Wednesday, August 26, 2026

Final Defendant in Nationwide Marijuana and THC Trafficking Organization Pleads Guilty in New York

 

Organization Shipped Over 15,000 Pounds of Marijuana from California to New York's Capital Region and Laundered Millions of Dollars in Drug Proceeds

Dwight A. Singletary II, aka “Nutt” and “Mike Jones,” age 44, of Fresno, California and Troy, New York, pled guilty August 25, 2026, to leading a nationwide marijuana and THC trafficking organization that shipped thousands of kilograms of marijuana from Fresno to locations throughout the United States, including the Capital Region.  Singletary is the 25th and final defendant to plead guilty in the case.  

Starting in 2016, Singletary and other members of the organization shipped marijuana and THC from a shipping store in Fresno, Fast Pack & Ship, to recipients throughout the United States, including the Capital Region, New York City, and other parts of New York, Alabama, Connecticut, Delaware, Florida, Georgia, Louisiana, Maryland, Massachusetts, Missouri, Nevada, New Jersey, North Carolina, Ohio, Oklahoma, South Carolina, Tennessee, Texas, and Virginia.  Fast Pack & Ship was initially owned by Sammy Olague, who sold the store to Nehemiah Fane, aka “Neil,” in June 2018.  Singletary helped finance the purchase, and Fane ran the store with James Tyrell Daniels, aka “Red” and “Ghost,” and Ruby Ledesma before transferring it to the mother of Singletary’s children, McKenzie Merrialice Coles, aka “Kenzie,” in April 2020.  Coles, who is originally from Troy but lived with Singletary in Fresno, operated Fast Pack & Ship through M.M.M.C. Management, Inc.  Singletary, Coles, Fane, Daniels, Olague, Ledesma and other members of the organization all shipped marijuana from Fast Pack & Ship.  

The packages of marijuana, which were shipped through UPS and FedEx, reflected the names of fake shippers, and the marijuana was concealed in dog food containers and luggage.  To avoid detection, the packages of marijuana were often sealed with eBay packing tape.  Between April 2017 and June 2022, approximately 1,292 packages containing 7,068 kilograms, or 15,582 pounds, of marijuana were shipped from Fast Pack & Ship to the Capital Region alone.  

“This guilty plea marks the final defendant held accountable in a sophisticated, nationwide drug trafficking organization that moved more than 15,000 pounds of marijuana from California into the Capital Region and communities across the country,” stated DEA New York Enforcement Division Special Agent in Charge Farhana Islam. “For years, this organization attempted to conceal its criminal enterprise by disguising drug shipments in dog food containers and luggage, using our nation’s commercial shipping system to move thousands of pounds of marijuana, and laundering millions of dollars in drug proceeds through cash couriers, financial transactions and real estate. The DEA and our law enforcement partners have and will always continue to relentlessly pursuit drug trafficking organizations at every level; from its leadership and suppliers to its distributors and those responsible for laundering its profits.”

“With this final guilty plea, my office has now brought 25 defendants to justice for their roles in this criminal enterprise,” said First Assistant U.S. Attorney John A. Sarcone III. “These individuals operated a large-scale illegal marijuana and THC trafficking scheme, moving their illicit product across the country and into the Capital Region. As if flooding the community with unregulated, illegal drugs weren’t harmful enough, they also sought to launder millions of dollars in illegal profits. Thanks to the collaboration of our law enforcement partners across the country, their scheme was disrupted, and justice has been delivered to all 25 defendants.”

ATF New York Special Agent in Charge Bryan DiGirolamo said, “This guilty plea closes the chapter on a sprawling criminal organization that moved thousands of kilograms of marijuana and THC across the country and into communities throughout New York’s Capital Region. This network relied on concealed shipments, knock spots and, in some instances, firearms to facilitate and protect its illegal drug trafficking activities. Holding the 25th and final defendant accountable reflects years of determined investigative work and the strength of the partnerships that brought this organization down. ATF NY Albany is proud to have worked alongside HSI, DEA, the Troy Police Department and the U.S. Attorney’s Office for the Northern District of New York to dismantle this network and hold those responsible accountable.”“This investigation is a strong example of the importance of law enforcement agencies working together to address complex criminal activity. Our task force officer’s involvement reflects this department’s commitment to supporting our federal law enforcement partners. We are proud of the work our detective contributed to this investigation. Strong partnerships and interagency cooperation are critical to keeping our communities safe and holding those responsible for criminal activity accountable,” said Troy Chief of Police Daniel DeWolf 

HSI Buffalo Acting Special Agent in Charge Anthony Patrone said, “Dwight Singletary led a coast-to-coast marijuana and THC trafficking organization that, for years, shipped more than 15,000 pounds of marijuana to the Capital Region alone using fake shipper names, dog food containers, luggage, and other methods designed to hide the crime. This investigation exposed the full scope of the operation, from packaging and shipment in Fresno, to street-level ‘knock spot’ sales in New York, to the laundering of millions of dollars in drug proceeds through cash couriers, cashier’s checks, business accounts, real estate, and luxury assets. As the 25th and final defendant, Singletary’s guilty plea marks a decisive end to this organization and demonstrates how sustained collaboration among federal, state, and local law enforcement partners protects the public from sophisticated criminal networks.”

The packages of marijuana were received by numerous members of the organization in the Capital Region, including Coles’ mother, Rosemary Coles; Coles’ cousins, Isiah Ti-Quan Clements, aka “Zay, and LaFay Pearson, aka “Lala”; and Coles’ aunts and uncle, Consanga Harris, aka “Sondy,” June Allyson Osman, aka “Juney,” and Victor Turner.  Other recipients in the Capital Region included Lawrence Mumphre, aka “L,” Deandre Caldwell, aka “Dilli,” “Dillinger,” and “Dre,” Tyquan Armstrong, aka “Moose,” Niara Banks, aka “Nie,” Toqwanda Ketchmre, aka “Quannie,” and Jazell Shuler.  The recipients were paid between $300 and $400 per package received, and the packages were often picked up by Singletary’s brother, David Singletary, aka “DB,” who managed the organization’s operations in the Capital Region and received packages of marijuana at his apartment in Cohoes.  

Lateek White and Onisha Smith, who are brother and sister, received packages of marijuana shipped from Fast Pack & Ship in Brooklyn, New York, and their uncle, Earnest Flood, aka “Pop,” received packages of marijuana in Richmond, Virginia.  

In addition to selling bulk marijuana, Singletary, David Singletary, Mumphrey, and other members of the organization sold marijuana and THC out of “knock spots” in the Capital Region.  The “knock spots” advertised various strains and quantities of marijuana and THC “edibles” for sale, with prices, on white boards.  To make a purchase, customers knocked on the door, requested a particular strain of marijuana or type of THC edible, and exchanged cash for the marijuana or THC edibles, or both, through a slot in the door.  

In searching one of the “knock spots” at 2657 5th Avenue, Troy, New York, pursuant to a warrant on January 10, 2022, law enforcement encountered Mumphrey, who ran the day-to-day operations of the “knock spot,” and discovered approximately 29 pounds of marijuana packaged for distribution in several plastic shelves with sticky notes denoting the strain and price of the marijuana; digital scales; a large safe with a bulletproof vest; a dogfood container with strains of marijuana and dollar amounts written on the side; and a box shipped from Fast Pack & Ship to Mumphrey at his home in Albany.  A surveillance system with footage from January 5 to 10, 2022, depicted Singletary and David Singletary at the “knock spot” on three days and Mumphrey at the “knock spot” all five days.  A total of approximately 280 marijuana sales through the door to the “knock spot” were made over the course of the five days.  

On June 15, 2022, law enforcement simultaneously executed five search warrants in Fresno and 12 search warrants in the Capital Region.  Singletary and Coles owned two adjacent homes at 5636 and 5371 West Acacia Avenue, Fresno, California, and lived together in 5371 West Acacia Avenue.  In searching 5636 West Acacia Avenue, which was used by Singletary to store and package marijuana, law enforcement discovered a total of approximately 118 kilograms, or 260 pounds, of marijuana in black plastic bags throughout the house.  The home, which was unfurnished besides a couch and television, also contained stacks of unused brown shipping boxes; six spindles of plastic wrap; large bags of packing peanuts; eight rolls of eBay packing tape; digital and commercial scales; plastic bags for vacuum sealing and three vacuum sealers; several packages of locks; and at least five plastic dogfood containers and four pieces of luggage, which were used to ship marijuana.  

In searching Singletary’s and Coles home at 5371 West Acacia Avenue, law enforcement seized, among other things, over $1.2 million worth of watches, jewelry, and designer bags, belts, and shoes along with a loaded Glock Model 23 .40 caliber pistol.  

Before purchasing 5636 and 5371 West Acacia Avenue, Singletary and Coles lived in another home in Fresno, where Coles photographed Singletary packaging marijuana for shipment:

Singletary packaging marijuana for shipment

In addition to purchasing and reselling bulk marijuana, Singletary worked with Daniels to cultivate marijuana on a commercial scale at a warehouse on Van Ness Avenue in Fresno.  In searching the warehouse, law enforcement discovered 424 marijuana plants at various stages of maturity in five commercial grow rooms with fans, air conditioning, and grow lights.  Outside the warehouse itself, in the front entrance to the building and in an office off the front entrance, law enforcement discovered six plastic bags containing four pounds of processed marijuana buds; two digital scales; a money counter; a plastic dogfood container; luggage; shipping peanuts; and eBay packing tape.  Footage from a surveillance system at the warehouse showed Daniels tending to the marijuana plants and bringing supplies into the warehouse with Singletary.   

In searching David Singletary’s apartment in Cohoes, law enforcement discovered and seized, among other things, 29 vacuum-sealed packages of marijuana weighing approximately 19 kilograms and labeled, among other things, “GMO,” “Mimosa,” “Gary Payton,” “#45,” and “Gumbo 3A,” a dogfood container with ten clear knotted plastic bags each containing approximately one pound of marijuana, a clear plastic bag containing marijuana next to a scale on the kitchen counter, a gun box with 11 rounds of .40 caliber Winchester ammunition in a 12-round magazine, a money counter, a vacuum sealer,  jewelry worth over $30,000, and $14,552 in cash.  

“Nutty Pack” emblem

To promote the marijuana trafficking organization, Coles created an Instagram account in the name nutty_packz, and in searching David Singeltary’s apartment, law enforcement discovered marijuana packaging materials with the “Nutty Pack” emblem.

In searching Mumphrey’s home in Albany, which he shared with his wife, Latrice Mumphrey, law enforcement discovered a backpack containing two plastic bags of marijuana with “41 Cherries” and “Dulce De Leche” written on the side.  A locked room in the basement contained a plastic dogfood container with “41 Cherries $3,600,” “Dulce De Leche $3,800,” and “12 Lows $700” written on the side and with eight bags of marijuana weighing approximately one pound apiece.  The locked room also contained a suitcase with four firearms—a Ruger model AR-556 5.56x45mm caliber semiautomatic rifle, 5.56x45mm caliber semiautomatic rifle, Anderson model AM-15 5.56x45mm caliber semiautomatic rifle, and Taurus 9mm caliber pistol—and assorted ammunition. 

Caldwell’s apartment in Albany contained marijuana, THC edibles, digital scales, boxes from Fast Pack & Ship, $15,941 in cash drug proceeds, and a .380 caliber handgun.  Armstrong’s apartment in Rotterdam contained seven vacuum-sealed packages of marijuana weighing 10 pounds; two money counters; and $18,723 in cash.  The apartment also contained a loaded .357 revolver, a loaded .22 caliber “ghost gun,” and 125 rounds of .357 ammunition.

The search warrants did not deter Singletary, David Singletary, and other members of the organization and they continued to traffic marijuana, including out of the “knock spot” at 2657th Avenue.  In searching 2657th Avenue a second time on November 11, 2022, law enforcement discovered prepackaged marijuana, a loaded Taurus G2C 9mm handgun, and paperwork in David Singletary’s name.

After the search, Singletary and David Singletary moved the “knock spot” to an apartment next door at 2655 5th Avenue, Troy, New York, which was searched pursuant to warrant on January 4, 2023.  A whiteboard offering marijuana for sale was outside the door to 2655 5th Avenue, which had a slot used to exchange marijuana for money.  The same day, law enforcement executed a second search warrant at David Singletary’s apartment in Cohoes, which contained approximately 74 pounds of marijuana in vacuum-sealed packages.  

The marijuana and THC trafficking generated millions of dollars in revenue, which Singletary and other members of the organization laundered through a variety of means.  David Singletary routinely gave other members of the organization, including Clements and Kristle Walker, aka “Demii,” locked suitcases containing well over $150,000 in cash marijuana and THC proceeds.  Walker and Clements then separately flew from Albany to Fresno, where they delivered the cash to Singletary and Coles.  In July 2020, Walker attempted to board a flight from Albany to Fresno with a suitcase containing $179,710 in cash drug proceeds, which was seized by law enforcement.  The cash belonged to Singletary, but in seeking return of the cash from the DEA, Walker falsely claimed ownership.    

Federal law requires financial institutions to complete a currency transaction report for cash transactions over $10,000.  At Singletary’s direction, Walker, Clements, Banks, Mumphrey, Latrice Mumphrey, and another member of the organization, Alyssa June White, purchased multiple cashier’s checks in amounts slightly below the reporting threshold for cash transactions of over $10,000, but amounting to over $10,000 in total, oftentimes at different banks and branches on the same day.  The cashier’s checks were payable to Singletary; his company, DAS Empire, Inc.; his real estate law firm; a company from which he and Coles purchased real estate; and to a person from whom Singletary and DAS Empire purchased real estate.  

Singletary, at times through DAS Empire, purchased and renovated several properties in the Capital Region with marijuana proceeds.  He used the cashier’s purchased with cash marijuana proceeds to pay for the properties, and paid contractors renovating the properties with cash marijuana proceeds.  In 2021, Singletary and Coles used $430,000 and $390,000 in marijuana proceeds to purchase 5363 and 5371 West Acacia, respectively.  The purchase price was paid through, among other means, cashier’s checks purchased with marijuana proceeds.  

To make the marijuana proceeds appear like legitimate business income, members of the organization deposited hundreds of thousands of dollars in cash marijuana proceeds into accounts held by Coles in the name of her company, M.M.M.C. Management, and into business accounts held by Fane, who was previously employed as a banker but fired for money laundering.  At Singletary’s directions, members of the organization—including Walker, Clements, and Shuler—sent over $103,000 in money transfers purchased with cash marijuana proceeds in the Capital Region to Fane and others in and around Fresno.  

Law enforcement forfeited a total of over $2.53 million in cash, vehicles, jewelry, real property, and other assets from Singletary and other members of the organization.

Singletary faces at least 10 years and up to life in prison on the two counts to which he pled guilty, conspiring to distribute marijuana and conspiring to commit money laundering; fines of up to $10.25 million; and a term of supervised release of between five years and life.  His plea agreement with the government calls for a sentence of 10- to 20-years imprisonment.  If the court rejects the plea agreement, Singletary will be permitted to withdraw his plea.  A defendant’s sentence is imposed by a judge based on the particular statute the defendant is charged with violating, the U.S. Sentencing Guidelines and other factors.

In addition to Singletary, 24 other defendants have pled guilty.  The following defendants pled guilty to the following charges and received the following sentences:

Defendant 

Charge(s) 

Sentence 

James Tyrell Daniels, aka “Red” and “Ghost,” age 42, of Fresno 

Two counts: (i) conspiracy to manufacture, distribute, and possess with intent to distribute marijuana, and (ii) conspiracy to commit money laundering 

180 months imprisonment 

Lawrence Mumphrey, aka “L,” age 47, of Albany 

Three counts: (i) conspiracy to manufacture, distribute, and possess with intent to distribute marijuana and THC, (ii) possession of firearms in furtherance of a drug trafficking crime, and (iii) conspiracy to commit money laundering 

156 months imprisonment 

Deandre Caldwell, aka “Dilli,” “Dillinger,” and “Dre,” age 34, of Albany 

Two counts: (i) conspiracy to manufacture, distribute, and possess with intent to distribute marijuana and THC, and (ii) possession of a firearm in furtherance of a drug trafficking crime 

97 months imprisonment  

Tyquan Armstrong, aka “Moose,” age 47, of Rotterdam 

Three counts: (i) conspiracy to distribute and possess with intent to distribute marijuana, (ii) possession with intent to distribute marijuana, and (iii) possession of firearms in furtherance of a drug trafficking crime 

90 months imprisonment 

Toqwanda Ketchmore, aka “Quannie,” age 32, of Troy 

One count: conspiracy to manufacture, distribute, and possess with intent to distribute marijuana 

24 months imprisonment 

Earnest Flood, aka “Pop,” age 68, of Richmond, Virginia 

Two counts: (i) conspiracy to manufacture, distribute, and possess with intent to distribute marijuana, and (ii) conspiracy to commit money laundering 

Time served  

JuneAllyson Osman, aka “Juney,” age 61, of Troy 

One count: conspiracy to manufacture, distribute, and possess with intent to distribute marijuana 

Two years’ probation 

The following defendants pled guilty to the following charges, face the following sentences, and are awaiting sentencing:  

Defendant 

Charge(s) 

Potential Sentence 

McKenzie Merrialice Coles, aka “Kenzie,” age 39, of Fresno 

Two counts: (i) conspiracy to manufacture, distribute, and possess with intent to distribute marijuana and THC, and (ii) conspiracy to commit money laundering 

At least 10 years and up to life imprisonment (if accepted by the court, the plea agreement calls for sentence of up to 20 years imprisonment)  

Nehemiah Fane, aka “Neil,” age 44, of Fresno 

Two counts: (i) conspiracy to manufacture, distribute, and possess with intent to distribute marijuana, and (ii) conspiracy to commit money laundering 

Maximum sentence of 40 years imprisonment 

Sammy Olague, age 39, of Fresno 

One count: conspiracy to manufacture, distribute, and possess with intent to distribute marijuana 

At least 5 years and up to 40 years imprisonment 

Ruby Ledesma, age 28, of Fresno 

One count: conspiracy to manufacture, distribute, and possess with intent to distribute marijuana 

Maximum sentence of 20 years imprisonment 

David Singletary, aka “DB,” age 40, of Cohoes 

One count: conspiracy to manufacture, distribute, and possess with intent to distribute marijuana 

At least 10 years and up to life imprisonment (if accepted by the court, plea agreement calls for sentence of at least 10 years and up to 18 years imprisonment) 

Isiah Ti-Quan Clements, aka “Zay,” age 39, of Troy 

Two counts: (i) conspiracy to manufacture, distribute, and possess with intent to distribute marijuana and THC, and (ii) conspiracy to commit money laundering 

At least 10 years and up to life imprisonment 

Latrice Mumphrey, age 45, of Albany 

One count: conspiracy to commit money laundering  

Maximum sentence of 20 years imprisonment 

Rosemary Coles, age 74, of Troy 

One count: conspiracy to manufacture, distribute, and possess with intent to distribute marijuana and THC 

At least 10 years and up to life imprisonment 

Kristle Waler, aka “Demii,” age 42, of Albany 

Two counts: conspiracy to commit money laundering and false statements  

Maximum sentence of 25 years imprisonment 

Niara Banks, aka “Nie,” age 34, of Troy 

Two counts: (i) conspiracy to manufacture, distribute, and possess with intent to distribute marijuana and THC, and (ii) conspiracy to commit money laundering 

Maximum sentence of 40 years imprisonment 

Jazell Shuler, age 38, of Troy 

Two counts: (i) conspiracy to manufacture, distribute, and possess with intent to distribute marijuana, and (ii) conspiracy to commit money laundering 

Maximum sentence of 40 years imprisonment 

Victor Turner, age 72, of Troy 

One count: conspiracy to manufacture, distribute, and possess with intent to distribute marijuana 

Maximum sentence of 20 years imprisonment 

LaFay Pearson, aka “Lala,” age 25, of Troy 

One count: conspiracy to manufacture, distribute, and possess with intent to distribute marijuana 

Maximum sentence of 20 years imprisonment 

Consanga Harris, aka “Sondy,” age 65, of Troy 

One count: conspiracy to manufacture, distribute, and possess with intent to distribute marijuana 

Maximum sentence of 20 years imprisonment 

Alyssa June White, age 33, of Troy 

One count: conspiracy to commit money laundering 

Maximum sentence of 20 years imprisonment 

Onisha Smith, age 43, of Brooklyn 

Two counts: (i) conspiracy to manufacture, distribute, and possess with intent to distribute marijuana, and (ii) conspiracy to commit money laundering 

Maximum sentence of 40 years imprisonment 

Lateek White, age 55, of Brooklyn 

Two counts: (i) conspiracy to manufacture, distribute, and possess with intent to distribute marijuana, and (ii) conspiracy to commit money laundering 

At least 10 years and up to life imprisonment 

The DEA, ATF, Troy Police Department, and HSI investigated the case, with critical support from U.S. Attorney’s Office Financial Investigator Justus Derx.  Assistant U.S. Attorneys Cyrus P.W. Rieck, Dustin C. Segovia, and Nicholas Walter are prosecuting the case.  

This case is part of the Homeland Security Task Force (HSTF) initiative established by Executive Order 14159, Protecting the American People Against Invasion. The HSTF is a whole-of-government partnership dedicated to eliminating criminal cartels, foreign gangs, transnational criminal organizations, and human smuggling and trafficking rings operating in the United States and abroad. Through historic interagency collaboration, the HSTF directs the full might of United States law enforcement towards identifying, investigating, and prosecuting the full spectrum of crimes committed by these organizations, which have long fueled violence and instability within our borders. In performing this work, the HSTF places special emphasis on investigating and prosecuting those engaged in child trafficking or other crimes involving children. The HSTF further utilizes all available tools to prosecute and remove the most violent criminal aliens from the United States. 

Justice Department and FBI Seize Platforms Operated and Used by China State-Sponsored Hackers to Target U.S. Critical Infrastructure


The Justice Department and FBI announced court-authorized domain seizures today to deny malicious cyber actors access to two complementary hacking platforms known as “QScan” and “QTRouter,” used to target U.S. critical infrastructure and other sensitive networks. As described in court documents unsealed in the Southern District of California, a People’s Republic of China (PRC) state-sponsored group known as “QTFY,” employed by China-based Nanjing Xinjiuwei Network Technology Company (南京鑫玖维网络科技有限公司), created and operated QScan and QTRouter. Among the victims of QTFY computer intrusion activity are the National Aeronautics and Space Administration, Federal Reserve, Department of Energy, Department of Justice, Department of Health and Human Services, National Institutes of Health, and the U.S. Senate.

“State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted. We are here to ensure security for the American people and will use every tool we have to keep that promise,” said Attorney General Todd Blanche. “Federal law enforcement investigated and disabled the PRC’s malicious software, the latest in a series of technical operations to dismantle indiscriminate hacking activities sponsored by the People’s Republic of China.”

“Today we announced the disruption of a global botnet and hacking platform used by Chinese state-sponsored hackers to target U.S. critical infrastructure,” said FBI Director Kash Patel. “These tools were used by PRC cyber actors to hide the origin of their attacks. Thanks to the work of FBI San Diego, FBI Cyber Division, and DOJ partners, we seized adversary infrastructure and shut these platforms down. Today’s action is just the latest technical operation against PRC-sponsored hacking - and in support of President Trump’s Cyber Strategy for America, the FBI is surging efforts to shape adversary behavior and defend the homeland in cyberspace.” 

“Today’s announcement demonstrates the Justice Department’s steadfast commitment to going on the offensive against cyber threats to the national security,” said Assistant Attorney General for National Security John A. Eisenberg. “These court-authorized seizures deny PRC-linked hackers access to tools they use to mount online attacks against our Nation’s critical infrastructure.” 

“We’re taking the fight to PRC sponsored cybercriminals to protect the critical services Americans rely on every day,” said U.S. Attorney Adam Gordon for the Southern District of California. 

“The FBI remains relentless in our efforts to counter nation state cyber actors, taking decisive action against those threatening the United States and our critical infrastructure,” said Special Agent in Charge Mark Remily of the FBI San Diego Field Office. “Through complex investigations, aggressive technical operations, and strong partnerships, FBI San Diego will continue to identify, disrupt, and impose costs on our cyber adversaries. We are committed to dismantling the tools behind these state-sponsored crimes and protecting the American people from malicious cyber activity.”

According to court documents, QTFY offers computer hacking services to its paying customers, including the PRC’s Ministry of State Security and the People’s Liberation Army. These computer hacking services include QScan and QTRouter, which work in conjunction. QScan scans and automatically infects thousands of “internet-of-things” (IoT) devices worldwide, which are then added to the QTRouter network of QTFY-controlled devices. QTRouter consists of these compromised IoT devices, as well as commercial proxy service devices and leased virtual private servers. QTRouter then serves as an “obfuscation network” – meaning it allows QTFY and other malicious cyber actors to conceal the PRC-origin of their computer intrusion activities because the malicious communications appear to originate from computers (such as those compromised by QScan) that are outside of the PRC and may even be local to the targeted networks. Because the seized domains were hard-coded into both the QScan and QTRouter malware and used for essential tasks such as communication and authentication, the court-authorized seizures made QScan and QTRouter inoperable. 

This disruption announced today is among a series of court-authorized technical operations against indiscriminate hacking activities by the PRC. In 2025, the FBI removed PlugX surveillance malware from over 4,000 U.S. computers after they had been infected by the PRC-sponsored hacker group Mustang Panda. In 2024, the FBI disabled a botnet consisting of hundreds of thousands of infected internet-of-things devices, which the PRC-sponsored hacking group Flax Typhoon was providing to customers in the Chinese government. In 2023, the FBI disrupted a different botnet used by the PRC-sponsored hacking group Volt Typhoon to conceal their exploitation of U.S. and foreign critical infrastructure. Also today, the FBI and National Security Agency published a cybersecurity advisory providing indicators-of-compromise by QTFY based on their analysis of QTFY malicious cyber activity dating back to at least 2018. In addition, Lumen Technologies’ threat intelligence group, Black Lotus Labs, published a description of QTFY’s tactics, techniques, and procedures: www.lumen.com/blog/en-us/the-infrastructure-quartermaster-inside-a-china-nexus-state-enablement-model.

The FBI’s San Diego Field Office and Cyber Division, the U.S. Attorney’s Office for the Southern District of California, and the National Security Cyber Section of the Justice Department’s National Security Division investigated this hacking activity and led this disruption effort.  

Attorney General James Joins Coalition and Sues to Block Trump Administration Rule That Would Shut Millions of Voters Out of Mail-In Voting

 

With Midterms Less Than Three Months Away, New Rule Lets USPS Intercept and Reject Lawful Ballots

New York Attorney General Letitia James today joined 23 other attorneys general and the governor of Pennsylvania in suing the U.S. Postal Service (USPS) to stop a new rule that gives the agency unprecedented control over mail voting in federal elections, just weeks before ballots go out for the November midterms. The rule, finalized at President Trump’s direction, forces states to hand over lists of every eligible mail voter to USPS and requires federal pre-approval of ballot envelope designs. Any ballot mailed to or by a voter missing from the federal list, or using an envelope USPS hasn’t approved, could be rejected and not delivered, regardless of whether that voter is fully eligible and registered under state law.

“Across the country, states are already deep into preparations for the 2026 elections. Now, at the last moment, the federal government is attempting to meddle in those preparations and potentially threaten countless Americans’ right to vote,” said Attorney General James. “The USPS has no authority to decide who can and cannot vote by mail. This new policy will just create confusion, unnecessary costs, and unacceptable risks for voters going into Election Day, and my office is going to court to stop it.”

On Monday, the U.S. Supreme Court stayed a lower court’s ruling against key portions of the president’s underlying executive order, which directed USPS to promulgate this rule. Now that USPS has finalized the rule, states have just weeks to comply before the midterm elections in November. Election officials will have to redesign ballot envelopes, obtain federal approval, and establish entirely new systems to transmit voter lists to USPS, all while preparing to mail ballots to millions of Americans. If states or local election officials cannot comply in time, eligible voters could be prevented from receiving or returning their ballots.

The rule requires states to provide USPS with lists of voters seeking to vote by mail. It also imposes new federal requirements for ballot envelopes, including unique Intelligent Mail barcodes, and requires states to submit ballot envelope designs to USPS for review and approval. Under the rule, USPS could refuse to deliver ballots associated with voters who are not on the lists or that fail to comply with the agency’s new requirements regarding envelopes.

The rule comes at a particularly critical moment for state election officials. States and localities have already been preparing for the November 2026 general election and, in many cases, have designed and purchased ballot envelopes based on existing USPS guidance. The new requirements could force election officials to purchase new envelopes and equipment, establish new systems for submitting and updating voter information, and train staff – imposing significant costs and administrative burdens with the election just weeks away. The USPS processed nearly 100 million ballots during the 2024 general election, and approximately 30 percent of voters nationwide voted by mail.

Attorney General James and the coalition warn that the rule could also disenfranchise voters through administrative errors or technical failures. Voter and mail ballot registration continues in the weeks leading up to an election, requiring states to continually update their lists. Yet under the new system, USPS would have the power to reject ballots based on compliance with its arbitrary requirements, even when a voter is eligible and registered under state law.

Attorney General James and the coalition argue that the rule violates the Voting Rights Act by directing USPS to refuse to deliver mail ballots to qualified voters who are otherwise entitled to vote under state law. In addition, the coalition argues that requiring states to provide USPS with information identifying voters who participate in mail voting violates the Privacy Act’s restrictions on federal collection of records describing individuals’ exercise of First Amendment rights.

The coalition also argues that the rule threatens to undermine states’ constitutional authority over elections. State law determines who is eligible to vote by mail and establishes the procedures voters must follow to receive and return their ballots. The USPS has no authority to establish its own federal eligibility requirements to vote by mail or to refuse to transmit ballots to or from voters who are eligible to vote by mail under state law. The coalition argues that the rule also exceeds USPS’s statutory authority because federal law requires USPS to accept, transport, and deliver lawful, properly posted mail, and does not authorize the agency to create new categories of mail that can be rejected based on its own election-related requirements.

With the midterms fast approaching, the coalition is asking the court to declare the rule unlawful, immediately block USPS from enforcing the rule while the case proceeds, and permanently strike down the rule.

Attorney General James joins in filing the lawsuit with the attorneys general of Arizona, California, Colorado, Connecticut, Delaware, Hawaii, Illinois, Maine, Maryland, Massachusetts, Michigan, Minnesota, Nevada, New Jersey, New Mexico, North Carolina, Oregon, Rhode Island, Vermont, Virginia, Washington, Wisconsin, and the District of Columbia, as well as the Governor of Pennsylvania.