranging from "tracing fraudsters’ assets to darker arts that include hacking, infiltration, honey traps, blackmail and kidnapping."
The FT reporter, Tom Burgis, dramatically described the Ablyazov case in his reporting as mirroring "the tournament of shadows fought in the 19th century by spies, soldiers, and fortune-seekers from imperial Russia and Britain in an attempt to control Central Asia. Today, though, the political battles of the former Soviet Union are fought not in the parched valleys east of the Caspian but in western courts, parliaments and media."
Wahid had told Burgis for his article they had never reached the point where Ablyazov was provided a proposal to counter Nazarbayev, but did admit they had been working on behalf of Kazakhstan and BTA Bank at this time.
Burgis relayed these 2009 meetings as "early exchanges in perhaps the most remarkable battle the secrets industry has yet fought" and Arcanum, Wahid's company, as being "just one piece on a chessboard which spans four continents. It reveals how the mercenaries of the information age are shaping the fate of nations."
(Side note: Aliyev was found dead in his jail cell in Austria which was first deemed a suicide. However, his lawyer had seen him the prior day and demanded a thorough investigation. He didn't believe it was likely Aliyev would kill himself. A later autopsy and news media report (again with the assistance of Google Translate) stated Aliyev had been murdered.
KAZATOMPROM HEAD, DZHAKISHEV, ARRESTED
There was also the matter of Moukhtar Dzhakishev who was also arrested this year and connected to Ablyazov. As the former head of Kazatomprom between 2002 to late May 2009, he had allegedly appropriated 60% of Kazakh's uranium deposits as his personal property, amounting to tens of billions of dollars.
In May of 2009, Reuters connected Dzhakishev with Ablyazov and the sale of uranium assets, reporting a crash in Uranium One stock when it was announced there would be an investigation into uranium assets their company owned.
In prior years, there had been an odd "reverse merger" between the Canadian company Uranium One and an energy company, Urasia Energy, which had already purchased the uranium assets in Kazakhstan back in 2005. (More on this later.)
Though Reuters was reporting it was a 30-percent stake in the Khorasan uranium mine, Globe and Mail, a UK newspaper, reported a couple things differently. Globe and Mail also had more details in their coverage, however it's unclear which media reporting was accurate. Their reporting named a 30-percent stake in Kyzylkum, not Khorosan as Reuters had stated. The UK-based publication also reported UrAsia had purchased the stake in the same year it was sold (2005) from a Jeffcott Group for approximately $100,000. Jeffcott Group was reportedly incorporated in the British Virgin Islands. The shareholders of Jeffcott were never identified.
Also reported within the article by Globe and Mail was Jeffcott was "owned and controlled by 1900 Trust Company Limited (the 'Trustee') acting as trustee of the Jeffcott Family Trust. ... The control of Jeffcott, as shareholder, is carried on by the Board of Directors of the Trustee," according to documents they had been shown. A "Eugene Charyshkin" had been listed as the Jeffcott director and his signature was the one on the agreements. They also reported Ablyazov as having sold UrAsia the South Inkai and Adkala assets, but their reporting did not indicate any knowledge Ablyazov had sold the uranium assets in question to Jeffcott.
(Side note: In a leaked 2009 video, Dzhakishev reportedly linked his arrest to a struggle between Russia and Kazakhstan for uranium assets and global nuclear fuel markets and stated he had opposed a move by Rosatom to buy shares in Uranium One, which held Kazakh uranium assets.)
Also around October of 2009, Foreign Policy had published an article titled 'The Future Nuclear Powers You Should Be Worried About' naming Kazakhstan as one of these countries and referencing Dzhakishev's arrest as a reason to be concerned. Their very question of which narrative to believe is a tough one, because neither alternative is very pleasant. They wrote:
"The danger, however, is the risk of dangerous materials falling into the wrong hands. Corruption is endemic at all levels of autocratic President Nursultan Nazarbayev’s government, and the country’s massive and expanding nuclear bureaucracy is no exception.
This May, authorities arrested Mukhtar Dzhakishev, head of the state-run energy firm Kazatomprom, which oversees uranium production and plans to become the world’s largest producer by 2010. Dzhakishev was arrested for appropriating nearly two-thirds of the country’s uranium deposits and selling them to foreign firms.
Some have suggested that such a feat would be impossible and the charges are politically motivated. In any case, the implications are troubling: Either stunningly huge amounts of uranium can be shifted around without oversight, or one of the world’s largest uranium producers is becoming an unstable political battleground. The risk of rogue states or terrorist groups taking advantage of this situation is significant and frightening."
In this WikiLeaks Astana cable leak from 2009 Dzhakishev leaked videos to YouTube are possibly linked to December removal of the Chairman of the Committee for National Security (KNB) as well as a potential Russian role in this "multi-faceted drama."
(For additional context, between 1997-2009, Kazakhstan went from the world's 13th largest uranium producer to the 1st a year earlier than they had targeted, which was 2010.)
Also in WikiLeaks under Global Intelligence files from Stratfor, someone named Kendra was tasked in August of 2009 to make a list "of every rumor, fact, story, etc of Kazakh son-in-law Timur Kulibayev's business in the past 9 months. I need to know what he has purchased, been placed on the board of, companies he's merged with or simply acquired. Any new business for the man in the past 9 months." Within the email, Kendra is told "do not speak of this task with any other interns, analysts or overseers, etc."
Kendra came back with a good amount of detail for the requestor, noting Timur Kulibayev's recent purchases in the UK, and that "this guy seems to have his hands in everything...". She outlined his recent appointments including deputy chair of the management board of Samruk-Kazyna, the national welfare fund created the prior year, as well "chair of the boards of directors in a number of national companies that are part of this state-run body." A decision date of May 21, 2009 was listed as to when the management board of Samruk-Kazyna announced this change, as well as putting him as chair on JSC National Company KazMunayGas, JSC National Company Kazakhstan Temir Zholy, and JSC Samruk-Energo.
Another detail Kendra had included was Timur and Rakishev seemed linked to real estate purchased which was then left to fall into such terrible conditions it was deemed "in such a state of disrepair that the local council has announced it may now be seized to house the homeless." Kendra noted the obvious question of why Timur would purchase the Sunninghill Park for $15 million, $3 million over the asking price, only to treat his investment with such "contempt"?
Note it was Kenes Rakishev who was reported as having negotiated the deal and there was speculation "the purchase was a special favor to the Duke of York because of his close relationship with Kazakhstan."
Also within this same cable leak was reference to an interesting rumor/article about a mystery child Kulivayev has with a woman who is a VIP at KazMunaiGaz in UK and linked to this article.
Related WikiLeaks CableLeaks from February of 2009 detailed how the takeover of BTA Bank from Ablyazov may have been because he had grown too powerful and compared it to how "then-favored" son-in-law Rakhat Aliyev took over several banks in 2001 in a "simple raiding and consolidation" for the benefit of President Nazarbayev. Timur Kulibayev was named in this cable leak as a potential contender to one day succeed Nazarbayev.
Towards the end of this cable which ended up on WikiLeaks was this included quote which referred to Russian oligarchs. The cable stated: "Presidential advisor -- and former Minister of Culture and Information -- Yermukhamet Yertsybayev, who has a reputation for speaking frankly, told the press on February 10 that "no political motive" was behind" BTA's takeover and Ablyazov's ousting. "The only motive behind the nationalization was the protection of BTA's clients from losing their savings," he claimed. However, he somewhat ominously added that "bankers and oligarchs should stay away from politics. Russian oligarchs learned that lesson long ago.... Unfortunately, some of our businessmen still don't get that."
The cable had also concluded though there may be political reasons behind BTA Bank being nationalized, and Ablyazov being accused, but "most financial experts believe the government taking over BTA was a necessary step in Kazakhstan's relatively responsible response to the global financial crisis."
In 2009, the UK issued worldwide freezing orders on any assets believed to be Ablyazov's.
BTA Bank sought bankruptcy protection in February of 2010. It sought to protect itself from US creditors while it worked to restructure $11.6 billion of debt, while accusing oligarch Muhktar Ablyazov of stealing billions from the bank. Reuters reported, "The Almaty-based bank filed late Thursday for protection under Chapter 15 of the U.S. bankruptcy code with the U.S. bankruptcy court in Manhattan. The filing came a year after Kazakh’s state-owned Samruk-Kazyna National Welfare Fund took a 75 percent stake in the bank."
One of the Stratfor emails leaked on WikiLeaks in February of 2010 had a subject line 'Arcanum Proposal to Stratfor' but the attachment link does not work to determine what was being proposed. However, it does seem to indicate Stratfor and Arcanum had some form of working relationship at this point in time.
In March of 2010, a Stratfor email leak with a subject 'Timur articles" detailed Ablyazov had accused Nazarbayev's son-in-law, Timur Kilubayev, of fraud and bribery. There had been a pretty public fallout between Ablyazov and virtually all of the Kazakh government. There was a purge in 2009 of important political and power players inside Kazakhstan for political and economic reasons with players like Timur making moves to consolidate assets like energy firms, banks, etc. Ablyazov had painstakingly laid out an "intricate network" Timur used to take bribes, shield money, and purchase other pieces in the country. It also stated a belief no one will touch Timur without approval from Nazarbayev.
GOLDMAN SACHS WITHDREW CLAIM AGAINST BTA BANK
In another WikiLeaks dump from September of 2010, the Stratfor Kazakhstan recap noted "Russian Goldman Sachs" withdrew $109 million claim against BTA, and the main shareholder of SAT & Company was Kenes Rakishev. (More on SAT & Company later.)
DILIGENCE SAID LARGEST MONEY LAUNDERING OPERATION
THEY HAD EVER SEEN
In a Financial Times article not published until 2017 it was reported, "In October 2010, Williams’s bloodhounds followed one of Ablyazov’s brothers-in-law to a self-storage facility in Finchley, north London. BTA’s lawyers secured a court order to open the container. Inside, among 25 boxes of documents and a hard drive, was a spreadsheet listing some of the thousands of offshore companies through which BTA’s billions had flowed, a virtual treasure map of secretive tax havens. It was the key to what Williams describes as the biggest money-laundering operation he had encountered."
HUNTER BIDEN, ASSOCIATES RECEIVED MONEY FROM RAKISHEV,
NEW MAJOR SHAREHOLDER OF BTA BANK
By 2010, Hunter Biden, Devon Archer, and Chris Heinz (John Kerry's stepson) had formed a company named Rosemont Seneca Partners. This may seem irrelevant to this story, but rest assured it is not. It is in April of this year Hunter makes his first trip to Beijing according to the Secret Service travel information provided in the report 'Hunter Biden, Burisma, and Corruption: The Impact on U.S. Government Policy and Related Concerns'.
(Keep in mind within this report it is disclosed Kenes Rakishev did send Hunter Biden's partner, Devin Archer's company money on April 22, 2014, when only two months earlier Rakishev had become a major shareholder of BTA Bank. So there is context here. More details in 2014 section.)
Ablyazov was appointed Chairman of BTA Bank in 2005, later removed in 2009, and was at political odds with Kazakhstan President Nursultan Nazarbayev
Felix Sater started work as a consultant for the owner and chairman (Fettah Tamince) of two Turkish companies doing work in Kazakhstan: Sembol Construction and Rixos; this work later ended in 2010
By fall, the Ablyazov-Khrapunov families were merging due to an upcoming wedding and reportedly Nazarbayev was sending warnings to the Kazakh elite not to attend
According to the BTA Bank lawsuit filed against Felix Sater in spring of 2019, Sater likely met Ablyazov at this Kazakh wedding and been introduced to the Khrapunovs by Tevfik Arif either this year, or a year or two earlier
The Khrapunovs were tipped off by late 2007 of potential pending charges and fled from Kazakhstan to Switzerland
The company Swiss Development Group (SDG) was formed by late July 2007, weeks before the planned wedding
By presidential decree, as the Kazakh economy was faltering in 2007 and there were already signs of a looming global financial crisis, Nazarbayev had two funds merged to create a new sovereign wealth fund named Samruk Kazyna
LATER LAWSUIT ALLEGED SATER ASKED
AROUND THIS TIME TO HELP KHRAPUNOVS
Felix Sater had already been sentenced in 2009 for his role in the stock fraud scam, but his later 2017 transcript from the Mueller team's investigation stated he testified he cooperated and worked with the US government for almost 20 years. If his cooperation had started by 1997 with the Defense Intelligence Agency as indicated, and with the FBI later in December of 1998, this would mean he was still cooperating long past his sentencing. Even when he no longer had to and was no longer facing any charges.
After his late 2009 sentencing, he was back at Trump Tower a couple offices down from Donald Trump and this had continued through much of 2010. However, the lawsuit which would be filed against him eight years later in 2019 alleged he was approached or asked around 2011 to help Khrapunovs conceal and launder their money not yet frozen by banks.
WIKILEAKS STRATFOR EMAILS INDICATE FOCUS DURING THIS TIME
TO DEFINE POWER GROUPS IN KAZAKHSTAN
In a WikiLeaks email dump dated 2011 with the subject line, "hello dosym" the interest is to determine the power groups within Kazakhstan and better grasp the ensuing battle which would be coming over the next several years. In fact, there are many emails on WikiLeaks alluding to a deep concern for how Kazakhstan will fair when Nazarbayev is no longer living. Kazakhstan's geographical location residing between China and Russia was also a concern.
Some of the exact text reads:
As we discussed last week, I was hoping if you could help me
come up with a list of the 5 or 6 power groups in Kazakhstan and
their background. What I am looking for is:
1) Type of powergroup (if they have a name or branding)
2) Who is the main leader in this group
3) Any other powerful people in this group
4) what economically does this group control
5) what politically does this group control
6) Are they willing to ally with another group?
7) How connected to Nazarbayev
8) Anything else important about them
What I'm trying to do is come up with the groups that will
struggle with each other before the struggle begins in the next
For a little more background here, there is an older email dated 2009 where Lauren from Stratfor is reaching out to Dosym who apparently manages a website related to Kazakhstan news. She's traveling there soon and wants to buy him a drink. From there on, a relationship appears to have developed where she would occasionally send requests to him for information related to the Kazakhstan government, energy deals, and other topics of interest. This following email details where Dosym was offered flat rate of $500 a month to answer her questions, some tricky, some not.
This is an email from August 2011 where she asks Dosym about information on some specific Kazakh companies:
"I know Meredith contacted you to say that we will be heavily focusing on
financial issues in Kazakhstan. We have three pretty hefty issues we need
to suss out.
1) We need information on the Kazakh government's consideration for
IPOs for KMG, KazTemir and Kazatom.
2) What KMG is planning on for its subsidiaries KMG EP, KTO, and KTG,
as cash is really strapped for KMG
3) Any more word on whether the Russians are planning on buying
Alliance or BTA bank from Samruk. Or if anyone else is being seriously
considered to purchase the banks.
This email held an attachment regarding pressure political groups within Kazakhstan. The document outlined the following groups:
The Group of Dariga Nazarbayeva (the elder daughter of the president of Kazakhstan) and the president’s former son-in-law Rakhat Aliyev) - This group began to form in 1994-1995. The group’s main forces were concentrated in public service, mainly in the law-enforcement structures (Committee for National Security (KNB), Tax Police, Customs Committee) and in the mass-media (TV channels Khabar, NTK and КТК, the newspapers Caravan and Novoye Pokolenie (NP), that is, the most popular and influential mass media in the republic.). However, the falling out with ex-husband Rakhat Aliyev cost her some political power.
Timur Kulibayev's Group (the second son-in-law of the President of Kazakhstan) - This group was formed in 1999-2000. The group’s main forces are concentrated in the strategic spheres of the Kazakhstan economy (industry, oil, bank, and communications). The companies, which are under this group’s control: KazMunayGas, Kazenergy, KEGOK, Kazakhtelecom, Alautransgas, ShNOS, Atyraubalyk, NSBK-GROUP, KazAgroFinance, Silk Road - Kazakhstan, etc. The Group’s Bank: Narodny Bank of the RK. Also the following was written: "It is needed to stress that weakening of positions of Dariga Nazarbayeva and Rakhat Aliyev automatically has led to strengthening of the Timur Kulibayev’s Group. After the crash of Rakhat Aliyev, from the viewpoint of cumulative near-power, financial, industrial, information and other resources, this group currently is the largest and influential in Kazakhstan."
The Group of Kairat Satybaldy (nephew of the President N. Nazarbayev)
The Group of Bulat Utemuratov
The Group of Nurtai Abykayev
The Group of Marat Tazhin
The Group of the "southerners" (representatives of the Kazakhstan’s southern regions in power) and reportedly excessive strengthening of the Masimov-Kulibayev group is a fear of the southerners
The Korean Group
The Eurasian Group (The Group of Alexander Mashkevich, Patokh (Fatakh) Shodiyev and Аlidzhan Ibragimov, otherwise known as the Kazakh Trio)
Last but not least, with the clarification this is actually a 2010 email with comments to questions, the attachment within details banks China may have been seeking to purchase. Answer provided was only two banks at the time were potentially seeking investors. Below is the question asked along with the provided answer. As you can see, during the years following BTA Bank's collapse and immediate nationalization by the SWF Samruk Kazyna, the later concerns appear to be a potential sale to either Russia or China, and perhaps a focus on Kulibayev who at this time was considered a possible Nazarbayev successor.
6. Are there any rumors of which banks China looks to purchase? Any that ally more with Nazarbayev than Kulibayev?
If the talk is about 9 large Kazakhstan banks (Kazkommertsbank, Narodny Bank, BTA Bank, Alliance Bank, CenterCredit Bank, Almaty Trade-Finance Bank, Eurasian Bank, KaspiBank, Nurbank), among them only two banks are actively searching for investors. These are BTA Bank and Alliance Bank which, since the last year, are under control of the state. However, BTA Bank conducts negotiations with the Russian Sberbank on its attraction as an investor. As for Alliance Bank, there is no information so far on its work on attraction of investors. Thus, it is not excluded that among investors can appear also the Chinese financial structures. Meantime, the talk is not about the sale of banks, but about the entry into their capital. Though the majority of large Kazakhstan banks are not going to conduct the sales procedure. From all these banks under Timur Kulibayev's control is only Narodny Bank and partly BTA Bаnk. Probably, China will be interested in the purchase of more small banks. Meantime, the “Bank of China in Kazakhstan” is operating for a long time already in Kazakhstan, that is quite enough for China given the small market of Kazakhstan.
This email is again in 2011 and outlined some of that succession crisis. If you want to take a look, here's the link.
PUBLIC PROSECUTOR IN GENEVA OPENED MONEY LAUNDERING INVESTIGATION INTO KHRAPUNOV FAMILY
BRITISH JUDGE SENTENCED ABLYAZOV TO 22 MONTHS
A British judge has sentenced a Kazakh businessman accused of embezzling billions of dollars from one of Kazakhstan’s largest banks to 22 months in prison for contempt of court.
Mukhtar Ablyazov, a former chairman of Kazakh bank BTA, is being sued by BTA in Britain for alleged fraud worth $4 billion. The court ruled that Ablyazov, who was not present to hear the decision, had acted in contempt of court because he failed to disclose the full extent of his assets. BTA accuses Ablyazov, who has been granted asylum in Britain, of siphoning off the money during his time as chairman of the bank between 2005 and 2009. BTA is now owned by the Kazakh government, which rescued it in the wake of the global financial crisis.
Ablyazov denies the claims, which he says are politically motivated and are an attempt by Kazakhstan's President Nursultan Nazarbaev to eliminate him as a political opponent.
BTA BANK ANNOUNCES CREDITOR COMMITTEE
Reuters reported in April of 2012 BTA Bank "announced the members of a steering committee of creditors to discuss the restructuring of its $2 billion worth of defaulted debt."
KAZAKHSTAN'S SOVEREIGN WEALTH FUNDS CONCERNS
With funding partially provided in a grant from the State Department, in August of 2012 a paper was published regarding Kazakhstan's use of sovereign wealth funds, namely the National Oil Fund (NOF) and Samruk Kazyna; the latter being the SWF used to bail out both BTA Bank as well as Kazkommertsbank.
For those who aren't clear what sovereign wealth funds are, the first one kinda came with little warning in the early 50s. Due to their growth, in the prior decade leading up to this paper's publication, the author wrote these wealth funds had caught the attention of policy makers. When this was written, the International Monetary Fund, or IMF, is described as having broken SWFs into five categories: "1) stabilization funds, 2) savings funds, 3) reserve investment corporations, 4) development funds, and 5) pension reserve funds."
David Kemme, the author and a professor at the University of Memphis, wrote:
"While these functions are typically and purposefully separated in unique free standing legal entities, many countries’ funds may have single or multiple functions with ambiguous missions and ambiguous lines of authority. Kazakhstan has two that play a critical role in the economy. The National Fund for the Future of Kazakhstan (NOF, the “national oil fund”) serves as a stabilization fund and a savings fund. Samruk Kazyna (SK, the “sovereign welfare fund”), a government owned holding company, acts as a development fund focusing on economic development objectives of the government."
Kemme further explained the majority of SWFs are converting the wealth from natural resources into more spendable assets and the primary concerns with them being around lack of transparency as well as state ownership. This was further clarified with these five listed points: "1) commercial advantages that private companies do not enjoy, 2) SWF objectives that may reflect government foreign policy objectives, 3) activities which may disrupt global or individual country capital markets, 4) ownership in particular industries as a vehicle for the transfer of sensitive technologies, and 5) coordinated actions of a group of SWFs that may lead to global control of particular resources."
The last three points were the most concerning, being potential disruption of global markets, possible transfer mechanism for sensitive technologies, and various SWFs among countries being able to coordinate together in a way to establish control of global resources.
The level of transparency with SWFs is virtually nonexistent. Kemme wrote "The lack of independent auditors or published annual reports and opaque balance sheets leaves room for questionable behavior. Critics claim that they are a major source of graft and corruption. These concerns can be addressed if the SWFs individually provide greater transparency in their strategy and objectives, management and accounting practices and individual transactions."
By page 3, Kemme elaborated more on the role of the Samruk Kazyna fund, which was the fund which repeatedly provided BTA Bank money in the aftermath of the global financial crisis and took over the Bank in the process.
"The Sovereign Wealth Fund Samruk Kazyna, a joint stock company with the Ministry of Finance as the sole shareholder, is much larger and more important than the NOF. The assets of SK are estimated to be from 50- 80% of GDP, and revenues of the companies around 20-30% of total GDP, perhaps higher. SK was created by merging two existing Joint Stock Companies, JSC Kazakhstan Holding for the Management of State Assets Samruk and JSC Kazyna Sustainable Development Fund, under the guidance of the State Property and Privatization Committee of the Ministry of Finance. Samruk was a holding company of the five large state monopolies, KazTelecom, KazRail, Kazmunigas, KazPost and KeGok. Kazyna consisted mainly of regional Social Entrepreneurship Companies focused on economic development, many initially funded with resources from the NOF. Entities held by SK, range from Air Astana, to real estate ventures and newly acquired commercial banks. Many of these companies have multiple subsidiaries so the total number of companies held is difficult to estimate. Recently ownership of several of the companies was transferred from SK to other Ministries.
Recent transactions with Samruk Kazyna are seen as one-time events. About $5 billion in SK bonds were purchased by the NOF and there was a $5 billion direct transfer from the NOF to SK. The direct transfer came in part from the tenge “Domestic” Account of the NOF managed by the Ministry of Finance and $2-3 billion from the Stability Fund of the NOF."
As you can well see, Samruk Kazyna as a wealth fund and becoming so integral and so quickly to the functioning of Kazakhstan's economy put it on the radar in geopolitical circles within only a couple of years following its creation in 2008 through the merger of these two funds.
This paper also included other related details such as, "In Kazakhstan four banks, several construction/real estate ventures and a major agricultural enterprise were fully or partially nationalized and/or recapitalized (the operations resulted in a transfer of funds of about US$5 billion in 2008, US$1.8 billion in 2009 and the purchase of about US$4 billion in Samruk Kazyna bonds by the National Oil Fund).
It also interestingly noted that had the global financial crisis not occurred, sovereign wealth funds assets across the world would have hit the $10-$15 trillion mark by 2015, but at the time this was written in 2012, this was now forecasted to be $5-$10 trillion. To provide contrast to this amount, the world GDP in 2012 was around $70 trillion.
ARCANUM GLOBAL MAKING STEADY MONEY FROM KAZAKHSTAN
By the end of 2012, the global intelligence firm Arcanum Global had made $3.7 million off the Kazakhstan BTA Bank battle.
The global accounting firm PriceWaterhouse Coopers reported finding a missing $10 billion shortfall in the BTA Bank's accounting books back in 2010 which had prompted BTA Bank into filing for bankruptcy to protect itself against US and UK creditors.
However, an organization who audits the audit companies found the following concerns regarding the financial sector, specifically naming PWC as one of the four firms audited. They found in some cases, audit documentation was lacking. It is unclear if any of these concerns related to PWC and their BTA Bank audit results.
TRUMP SOHO SALES - THREE RELATED LLC'S
By April of 2013, three LLC's had been created to purchase three apartments in Trump SoHo: SoHo 3310, SoHo 3311, and SoHo 3203.
FIRST FLAGGED FELIX SATER BANK TRANSACTIONS
According to Buzzfeed News reporting later in October of 2020, it was toward the end of August (Aug 29) in 2013 when Tri-County used an account at Chase Bank to send money ($2.6mil) to Bayrock Group, Inc. They reported a week later Bayrock sent money ($2.5mil) to a Canadian company. Buzzfeed reported the "bank believed [it] was set up in such a way as to obscure its true ownership and purpose of its transactions," which they referenced to a SAR filed by Wells Fargo.
Buzzfeed News reported, "Later in September, Tri-County’s Chase account wired an additional $866,000 to Bayrock. On the last day of the month, Tri-County sent more than $1.3 million from its Chase account to its Wells Fargo account." They detailed a final transaction occurring a week later when Tri-County used an account at Wells Fargo to send another substantial sum ($1.75mil) to Bayrock before Sater closed the account at Tri-County on the same day.
Sater was quoted explaining, "We were just doing a bunch of transactions. It was real estate. I don't remember specifically. But it was related to the mall, Tri-County."
(NOTE: Hold that thought regarding August 29th being this first transaction date until we get to the Tri-County shopping mall dispute which reportedly began on August 30th, 2013, the very next day.)
By the time the Tri-County account was being closed, it was October and another bank was flagging another round of Sater financial transactions. The entire timeline of 2013 flagged transactions looks like this:
Aug 30 - Tri-County used an account at Chase Bank to send $2.6mil to Bayrock Group, Inc.
Sep 7 - Bayrock sent $2.5mil to a Canadian company
Late Sept - Same Tri-County Chase bank account wired an additional $866,000 to Bayrock
Sept 30 - Same Tri-County Chase bank account wired more than $1.3mil from Chase account to Wells Fargo account, which then send $1.75mil to Bayrock and the Tri-County account was closed
Oct 29 - Sater sent $32mil to Sands Point Partners company from his Bank of America account
Nov 1 - $25mil was wired to Sater's wife's granola company; she attempted to deposit $20mil check into account belonging to Moses & Singer law firm but the check didn't clear
Dec 30 - Sater's wife wired $15mil from granola company account to Moses & Singer law firm
Within the Buzzfeed News article, Sater is quoted as explaining, "That law firm sent the money as a settlement payment with the Khrapunov family, Sater said, and his wife wasn't aware of its intended purpose. 'Here’s what I really, really would like to put a dot on — you would have to be literally just a moron to conduct money laundering transactions through your own company, through your own bank account, where everything is known,' Sater said. 'If you’re trying to do something illegal and obscure something, you don’t do it through your own accounts. It’s as simple as that. Guys — think of my history.'”
So, let's now cover the shopping mall dispute which started the day following the first flagged transaction and ended with secret settlement terms
Coincidentally, on the same day Rakishev was announced as the new Chairman of BTA Bank, the position Ablyazov held in the past, Hunter Biden's co-company with Archer and Heinz, Rosemont Seneca Partners, was wired $3.5 million dollars for consulting.
The Hunter Biden and Burisma report also touched on the fact in April of 2014, Kenes Rakishev sent $142,300 to Devin Archer's company, Rosemont Seneca Bohai LLC, for a car. The report also noted Rakishev is the son-in-law of Imangali Tasmagambetov.
Tasmagambetov was a close confidant of Kazakhstan President Nazarbayev and had also served as Prime Minister as well as Kazakh Ambassador to Russia from 2017-2019. He was also Minister of Defense from 2014-2016.
In August of 2014, Republika published an investigative report on the BTA Bank and Ablyazov story in which they wrote, "To date, the prosecution of Ablyazov and his associates, in criminal and civil trials is being carried out in dozens of countries, the key countries being Russia and the United Kingdom. Russia - because this country is home to a significant portion of Ablyazov’s assets, United Kingdom - because it was there that BTA Bank filed civil claims against Ablyazov and a number of his colleagues and assistants."
Keep in mind while reading excerpts from this Republika is an Indonesian national daily newspaper and it is unclear if they would have had any bias towards this case in their investigative reporting.
This is an interesting report any reader may wish to read in full but below are a select handful of excerpts:
"In Russia, the prosecution of Mukhtar Ablyazov began upon Nursultan Nazarbayev’s personal request to the then Prime Minister Vladimir Putin. An appropriate protocol instruction marked ‘Secret’, commanding the rendering of assistance to Kazakh security forces, dates back to the summer of 2009.
Currently, all the organisational work in this area is coordinated by the aide of the president of the RF, Shkolov, Putin's trusted man, whom he has known since the days working in the Russian foreign intelligence service in the GDR. The criminal case of BTA Bank is run by the Investigation Committee, and now the Department of the Interior Ministry of the RF. Since the opening of a criminal case, most of the work on the case has been performed by three investigators. Two of them were caught by the FSB of the Russian Federation engaging in informal communication with representatives of BTA Bank, were found to be in receipt of illegal remuneration from them, and subsequently dismissed.
A third investigator, N.N. Budilo, has become famous for his participation in the prosecution of the Russian lawyer Magnitsky, who died in prison. The death of the latter brought about strong repercussions in Europe and the United States; the US enacted a corresponding law, which was named after Magnitsky and became, in fact, the first instance of Western sanctions against Russian officials to break the law.
Communication between the Kazakh authorities and Budilo took place by virtue of two proxies - Kazakh diplomat accredited to the Embassy in Moscow, Anatoliy Konstantinov, former First Deputy General Prosecutor of Kazakhstan, and Shaken Amzeyev, according to some sources, an employee of the Kazakh special services.
More than a dozen Russian legal entities have collaborated with Amzeyev, representatives of BTA Bank and Samruk-Kazyna (a government agency, which from February 2009 to July 2014 held the state-owned shares of BTA Bank).
The most active and influential of these was the Russian firm Quorum Debt Management (‘Quorum’). This company is headed by Andrey Pavlov, known as the leader of the group whose members also participated in the Magnitsky case.
Pavlov was engaged in the case by a Dmitry Klyuev, who had begun the process of prosecution of Ablyazov in Russia. He was also involved in the case regarding the assassination of Magnitsky.
In addition to Pavlov’s firm, several other law firms are suspected of raider attacks: ‘Leader’ and ‘Atlant XXI’ have actively worked against Mukhtar Ablyazov and his associates in Russia.
This year, BTA Bank was, in a very peculiar way, ‘sold’ by the State Fund ‘Samruk-Kazyna’ to the second largest bank ‘Kazkommertsbank’ and Kenes Rakishev - one of the closest partners of the president’s son-in-law, Timur Kulibayev.
Taking into consideration that in most business projects, Rakishev acts as a figure head, secretly representing Kulibayev, we can undoubtedly cite Kulibayev as one of the main owners of the illegally nationalised BTA Bank."
Further down regarding some of the main involved law firms and money being spent on the BTA Bank-Ablyazov case:
"The international law firm Hogan Lovells is the main contractor of ‘BTA Bank’ in the UK. At the same time, it is used by the Kazakh authorities as the centre of control of a network of international law firms which protect the interests of Akorda in the West. This is the very company which executes proceedings against Ablyazov in London.
Formally, it represents ‘BTA Bank’. In reality, BTA is just a facade, a handy tool for Akorda’s actions in the jurisdiction of Great Britain. BTA, acting as a victim of Mukhtar Ablyazov’s alleged fraud, creates an aura of legitimacy for the persecution of Ablyazov by Nazarbayev.
Currently, lawyers from Hogan Lovells are actively trying to convince the law enforcement bodies of England to open a criminal case against Mukhtar Ablyazov. Hogan Lovells’ budgets for the war against Ablyazov boggle the imagination of all lawyers. Over four years, Kazakhstan has spent more than 100 million pounds on services provided by this company. In addition, two other law firms hired by Akorda have fought against Mukhtar Ablyazov: Reed Smith and Ronald Fletcher Baker. They are striving to induce the British authorities to revoke Mukhtar Ablyazov’s political refugee status. Reed Smith is also actively working to discredit Ablyazov in the West, coordinating all of the extradition processes. In line with Hogan Lovells, Reed Smith indirectly endeavours to influence the law-enforcement authorities in England so that they institute a criminal case against Mukhtar Ablyazov.
Reed Smith has already provided legal services to Akorda when in November, 2013, through the International Centre for Investment Disputes (Arbitration Court at the World Bank), it successfully brought about a refusal to consider claims filed by one of Ablyazov’s companies against Kazakh authorities. Then it opened an office in Astana, citing the brilliant prospects in the country’s commodity sector.
The Reed Smith company has reasons to rejoice - in 2013, for example, Kazakhstan paid the law firm 12.5 mln. dollars. This year, given the extradition process in France, Reed Smith’s outlook is even more optimistic.
Hogan Lovells’ work and BTA Bank’s success during the consideration of their civil claims in a British court, was supported by Tony Blair, who has served as the principal foreign policy adviser to Nazarbayev since autumn 2011. Along with Blair, Akorda is now supported by the efforts of the entire team of the former Prime Minister of Great Britain."
Note the reference here to "Akorda" is a likely reference to the Kazakh government, in general.
HACKING TEAM LEAKED EMAILS SHOW DISCUSSION OF AP REPORTING
In mid-2014, the Associated Press (AP) reported on Hacking Team and a report written by Kaspersky and Citizen Lab. When Hacking Team was later hacked the following year, the emails dumped to WikiLeaks show them forwarding each other the article. AP was reporting on findings made public by Kaspersky and Citizen Lab of Hacking Team malicious software, servers, where in the world they were located, and more.
WIRED reported around the same time as did Security Affairs, the conclusions being Hacking Team had servers in 40 countries around the world. The majority of them were located in the United States, Kazakhstan, Ecuador, and the UK. 64 being in the US, and 49 residing in Kazakhstan. Of 326 mapped servers, this meant almost 20% of them were in the United States and 15% were in Kazakhstan. Countries like Ukraine had 1 server, Germany and France had 2, Russia had 5, etc.
"The RCS mobile components for every device, including Apple iOS, Android OS, Windows mobile and BlackBerry, allow customers of the HackingTeam company to monitor victims, spy on conversations through principal VOIP and instant messaging applications (e.g. WhatsApp, Skype), steal data from their devices and use them as spy bugs enabling the microphone.
The RCS mobile modules are meticulously designed to operate in a discreet manner, for instance by paying close attention to the mobile device’s battery life,' 'This is implemented through carefully customized spying capabilities, or special triggers: for example, an audio recording may start only when a victim is connected to a particular Wi-Fi network (for example, the network of a media house), or when he/she changes the SIM card, or while device is charging,' Kaspersky Lab said.
Experts at Kaspersky and Citizen Lab discovered that the iOS version of the RCS Trojans is able to monitor only jailbroken devices, anyway the spyware can work on any devices considering that is possible to remotely run a jailbreaking tool such as Evasi0n and then load the malware implant.
The Android spyware was characterized by the presence of a sophisticated obfuscator dubbed DexGuard that made hard the analysis of the malicious code.
The malware developer at HackingTeam also used zero-days for their exploits that served with classic spear phishing scheme and also through local infections via USB cables while synchronizing mobile devices.
The findings proposed by the experts are very important because they demonstrate the high level of sophistication of the spyware designed by the HackingTeam and the scale of the surveillance operated through its tools.
These tools in the wrong hands are a dangerous weapon."
TECH CRUNCH REPORTED HACKING OF MILITARY COMMAND ACCOUNTS AND THREATS TO AMERICAN SOLDIERS TO WATCH THEIR BACKS
Tech Crunch reported of the hacking of US CENTCOM Facebook and Twitter social media accounts and posted what were alleged to be war scenarios showing US plans to use India as a base to deal with simultaneous conflicts in Middle East and China but were dated 2004, 2005, and 2008. This breach of their social media accounts came at the same moment President Obama was giving a speech to FTC on cybersecurity.
RAKISHEV SHARES IN BTA BANK DOUBLED BETWEEN 2014-15
Kenes Rakishev shares in BTA almost doubled between 2014 and 2015. In March of 2015, this was the news report in the Gazette of Central Asia reporting KazkommertsBank (KKB) had acquired over 304 billion common shares of BTA Bank at 0.24162 tenge per share. This increased KKB's holding in BTA shares from 47.415% to 94.83%.
SARKOZY'S FORMER SPY CHIEF, BERNARD SQUARCINI, HIGHLIGHTED 'ENORMOUS GEOSTRATEGIC STAKES' IN BTA BANK-ABLYAZOV SAGA
In March of 2015, Mediapart, an online French investigative journalism site, published an article regarding the unfolding Ablyazov case.
As they made it clear further on, "The Ablyazov case is a vast and complex affair, a titanic battle that is being fought out between the Kazakh capital Astana, London, Paris, and Geneva through battalions of lawyers, private detectives, hackers, PR consultants, and lobbyists of all kinds."
Mediapart noted a WikiLeaks-style site called Kazaword leaked 69 gigabytes of data related to the background of the Ablyazov affair. The website had appeared the previous year and had revealed Bernard Squarcini, a French intelligence officer and security consultant who had recently joined Arcanum Global as a Senior Advisor, was involved in the BTA Bank case. By June of 2013, Squarcini had retired from public service and joined Arcanum in this new role, yet months later was convicted and fined for "checking the phone records of journalists from Le Monde to try to find the source of a leak that could have embarrassed Sarkozy." (former French president)
Mediapart excerpt regarding Arcanum:
"One of the firm's most high-profile clients is the Kazakhstan government. Among the many documents released by Kazaword, Mediapart has found hundreds of emails showing that Arcanum AG was part of the war machine put in place by the authorities in the Kazakh capital Astana against Mukhtar Ablyazov, alongside the large law firms also appointed by the Kazakh justice system. It appears from the emails that the company regularly sent “investigation reports” to the judicial authorities in Astana, for which they were handsomely paid. However the contents of these reports themselves cannot be accessed, as they were stored on a secure server.
According to Mediapart's information, Bernard Squarcini's role was to inform the Kazakh authorities on the progress of the Ablyatov legal proceedings and to lobby certain figures in France. Several emails found on Kazaword show that the former head of the DCRI carried out some of the groundwork in France for the visit of a Kazakh delegation to Paris from June 25th to 27th, 2014. Four people took part in that trip: former prime minister, former mayor of Astana and current defence minister Imangali Tasmagambetov; Kenes Rakishev, chairman of the board at BTA Bank; Marat Beketayev, deputy minister for justice; and his former advisor Nourlan Nourgabylov, who is now head of the legal department at BTA Bank. The last two are in charge of the country's legal proceedings against Ablyazov.
Mediapart excerpt regarding Squarcini highlighting "enormous geostrategic stakes" which surrounded the Ablyazov case in late 2013:
"In mid-November 2013 the Canadian lawyer received a text from Obadia who had arranged an interview for him with “interesting people” at the upmarket L'Avenue bar on avenue Montaigne in Paris. In the middle of a swarm of top models Sahlas noticed a table of men who were wearing ties. He recognised Bernard Squarcini who was next to Charles Pellegrini, former head of the anti-gang crime unit ... Squarcini, who at that time was awaiting judgement on the telephone records court case, criticised journalists and the French justice system, whom he said were too often 'used'. He said that, with his network, he was able to help and highlight the 'enormous geostrategic stakes' that surrounded the Ablyazov case."
ARCANUM GLOBAL POLITICAL CONTRIBUTIONS 2016 U.S. ELECTION
Arcanum Global in April of 2015 contributed $100,000 to the Right to Rise PAC supporting Jeb Bush.
KAZAKH KNB PURCHASES SOFTWARE UPGRADES
FROM HACKING TEAM COMPANY
Not only do we know based and hacked and leaked documents tied to the former Hacking Team company based in Italy that the Kazakhstan government became a client of theirs by late 2012, we also know they purchased new "tools" or software or malware from HT, taking delivery on March 26, 2015.
*If you click link to view attachment with contract details between Kazakhstan KNB and Hacking Team, note in the contract the reference to Deutsche Bank
In a related email dated the following month of April 2015, there is a question from a Kazakh official to a HackingTeam contact regarding potential training in Kazakhstan for "IT Intrusion for government & intelligence specialists."
JOE AND HUNTER BIDEN PRIVATE DINNER PHOTO WITH KAZAKHS
This will be covered in further depth below when this reporting was actually made public. On April 16, 2015, a private dinner was held at Cafe Milano where a photograph of Joe Biden, Hunter Biden, Karim Massimov, and Kenes Rakishev was taken.
Keep in mind at this time the government of Kazakhstan was essentially a client of Arcanum Global, and had been since 2009.
JUDGE BRIAN COGAN ORDERS LAWYERS TO RETURN DOCS
STOLEN FROM FELIX SATER AT BAYROCK
FELIX SATER FORMED LITCO
ISIS-LINKED CYBER CALIPHATE HACKS CENTCOM TWITTER ACCOUNT
InfoSec Affairs reported on May 17, 2015 pro-ISIS hackers were threatening "electronic war" on the US and Europe. Hackers calling themselves “Islamic State’s Defenders in the Internet,” also known as Cyber Caliphate hacked social media accounts belonging to the US CENTCOM and released a propaganda video threatening cyberattacks. They stated:
“Praise to Allah, today we extend on the land and in the internet. We send this message to America and Europe. We are the hackers of the Islamic State and the electronic war has not yet begun,” the video said with a distorted voice and picture of an Anonymous member. “What you have seen is just a preface of the future. We are able until this moment to hack the website of the American leadership and the website of the Australian airport and many other websites.”
A screenshot of a tweet from the compromised account was included in this article's reporting and is are shown below here:
DISTRICT JUSTICE ASKED JUSTICE DEPARTMENT TO ACT REGARDING POTENTIAL UNSEALING OF FELIX SATER FILES
In March of 2016, a smaller publication called The Tri-County Independent reported on the fact US District Justice Brian M. Cogan had directed an "unusual order prompted by an unsealing request from The Associated Press", stating that unless the Justice Department acts before April 18, he will decide whether to make the court files related to Felix Sater public under the assumption that "federal prosecutors don’t care."
They also reported, "Not only did Cogan seal all documents in the contempt case, he also initially sealed the AP’s request that he unseal his justification for their sealing. When The New York Times asked the judge to unseal the AP’s request to unseal the sealing order, that request was sealed, too. Late last week, he made the requests by the AP and the newspaper publicly accessible ” but ordered that the parties to the case file any response to them under seal."
FELIX SATER LONG-TERM LAWYER CREDITED HIM WITH SAVING LIVES
Also in March of 2016, CBS News reported on the legal ongoing battle related to the unsealing of Felix Sater's files, as well as the media interest due to his employment at Bayrock, which had licensed multiple real estate dels using the Trump brand name. Sater's lawyer since at least 1997 or 1998 is quoted as saying the following in this excerpt:
"The New York judge has twice asked the Justice Department to pursue contempt charges against the two lawyers who revealed Sater's cooperation. In both cases, local federal prosecutors recused themselves over unspecified conflicts of interest after consulting with Justice Department officials in Washington. They referred the case to federal prosecutors in Albany, New York, who likewise did not act. In his latest order, Cogan again urged prosecutors to go after Oberlander and Lerner. 'One would think that the desire to ensure that further informants cooperate in government investigations should also motivate the government to take swift action against individuals who seek to expose the identity of informants, their proffered criminal history and the details of their cooperation,' the judge wrote.
Sater's attorney, Robert Wolf, said the judge was right. 'Mr. Sater shares and supports the court's frustration and outrage as to why these rogue lawyers have not yet been criminally prosecuted,' Wolf said in a statement. He credited Sater with providing information that 'potentially saved tens of thousands, if not millions, of our citizens' lives.'
PRO-ISIS HACKING GROUPS MERGE FORCES INTO CYBER CALIPHATE
TechWorm reported in March of 2016 this merging of different ISIS hackers and their affiliates into a new mega hacking unit with a chosen moniker United Cyber Caliphate, or UCC. They reported, "The UCC comprises of Cyber Caliphate Army (CCA), ISIS’s main hacking unit, and other pro-ISIS groups like Sons Caliphate Army (SCA) and Kalacnikov."
DISTRICT JUSTICE COGAN RULED TO UNSEAL SOME SATER FILES, NOT ALL
In May of 2016, the Associated Press had reported the District Justice's decision to unseal some of Felix Sater's files (about 240 court documents), as well as consider unsealing 38 more documents in the future after additional review. However, they reported Justice Cogan saying during the hearing "he was leaning toward keeping those private because their disclosure would deter cooperation and will jeopardize ongoing investigations.”
EFF MAKES PRESENTATION AT BLACKHAT 2016 FOCUSING ON KAZAKHSTAN
This video can be watched on YouTube and is less than hour long.
In November of 2016, only weeks following the 2016 election, Electronic Frontier Foundation (EFF) presented at the Black Hat USA conference regarding state-sponsored government use of spying tools. Some of the previous work EFF had been involved in included malware being spread by hackers allied with Assad in Syria, especially at the beginning of the Syrian civil war, was a focus of EFF's for 2.5 years.
This presentation given by EFF in late 2016 was almost entirely focused on the government of Kazakhstan but early on they reference how their domain EFF.org itself was spoofed and targeted, yet they weren't the actual targets. It would seem this spoofing may have taken place early 2015 as they alluded to "earlier last year."
Friends of theirs on the Google Security team had reached out to inform them their EFF domain was being used in a "watering hole" attack. They were concerned enough to look into it and determined it was part of Pawn Storm so an internal focus and investigation started into why it had happened. They reference Pawn Storm along with Fancy Bear. Yes, the same Fancy Bear group which had targeted the DNC during the 2016 election.
Bear with me as Kazakhstan will return to focus during this longer section. So, Pawn Storm was written about close to the 2016 US election by Trend Micro, 'Pawn Storm Boosts Attacks Before Zero-Days Get Patched' and they reported between late October to early November a rush of attacks towards various governments and embassies around the world. Yes, the DNC was reportedly targeted by Fancy Bear, but many others were as well.
One key thing to skip ahead and know is within this later 2018 report on Pawn Storm by Trend Micro, they traced back Pawn Storm activities to 2004. They reported, "We can trace activities of Pawn Storm back to 2004, and before our initial report in 2014 there wasn’t much published about this actor group. However, since then we have released more than a dozen detailed posts on Pawn Storm. This new report is an updated dissection of the group’s attacks and methodologies—something to help organizations gain a more comprehensive and current view of these processes and what can be done to defend against them." They also noted, "Pawn Storm is known for its sophisticated social engineering lures, efficient credential phishing, zero days, a private exploit kit, an effective set of malware, false flag operations, and campaigns to influence the public opinion about political issues."
How did Trend Micro source their claim of Pawn Storm activities to 2004? They referenced virus encyclopedia highlighting TROJ_SCONATO.A which was added to a virus database in July of 2004 but no further explanation is provided.
Interestingly, in their 2018 report they noted this link between Pawn Storm actors and a Cyber Caliphate pro-ISIS attack in 2015:
"In 2015, US Army information was released on the site cyb3rc.com by a group calling itself the Cyber Caliphate. The group presented itself as pro-ISIS and suggested that they are an Islam-inspired terrorist group. In the same year, Cyber Caliphate claimed to have taken down the live broadcast of French TV station TV5 for a number of hours. Pro-ISIS messages from the group also appeared on the Twitter and Facebook accounts of TV5. This was particularly painful for France, a country that was still in shock from terrorist attacks on the editors of Charlie Hebdo, a French satirical weekly magazine. However, it was later reported that the Cyber Caliphate was actually a front of Pawn Storm. French magazine L’Express shared indicators with us that clearly connected Cyber Caliphate to Pawn Storm, which French authorities later confirmed. The motives for the TV5 attack are still unclear. Of course, it is also possible that this attack was the work of undisciplined Pawn Storm actors. Though the Pawn Storm actors normally work in a professional way, there have been a few other incidents where some Pawn Storm actors showed a lack of discipline."
Yet, reporting close to this time in early 2015 had not (at least publicly) indicated any kind of Russian-tied element at all, but the Cyber Caliphate, or United Cyber Caliphate (UCC) were being tied to Islamic extremist hackers. Infosec was reporting in May of 2016 the following regarding ISIS capabilities:
"At the end of April 2015, the US Government announced the first attack conducted by the Cyber Command against online activities conducted by members of the ISIS. The war against the Islamic State also has cyberspace as a battlefield, for this reason, the US Cyber Command plans to run hacking operations and uses cyber weapons to destroy computer systems used by the ISIL, to destroy it functions (e.g. propaganda, economic support to militants) and to track its cyber hubs.
At the recent meeting held in Hanover, Germany, the US President Barack Obama discussed with other leaders about the cyber strategy to contrast the Islamic State online.
And towards the end of this reporting:
"Lisa O. Monaco, a deputy national security adviser, and Mr. Obama’s top adviser met technology executives at IT giants calling for action against the online activities of the Islamic State.
Track and block any activity conducted by members of the ISIS online is very hard, under the ISIS umbrella operate many pro-ISIS groups including the United Cyber Caliphate (UCC). I mentioned the UCC because a couple of weeks ago its members published online a ‘Kill List’ containing the names of 43 of US Government employees working at the Pentagon, Department of Homeland Security, State Department, and other agencies. The information disclosed includes name, phone number, city and zip code of the targets.
The members of the United Cyber Caliphate (UCC) shared the Kill List through the popular encrypted messaging app Telegram.
'Hackers with a pro-ISIS group calling themselves the United Cyber Caliphate distributed a "kill” list on Monday that appears to include dozens of U.S. government personnel, Vocativ discovered.' states the Vocative that first discovered the Kill List.
'The list features 43 names of people linked to the State Department, the Department of Homeland Security and the departments of defense, energy, commerce and health and services. It also identifies the U.S. embassies in Santiago and Kathmandu—as well as the Department of the Navy in Gulfport, Mississippi—as targets. It includes someone who appears to have worked for Australia’s Department of Defence.'”
This led to another article written by Infosec in October of 2015 regarding Cyber Caliphate declaring "electronic war" -- the same Cyber Caliphate Trend Micro has later linked to Pawn Storm, which is supposed to be the Fancy Bear group, which US intelligence agencies have linked to Russian players. This was in particular regarding attacks on the U.S. electric grid.
"In May 2015, Pro-ISIL Hackers belonging to the Cyber Caliphate hacking team threatened ‘Electronic War’ on US and Europe.
“ISIL is beginning to perpetrate cyberattacks,” explained Caitlin Durkovich, assistant secretary for infrastructure protection at the Department of Homeland Security.
Investigators revealed to CNNMoney that Islamic State have run a series of cyber attacks that have been unsuccessful. They avoided to provide further information on the attacks neither cited evidence of specific incidents.
The experts described the attacks as not particularly sophisticated, anyway they represent a serious threat to the Homeland Security. ISIL hackers use to buy hacking tools in the black markets, there is no evidence that they are developing their own “cyber weapons.”
***Keep this timeline in context in the back of your mind, this is at the time Felix Sater is about a month into discussion regarding a potential Trump Tower in Moscow working with Michael Cohen, this is while he's also only recently started assisting Arcanum Global, BTA Bank, and the government of Kazakhstan with recovering alleged stolen money by the Khrapunovs and Muhktar Ablyazov, and Cyber Caliphate had reportedly declared this "electronic war."
But Trend Micro was later reporting Cyber Caliphate as being a "front" for Pawn Storm, and Pawn Storm was associated to this spoofing "watering hole" attack which used EFF's domain.
So what else did the Trend Micro report "two years later" state about Pawn Storm or Fancy Bear? (This is later in 2018.)
"A study of ThreatConnect showed that Guccifer 2.0 approached news media and offered them exclusive access to password-protected parts of the dcleaks[.]com site. This specific site actually leaks email repositories taken from mainly US Pawn Storm targets that have been victimized by the group’s advanced Gmail credential phishing campaigns. We were able to collect a substantial amount of information on the Gmail credential phishing campaigns of Pawn Storm from 2014 onwards (as we discuss in the How Pawn Storm Attacks Free and Corporate Webmail section). This makes it very likely that Guccifer 2.0 is a creation of the Pawn Storm actor group. (bolded for emphasis)
Meanwhile, WikiLeaks, which has dubbed itself a “multi-national media organization and associated library”, published emails from the DNC and the AK party of Turkish President Erdogan in 2016. We know that the DNC received a wave of aggressive credential phishing attacks from Pawn Storm in March and April 2016: during the campaign, dozens of politicians, DNC staff, speech writers, data analysts, former staff of the Obama campaign, staff of the Hillary Clinton campaign, and even corporate sponsors were targeted multiple times. Pawn Storm also used phishing campaigns against the Turkish government and parliament in early 2016. This makes it highly plausible that the emails published by WikiLeaks were originally stolen by the Pawn Storm actor group."
Further down they did highlight the first Russian angle, being that some Russians were also targeted:
"It is very likely that from July 2015 to August 2016, Pawn Storm had access to the Gmail account of Colin Powell, former United States Secretary of State under the George Bush administration. In September 2016, more than one year after the initial compromise, dcleaks[.]com posted several of his personal emails online. This was just one of the many examples where Pawn Storm leaked confidential information, and it shows that some of the compromises span a lengthy period. Russian citizens—journalists, software developers, politicians, researchers at universities, and artists— are also targeted by Pawn Storm.13 Several Russian media organizations (including mainstream media corporations) and foreign embassies in Moscow are common targets too.
Pawn Storm has maintained long-running campaigns against high profile users of free international webmail providers like Yahoo and Gmail; as well as webmail providers for Ukrainian internet users (Ukr. net), and Russian users (Yandex and Mail.ru). Pawn Storm sets up phishing sites of other free webmail providers for very specific targets only. We found Pawn Storm phishing domains for relatively small webmail providers in Cyprus, Belgium, Italy, Norway, and other countries. Users of university webmail in Estonia and Russia were targeted as well. These were probably part of tailored attacks where Pawn Storm had very specific and high profile targets in mind. The credential phishing attacks against high profile Google, Yahoo and Ukr.net users are relatively voluminous. We were able to collect thousands of phishing emails since early 2015. It was not continuous. Pawn Storm sometimes paused activities, which they but then later on resumed. Some targets get multiple phishing emails in one week."
This Trend Micro report contained a nice summary timeline of Pawn Storm or Fancy Bear political targeted countries:
***Note Felix Sater has ties to Turkish players like Fettah Tamince (through Rixos and Sembol Construction and Sater's advisor role to Tamince being the Chairman of both these companies), Tamince has been linked to Erdogan, as well as the untold (perhaps never told) story regarding Gen. Michael Flynn, Gulen, Erdogan, and some kind of kidnapping plot. So it's hard not to wonder why these were the central political targets for Pawn Storm?***
A believed-and-reported Pro-ISIS group had become established as a "front" for the Russian-linked Fancy Bear between 2015 and 2016 and this was not made into a bigger deal, but it seems like maybe it should have been. This change in attribution from pro-ISIS hackers to Russian hackers was based on evidence which still isn't clear to the common non-technical observer.
At the Black Hat conference in 2016, EFF's focus in their presentation on APT28 / Pawn Storm / Fancy Bear and the spoofing of their EFF domain being used in a "watering hole" attack by actors associated to Pawn Storm or Fancy Bear transitioned right into nation-state tools being sold to the country of Kazakhstan by the Hacking Team company based in Italy.
Not much time at all was spent on this Pawn Storm topic and its relation to EFF before the focus of their presentation was Kazakhstan and their use of procured hacking tools through companies like Hacking Team and FinFisher.
Moving promptly to Operation Manul, as they called it, they noted there was a government order issued by Kazakhstan in December of 2015 mandating all citizens to install a root-cert on their computers so the only telco in the country could man-in-the-middle all SSL traffic. This of course caused "an enormous outcry in the tech community" but nothing ended up happening. The government of Kazakhstan ended up retracting their order within a few days.
The EFF presenters go on to show maps highlighting Kazakhstan FinFisher spyware use on a map, as well as a similar map for Hacking Team RCS.
EFF did not show any presence of Hacking Team or FinFisher in the USA on either of these maps shown, but the majority of Hacking Team servers were in both the USA and Kazakhstan.
They touched on a website Kazaword which had went live on August publishing caches of leaked documents and emails. These leaks indicated a business relationship where Arcanum Global Intelligence was working with the government of Kazakhstan/BTA Bank as their client. They had been hired to be the eyes and ears for Kazakhstan in Switzerland where the Khrapunov family had fled. Arcanum's operations were described as a "spying and data extraction campaign."
EFF represented a journalist who had lived in Kazakhstan and reported news about corruption within the country since 2001, but after their newspaper's offices were firebombed, had moved to Russia and moved the paper to an online platform. The 2015 case was debated in New York City courts. EFF's involvement in this legal case was their foot in the door towards looking at what the government of Kazakhstan was doing as far as spying and intimidation. This journalist began receiving some weird emails. This would be the Operation Manul part of all of this. EFF observed both JRat and Jacksbot as the two types of malware found in phishing emails being sent to her and is multi-platform. They also observed Bandook which is only capable of targeting Windows.
In late September of 2017, the Financial Times (FT) reported for the first time the fact Ablyazov had met with Ron Wahid at least one time in 2009 when all of this had really kicked into gear, but Ablyazov had suspected his private intelligence firm, Arcanum Global, was already working for BTA Bank. And Wahid confirmed to FT Ablyazov was correct in his suspicion.
Their article was titled 'Spies, lies and the oligarch: inside London's booming secrets industry' and detailed how "Kazakhstan has made a disproportionately large contribution to the private intelligence industry." Two private investigators who had worked on Kazakh dossiers were quoted in this reporting saying, "At one point, literally everyone I know in London was working on Kazakhstan,” and the other saying the money coming in from the former Soviet Union "helped to make the private intelligence game in London 'very dirty'.”
Wahid was described as liking "to show off his political connections," and hinting he had worked with U.S. intelligence agencies before 2006 when he had established Arcanum Global. "Superstar spies" are reported as having graced Arcanum's board, including the former head of Mossad, Meir Dagan.
Kazakhstan was reported as "a resource-rich Central Asian expanse of nomads and billionaires that forms a strategic fulcrum between Russia and China" and Wahid as reportedly knowing "everybody in the Kazakh elite."
One of the most important excerpts of this entire article explained, "For handsome fees, teams from this largely unregulated industry will set about the extraction, dissemination and, sometimes, manipulation of information to serve a client’s agenda and target that client’s enemies — enemies who have, often, assembled a similar team of their own."
SUSPICIOUS ACTIVITY REPORTS (SARs) REGARDING FELIX SATER
In the fall of 2020, Buzzfeed News reported as part of an investigative series regarding SARs which were leaked to one of their journalists, Felix Sater had been flagged by banks during these four years but never questioned by anyone officially regarding any of them. What was noteworthy regarding this reporting which came well after the Mueller Report findings were published was the fact in an August 2019 Buzzfeed article, they had reported sources stating Felix Sater had continued his cooperation "until at least late 2017."
Their exact reporting was, "The government makes clear that Sater was not exaggerating about his extensive cooperation with US agencies, which began before his involvement in real estate development with the Trump Organization and continued, according to Sater and law enforcement sources, until at least late 2017."
Yet they reported over a year later on these SARs regarding Felix Sater sent between 2013-2017 by multiple banks noting, "Report after report filed to the Treasury Department — each of which was accessible to his FBI handlers and other law enforcement investigators — shows Sater and his companies behaving suspiciously. Sater said no one from the FBI ever questioned him about his financial dealings."
Various other parts of this Buzzfeed News reporting are sourced throughout this page referencing when the actual flagged transaction by each bank occurred between 2013-2017.
BTA BANK, CITY OF ALMATY LAWSUIT FILED AGAINST SATER, OTHERS
BTA Bank, City of Almaty lawsuit filed against Felix Sater and other parties.
The Associated Press (AP) a few days later published a correction to their reporting which clarified an important detail distinguishing Bayrock Group Inc. and Bayrock Group LLC.
They explained, "In a story March 26 about Felix Sater, an associate of President Donald Trump, The Associated Press erroneously reported the name of a company named in a lawsuit against Sater. The company that was sued is Bayrock Group Inc., which is owned by Sater, not Bayrock Group LLC, a real estate company founded by Tevfik Arif where Sater was an executive.
Further down they reported, "Sater and two other people are named as defendants, along with five companies. They include Bayrock Group Inc., a company owned by Sater that is separate from Bayrock Group LLC, the real estate company founded by Tevfik Arif where Sater worked as an executive. Bayrock Group LLC is not a defendant in the lawsuit."
KAZAKH ANTI-CORRUPTION SITE KIAR LINKS
BIDEN FAMILY TO KAZAKHSTAN
In November of 2019, in the early months of the 2020 election, the Kazakhstan Initiative on Asset Recovery, or KIAR, linked Hunter Biden to Kazakhstan players, as well as Ukraine. For the first time ever, a picture of Joe Biden, Hunter Biden, along with Karim Massimov and Kenes Rakishev was shown to anyone who was paying attention. The picture was undated at the time, as well as the location the picture was taken being an unknown detail. But what we do know is Hunter Biden was likely on the board of the Burisma energy company in Ukraine at the time the photograph was taken.
(From far left: Kenes Rakishev, Hunter Biden, Joe Biden, Karim Massimov)
KIAR reported Hunter Biden was also on the board of the Kazakh company, Burisma Kazakhstan, and was receiving payments from them while sitting on the Burisma board as his father was then Vice President of the United States and in charge of Ukraine-US policy during this time. They reported it was Karim Massimov who met with Burisma leaders in Astana, and instructed KazMunaiGas to establish a joint-venture with Burisma. KIAR specifically asked the question "What for?" and wrote, "Is it not so that you can legally pay American politicians? This is the money that Kazakh oil workers and their families did not receive …" as well as stating "There’s $145,000 from the son of the former prime minister of Kazakhstan, which is of course a highly corrupt country with all sorts of interesting implications.”
They offered to help support American media investigate this further. But the Trump impeachment hearings over Ukraine were kicking into full gear this time. Here's that timeline for additional context. KIAR printed their reporting on November 26.
In October of 2020, Buzzfeed News published the earlier-referenced article regarding Suspicious Activity Reports, or SARs, which had named Felix Sater between 2013-2017. In this reporting Sater is stated as saying "all the transactions were legitimate and that he had not laundered money. He said he believes the banks kept a particularly close watch on him because of his past financial crimes and his role in the special counsel’s investigation." However, the Special Counsel investigation didn't begin until May of 2017, so it's unclear what was meant by this because it doesn't explain why banks were finding any of his transactions suspicious between 2013-2016. Nor are SARs automatically any indication criminal activity such as money laundering even occurred, nor should it assume his FBI handlers weren't informed at the time. They may have been informed and been well aware of what the transactions were for, and there was no further action ever needed. We simply just do not know.
Another longer excerpt from this Buzzfeed reporting:
"As part of the election inquiry, the Senate Intelligence Committee asked FinCEN to provide reports on Sater and accounts he controlled dating back to 2012. Like other documents in the FinCEN Files, these reports reveal how suspicious payments crisscross the globe — and also how little banks do to stop them.
Take Wells Fargo, which took four years to alert the US government about suspicious transactions on its books. By the time it sent a report to the Treasury Department, Sater, his associates, and their companies had used the bank to move $16 million in transactions for real estate projects — a shopping center in Cincinnati and another in Syracuse, New York — that both went bust.
Court records claim that one of the companies, Tri-County Mall Investors, purchased the Cincinnati property on behalf of Viktor Khrapunov, the former mayor of Almaty, Kazakhstan’s largest city, and Mukhtar Ablyazov, the former chair of a Kazakh bank, BTA. Both men were convicted in absentia in Kazakhstan: Khrapunov for looting the city and Ablyazov for an elaborate embezzlement scheme."
This 2020 reporting further complicated the prior 2018 and 2019 reporting from the same two Buzzfeed News reporters, Jason Leopold and Anthony Cormier, who had prior to this told their readers Sater was a prized informant for not only the FBI, but multiple U.S. intelligence agencies, given the nickname "Quarterback," and had cooperated per their own reporting, from assisting the Defense Intelligence Agency (DIA) in 1997 (before the gym locker with the documents regarding the stock scam was even opened in 1998) all the way up until at least late 2017.
This was also substantiated by Felix Sater's own transcript from late 2017 for the Special Counsel investigation and released for the public before Buzzfeed published this article. In the DNI dump of transcripts in May of 2020, Felix Sater clearly stated [p.6], "Understanding the gravity of my actions, for the better part of the next 20 years, I provided extraordinary assistance to our government involving serious matters of national security posing tremendous risk to my life and the safety of my family."
MORE DETAILS SURFACE OF 2015 BIDENS-KAZAKHS DINNER AND A PHOTO
In May of 2021, the New York Post who was temporarily banned from Twitter for reporting on the infamous Hunter Biden laptop because Twitter regarded it as hacked materials, published the following new information regarding the Spring 2015 dinner and photo related to the Bidens with very little attention given by the rest of the media to it.
The New York Post reported:
"The dinner, on April 16, 2015, was held in the private 'Garden Room' at Café Milano, a Georgetown institution whose catchphrase is: 'Where the world’s most powerful people go.'
The next day, Hunter received an email from Vadym Pozharskyi, an executive of the Ukrainian energy company Burisma, to thank him for introducing him to his father.
'Dear Hunter, thank you for inviting me to DC and giving an opportunity to meet your father and spent [sic] some time together,' Pozharskyi wrote on April 17, 2015.
'It’s realty [sic] an honor and pleasure.'
At the time, Burisma was paying Hunter $83,333 a month to sit on its board.
The guest list prepared by Hunter three weeks before the Café Milano dinner included Russian billionaire Yelena Baturina and her husband, corrupt former Moscow mayor Yury Luzhkov, who since has died. Baturina wired $3.5 million on Feb. 14, 2014, to Rosemont Seneca Thornton LLC, a Delaware-based investment firm co-founded by Hunter and Devon Archer, a former adviser to Secretary of State John Kerry.
The wires were flagged in suspicious activity reports provided by the Treasury to a Senate Republican inquiry into Hunter last year by the Homeland Security and Governmental Affairs Committee.
Hunter told guests before the dinner that his father would be attending. In one email, he appears to use his role on the board of World Food Program USA as a cover story for the evening’s true purpose of introducing his father to his business associates.
'Ok – the reason for the dinner is ostensibly to discuss food security,' writes Hunter on March 26 to Michael Karloutsos, son of the then-head of the Greek Orthodox Church.
'Dad will be there but keep that between us for now. Thanks.'
Karloutsos replies: 'Everything is between us. All good! … I know you mentioned your dad would probably join the dinner as well.'
The dinner raises questions about how much Joe Biden, who has claimed ignorance of his son’s activities, knew about Hunter’s dealings with foreign businesses and government officials.
Three officials from Kazakhstan also were invited to the Café Milano dinner, including Marc Holtzman, then chairman of the former Soviet republic’s largest bank, Kazkommertsbank.
It is also worth noting further down in the Post article they report Hunter had described Massimov in another email as a "close friend."