CaseCalendar.net

Emanuel Ashtor, a U.S. citizen and co-owner of Vali Tech Inc., was charged in the Southern District of Florida with conspiracy to damage protected computers, conspiracy to commit wire fraud and mail fraud, conspiracy to commit money laundering, and conspiracy to transfer false identification documents, based on allegations that he facilitated a scheme in which North Korean IT workers obtained remote employment at U.S. companies under stolen identities, receiving and hosting company-issued laptops at his residences and installing remote desktop software to enable the overseas workers to perform the work undetected. Co-defendant Erick Ntekereze Prince pled guilty to conspiracy to commit wire fraud and mail fraud and was sentenced to 18 months imprisonment, three years of supervised release, and a $100 special assessment, with a forfeiture money judgment of $89,000 also entered against him. Ashtor's case remains set for a calendar call on December 9, 2026, and a jury trial on December 14, 2026.

3:24-cr-00151 (M.D. Tenn.) — Matthew Isaac Knoot, a Nashville resident, was charged with conspiracy to cause damage to protected computers, conspiracy to commit money laundering, conspiracy to commit wire fraud, aggravated identity theft, and related offenses in the Middle District of Tennessee, stemming from his role as a U.S.-based facilitator who hosted laptops and installed remote desktop software to help a North Korean IT worker fraudulently obtain employment at American companies under a stolen identity. Knoot pled guilty to Count One (conspiracy to cause damage to protected computers) on September 29, 2025, after the court had dismissed Count Six on his motion, and the remaining counts were dismissed on the government's motion following sentencing. At a contested sentencing hearing on May 1, 2026, Knoot was sentenced to 18 months' imprisonment, one year of supervised release, $15,100 in restitution distributed among four victim companies, and a $100 special assessment; he has since appealed his conviction.

26-5455 (6th Cir.) — Matthew Knoot, a Nashville resident, was charged with conspiracy to cause damage to protected computers, conspiracy to commit money laundering, conspiracy to commit wire fraud, intentional damage to a protected computer, aggravated identity theft, and conspiracy to cause the unlawful employment of aliens, based on his role as a U.S.-based facilitator who hosted laptops and installed remote desktop software to help a North Korean IT worker fraudulently obtain employment at American companies under a stolen identity. Knoot pled guilty to Count One (conspiracy to cause damage to protected computers), and the remaining counts were dismissed on the government's motion. He was sentenced to 18 months' imprisonment, one year of supervised release, $15,100 in restitution, and a $100 special assessment, with a self-surrender deadline of June 30, 2026; he has since appealed his conviction.

Zhenxing Wang, a New Jersey resident, was charged with conspiracy to commit wire and mail fraud, money laundering conspiracy, conspiracy to commit identity theft, and conspiracy to damage a protected computer, arising from his role as a U.S.-based facilitator for a scheme in which North Korean IT workers used stolen identities to obtain remote employment at more than 100 U.S. companies and funnel the proceeds overseas. Wang pled guilty to Counts One and Two on January 7, 2026. He was sentenced to 92 months imprisonment and three years of supervised release, with a $200 special assessment; Counts Three and Four were dismissed on the government's motion, and Wang must self-surrender by June 9, 2026.

Kejia Wang, a/k/a "Tony Wang," a New Jersey resident, was charged in the District of Massachusetts with conspiracy to commit wire and mail fraud, money laundering conspiracy, and conspiracy to commit identity theft for his role in a scheme to place North Korean IT workers in remote jobs at more than 100 U.S. companies using stolen identities, shell companies, and laptop-hosting arrangements that funneled millions of dollars to overseas co-conspirators. Wang pled guilty to all three counts on September 3, 2025, and was sentenced on April 15, 2026, to 108 months imprisonment and three years of supervised release, with $29,236.03 in restitution to Snaplogic, Inc. and a $300 special assessment, along with a forfeiture money judgment of $400,000; he is required to self-surrender to the Bureau of Prisons by July 10, 2026.

Oleksandr Didenko, a Ukrainian national, was indicted in the District of Columbia on charges of conspiracy to commit wire fraud, conspiracy to defraud the United States, aggravated identity theft, and related offenses, stemming from his operation of "UpworkSell," a business that created thousands of fraudulent online accounts and U.S.-based "laptop farms" to help overseas IT workers — including North Koreans — fraudulently obtain remote employment at American companies in violation of U.S. sanctions. Didenko pled guilty to conspiracy to commit wire fraud (Count 1) and aggravated identity theft (Count 4) on November 10, 2025, and was sentenced on February 19, 2026, to 36 months on Count 1 and 24 months on Count 4, to run consecutively, for a total of 60 months imprisonment, followed by 12 months of supervised release on each count to run concurrently, along with $46,547.28 in restitution to Trinity Technology Partners and a $200 special assessment. The court also entered a forfeiture money judgment of $1,420,185.64 against Didenko, and all remaining counts were dismissed on the government's motion.

Four North Korean nationals — Kim Kwang Jin, Kang Tae Bok, Jong Pong Ju, and Chang Nam Il — were charged in the Northern District of Georgia with wire fraud conspiracy and money laundering conspiracy for allegedly posing as non-North Korean IT workers to infiltrate U.S. and foreign technology companies, steal more than $900,000 in cryptocurrency from victims' smart contracts, and launder the proceeds through virtual currency mixers and exchange accounts opened under fraudulent identities; Kim Kwang Jin faces additional substantive wire fraud counts. The defendant information sheet filed at indictment indicates that Kim Kwang Jin had not yet been arrested at the time of filing and that arrest was anticipated.

Fourteen North Korean nationals — Jong Song Hwa, Ri Kyong Sik, Kim Ryu Song, Rim Un Chol, Kim Mu Rim, Cho Chung Pom, Hyon Chol Song, Son Un Chol, Sok Kwang Hyok, Choe Jong Yong, Ko Chung Sok, Kim Ye Won, Jong Kyong Chol, and Jang Chol Myong — were charged in the Eastern District of Missouri with conspiracy to violate the International Emergency Economic Powers Act, conspiracy to commit wire fraud, money laundering conspiracy, and identity theft offenses arising from a scheme in which DPRK IT workers used stolen U.S. identities to fraudulently obtain remote employment at American companies and nonprofits, generating at least $88 million in revenue for North Korea's weapons programs between approximately April 2017 and March 2023. The defendants, associated with two sanctioned DPRK front companies — Yanbian Silverstar in China and Volasys Silverstar in Russia — also extorted some U.S. employers by threatening to publish stolen proprietary data, and laundered proceeds through U.S. money transfer services to banks in China. Eight of the defendants face an additional count of aggravated identity theft for using victims' identifying information during and in relation to the wire fraud conspiracy.

Connor Riley Moucka, a Canadian national, was charged in the Western District of Washington with conspiracy, computer fraud, extortion in relation to computer fraud, wire fraud, and aggravated identity theft, arising from an alleged international scheme to hack into at least ten organizations' cloud computing systems, steal billions of sensitive customer records, and extort victims of at least 36 bitcoin. On August 5, 2026, Moucka pled guilty to Counts 1, 2, 14, and 19 — conspiracy, one count of computer fraud, one count of wire fraud, and aggravated identity theft — with the remaining counts to be dismissed at sentencing. Objections to the magistrate judge's report and recommendation are due by August 19, 2026, and sentencing is scheduled for October 27, 2026.

Christina Chapman, a U.S. national from Arizona, was charged with conspiracy to defraud the United States, conspiracy to commit wire fraud, aggravated identity theft, money laundering conspiracy, and related offenses for operating a "laptop farm" that helped North Korean IT workers fraudulently obtain remote employment at hundreds of U.S. companies — including Fortune 500 firms — by hosting their work laptops, validating stolen American identities, and laundering their wages. Chapman pled guilty to conspiracy to commit wire fraud, aggravated identity theft, and conspiracy to launder monetary instruments, and was sentenced on July 24, 2025 to an aggregate term of 102 months' imprisonment — consisting of concurrent 78-month terms on the wire fraud and money laundering counts plus a consecutive 24-month mandatory term on the aggravated identity theft count — along with a $300 special assessment and an obligation to pay restitution. The court also entered an order of forfeiture covering specific seized funds and a forfeiture money judgment, and the remaining counts were dismissed on the government's motion.

Minh Phuong Ngoc Vong was charged in the District of Maryland with conspiracy to commit wire fraud, based on allegations that he conspired with a foreign national in China to fraudulently obtain remote software developer jobs at at least 13 U.S. companies — including contractors supporting the FAA, Census Bureau, and other federal agencies — collecting more than $970,000 in salary for work he never performed while transmitting the bulk of the proceeds overseas. Vong pled guilty to Count One of the indictment on April 15, 2025, admitting that between 2020 and 2024 he allowed his overseas co-conspirator to use his credentials to perform the work and access sensitive government systems, while retaining 20–30% of the wages for himself. Sentencing is scheduled for December 4, 2025.

Alexander Paul Travis, an active-duty U.S. Army soldier stationed at Fort Gordon, Georgia, was charged in the Southern District of Georgia with wire fraud conspiracy for knowingly allowing his identity to be used by overseas North Korean IT workers to fraudulently obtain remote employment with eight U.S. companies, causing those companies to pay over $193,000 in salary while Travis received at least $51,397 for his participation. Travis pled guilty to Count One and was sentenced to 12 months plus one day in Bureau of Prisons custody, three years of supervised release, a $2,000 fine, and a $100 special assessment, with a self-report deadline of May 18, 2026. A final order of forfeiture was entered against Travis in the amount of $193,265.

Jason Salazar was charged in the Southern District of Georgia with one count of wire fraud conspiracy for knowingly allowing his identity to be used by overseas North Korean IT workers to fraudulently obtain remote employment with at least fourteen U.S. companies, which paid those workers over $409,000 in salary while Salazar received at least $4,500 for his participation. Salazar pled guilty to Count One on November 13, 2025, and was sentenced on March 19, 2026, to three years of probation, a $2,000 fine, and a $100 special assessment. The court also entered a final order of forfeiture of $409,876.30 against him.

Audricus Phagnasay was charged in the Southern District of Georgia with wire fraud conspiracy for knowingly allowing his identity to be used by overseas North Korean IT workers who fraudulently obtained remote employment with at least ten U.S. companies, causing those companies to pay over $680,000 in salary to individuals posing as Phagnasay. He pled guilty to Count One and was sentenced to three years of probation, a $2,000 fine, and a $100 special assessment. The court also entered a final order of forfeiture of $681,926 against him.

Nine defendants — Victoria Eduardovna Dubranova, Valeriy Valeriyovich Zaborovsky, Maksim Nikolaevich Lupin, Mikhail Evgenievich Burlakov, Roman Omelchenko, Olga Denisovna Evstratova, Vitaly Anatolyevich Zubets, Nikita Alexandrovich Petukhov, and Andrei Stanislavovich Abrosimov — were charged in the Central District of California with conspiracy to damage protected computers under 18 U.S.C. § 371, arising from their alleged membership in NoName057(16), a Russia-aligned hacktivist group that conducted coordinated DDoS attacks against government, financial, and critical infrastructure targets worldwide using the group's proprietary DDoSia malware. The court granted an ex parte application to seal the indictment and related documents on August 21, 2025 (entry 44); some subsequent docket activity may not be publicly visible.

Angelo Martino, a former ransomware negotiator employed by a cyber-incident response firm, was charged in the Southern District of Florida with conspiracy to interfere with interstate commerce by extortion, based on allegations that he secretly fed confidential client information — including insurance policy limits and negotiating strategies — to ALPHV BlackCat ransomware actors while purporting to negotiate on victims' behalf, and also participated directly in ransomware attacks on multiple companies. Martino pled guilty to the sole count of the information on April 14, 2026, and was sentenced on July 9, 2026, to 70 months imprisonment, three years of supervised release, and a $100 special assessment, with restitution deferred pending a hearing scheduled for September 17, 2026. A preliminary order of forfeiture was entered covering seized cryptocurrency holdings across multiple wallets as well as two real properties, two vehicles, a trailer, and a vessel.

Aleksei Olegovich Volkov, a Russian national, pled guilty to conspiracy to commit computer fraud and conspiracy to commit money laundering in the Southern District of Indiana, arising from his role as an initial access broker who sold stolen network credentials to the Yanluowang ransomware group, enabling attacks on U.S. businesses that demanded at least $24 million in ransom. He was sentenced to 47 months imprisonment and two years of supervised release, and was ordered to pay $9,167,198.19 in restitution to six identified victims, along with a $200 special assessment; the court also entered a forfeiture money judgment of $1,552,023.00 and ordered forfeiture of an ASUS laptop, an Apple iPhone 13 Pro, and a USB flash drive.

Deniss Zolotarjovs, a Latvian national operating under the alias "Sforza\_cesarini," was indicted in the Southern District of Ohio on charges of money laundering conspiracy, wire fraud conspiracy, and Hobbs Act extortion conspiracy for his alleged role in the Karakurt ransomware group, which hacked into victim companies' computer systems, encrypted their data, and extorted ransom payments in cryptocurrency from approximately 2021 through 2023. Zolotarjovs pled guilty to counts one and two of the indictment, and was sentenced to 102 months in federal custody, three years of supervised release, and a $200 special assessment. The court dismissed count three on the government's motion, and an amended judgment ordered Zolotarjovs to pay $56,551,689.19 in restitution to more than fifty victim companies and entities.

Xu Zewei is charged in the Southern District of Texas with conspiracy to cause damage to and obtain information from protected computers, wire fraud, aggravated identity theft, and related offenses, stemming from a series of computer intrusions between 2020 and 2021 that he allegedly carried out alongside officers of the Shanghai State Security Bureau and a fugitive co-defendant, Zhang Yu, targeting U.S. universities and a law firm. Zewei was arrested in Italy in July 2025 and extradited to the United States in April 2026, after which he was arraigned and ordered detained pending trial. The court granted the government's agreed motion to designate the case as complex under the Speedy Trial Act, tolling the speedy-trial clock and continuing all deadlines; a status conference is scheduled for September 25, 2026.

Muneeb Akhter and his brother Sohaib Akhter were charged in the Eastern District of Virginia with conspiracy to commit computer fraud and destroy records, intentional damage to protected computers, theft of government records, and related offenses, after allegedly deleting approximately 96 federal agency databases and stealing sensitive government information minutes after being fired from a government contractor in February 2025; the superseding indictment added wire fraud, possession of unauthorized access devices, and — as to Sohaib — unlawful firearm possession and witness tampering. Muneeb Akhter pled guilty to intentional damage to a protected computer, obtaining information from a computer without authorization, and two counts of wire fraud, with sentencing scheduled for August 12, 2026. Sohaib Akhter proceeded to trial pro se and a jury was convicted at trial of conspiracy, password trafficking, and unlawful firearm possession, but was acquitted of witness tampering, with sentencing scheduled for September 9, 2026.

4:24-cr-00016 (E.D.N.C.) — Sina Gholinejad, an Iranian national, pled guilty to intentional damage to protected computers and conspiracy to commit wire fraud in connection with a multi-year ransomware scheme in which he and co-conspirators deployed the "Robbinhood" ransomware against city governments, hospitals, and other organizations — including the cities of Baltimore, Greenville (N.C.), and Yonkers — causing tens of millions of dollars in losses. He was sentenced on November 3, 2025, to 72 months' imprisonment and three years of supervised release, and was ordered to pay $14,655,096.24 in restitution to eighteen victims, along with a $200 special assessment; the remaining counts were dismissed. Gholinejad has appealed the judgment and is in federal custody.

25-4607 (4th Cir.) — Sina Gholinejad is appealing his conviction for intentional damage to protected computers and conspiracy to commit wire fraud, to which he pled guilty, after being sentenced to 72 months in prison, three years of supervised release, a $200 special assessment, and $14,655,096.24 in restitution to victims including the City of Baltimore, the City of Greenville, and sixteen other organizations. Briefing in the Fourth Circuit is underway, with the reply brief due June 12, 2026.

Volodymyr Viktorovych Tymoshchuk, a Ukrainian national also known as "Deadforz," "Boba," "msfv," and "farnetwork," was charged in the Eastern District of New York with conspiracy to commit computer fraud, intentional damage to protected computers, unauthorized computer access, and extortion threats in connection with the LockerGoga, MegaCortex, and Nefilim ransomware schemes, along with co-defendant Artem Aleksandrovych Stryzhak on the Nefilim conspiracy count. Stryzhak pled guilty to Count Five of the superseding indictment — conspiracy to commit computer fraud in connection with the Nefilim ransomware scheme — on December 19, 2025, and the court entered a preliminary order of forfeiture requiring him to forfeit one Apple MacBook Pro seized in Barcelona, Spain. A sentencing hearing for Stryzhak that had been scheduled for August 11, 2026 was cancelled, and a final forfeiture order was entered on August 7, 2026.

Oleksii Oleksiyovych Lytvynenko, also known as Alexsey Alexseevich Litvinenko, was charged in the Middle District of Tennessee with conspiracy to violate the Computer Fraud and Abuse Act and conspiracy to commit wire fraud for his alleged role in the Conti ransomware operation, which targeted more than 900 victims worldwide — including a government entity and two businesses in Tennessee — by hacking networks, encrypting data, and extorting cryptocurrency ransoms. Lytvynenko pled guilty to Count Two (conspiracy to commit wire fraud), with the government agreeing to dismiss Count One after sentencing, under a binding Rule 11(c)(1)(C) agreement calling for a term of imprisonment between 41 and 51 months; he also consented to a $25,042 forfeiture money judgment representing proceeds of the offense. Sentencing is scheduled for September 10, 2026.

Artem Aleksandrovych Stryzhak was charged in the Eastern District of New York with conspiracy to commit computer fraud and extortion in connection with his role as an affiliate of the Hive ransomware operation, which targeted hospitals, schools, businesses, and government entities worldwide between June 2021 and January 2023. Stryzhak pled guilty to Count One (conspiracy under 18 U.S.C. § 371) on December 19, 2025, and is in custody. A preliminary order of forfeiture was entered on January 2, 2026, requiring him to forfeit an Apple MacBook Pro seized in Barcelona, Spain, and a final forfeiture order was entered on August 7, 2026; the previously scheduled sentencing hearing was cancelled.

Roman Berezhnoy and Egor Nikolaevich Glebov, both Russian nationals, were charged in the District of Maryland with conspiracy to commit computer fraud, conspiracy to commit wire fraud, intentional damage to protected computers, transmitting extortion demands, and wire fraud, arising from their alleged roles as operators of the Phobos/8Base ransomware program that targeted more than 1,000 victims worldwide — including Maryland healthcare providers, school systems, a children's hospital, and a Defense Department contractor — extorting in excess of $16 million in Bitcoin ransom payments beginning as early as May 2019.

The United States filed this civil forfeiture action in the Central District of California seeking to forfeit virtual currency and $2,061,517.68 in U.S. currency alleged to constitute traceable proceeds of the Qakbot ransomware and money-laundering conspiracy led by Rustam Rafailevich Gallyamov, who was separately indicted on May 2, 2025, for conspiracy to commit computer fraud and wire fraud. After Gallyamov failed to file a claim or answer, the court granted default judgment on April 3, 2026, extinguishing and forfeiting all of Gallyamov's interests in the defendant assets to the United States; the claims of victim-claimants Concord Music Group, Inc., DISH Network Corporation, Minto Holdings, Inc., and Marathon Fasteners and Hardware Inc. remain pending.

Peter Stokes, also known as "Bouquet," "Spencer," and "Jordan," is charged in the Northern District of Illinois with computer intrusion under 18 U.S.C. § 1030(a)(2)(C), based on allegations that he is a member of the cybercriminal group Scattered Spider and participated in breaching a luxury jewelry retailer's network, exfiltrating data, and demanding approximately $8 million in cryptocurrency ransom between May 12 and May 15, 2025. Following his arrest, Stokes made an initial appearance on June 30, 2026, waived his right to contest pretrial detention and his right to a preliminary hearing, and was remanded to the custody of the U.S. Marshal pending further order of the court.

Patrick Schmitz, a German citizen also known as "William Gibson" and "PapaLegba," was charged in the District of New Jersey with eight counts including running a continuing criminal enterprise, drug trafficking and importation conspiracies, access device fraud conspiracy, conspiracy to transfer stolen identification documents, and money laundering conspiracy, all arising from his alleged co-founding and operation of the Versus Project, a dark web marketplace that facilitated the sale of drugs, stolen identities, and other illicit goods from approximately November 2019 through May 2022. An initial appearance was held on April 30, 2026, and a status conference is scheduled for October 13, 2026, with government Brady disclosures and substantial steps in discovery due by July 30 and September 30, 2026, respectively.

26-1049 (D.C. Cir.) — Anthropic PBC petitioned for review in the U.S. Court of Appeals for the D.C. Circuit, challenging the Department of War's March 3, 2026 determination under 41 U.S.C. § 4713 that Anthropic's products and services present a supply chain risk to national security — a designation Anthropic contends is pretextual retaliation in violation of the First and Fifth Amendments, arbitrary and capricious, and in excess of statutory authority. Oral argument was held on May 19, 2026, and the parties have since completed a second round of supplemental briefing, with Anthropic's supplemental reply brief due August 3, 2026.

3:26-cv-01996 (N.D. Cal.) — Anthropic PBC sued the U.S. Department of War and numerous other federal agencies and officials in the Northern District of California, alleging that a Presidential Directive ordering all federal agencies to cease use of Anthropic's technology, a Secretarial Order designating Anthropic a "Supply-Chain Risk to National Security," and related agency actions violated the First Amendment, the Fifth Amendment's Due Process Clause, the Administrative Procedure Act, and exceeded statutory authority — all in retaliation for Anthropic's public refusal to remove usage restrictions on its Claude AI models barring lethal autonomous warfare and mass surveillance of Americans. On March 26, 2026, Judge Rita F. Lin granted a preliminary injunction enjoining defendants from implementing the Presidential Directive, the Hegseth Directive, and the Supply Chain Designation, finding that the measures likely constituted unlawful First Amendment retaliation and were arbitrary and capricious under the APA. Anthropic's motion for summary judgment was heard on July 30, 2026, and Anthropic filed a proposed order on relief on July 24, 2026, as directed by the court.

26-2011 (9th Cir.) — Anthropic PBC petitioned for review of the Department of War's determination, issued March 3, 2026, that Anthropic presents a supply chain risk to national security under 41 U.S.C. § 4713, challenging the designation as unconstitutional retaliation and arbitrary agency action. This Ninth Circuit docket concerns Anthropic's appeal of the district court proceedings in N.D. Cal. No. 3:26-cv-01996-RFL, which targets the Department of War's reliance on § 4713 authority — a parallel but distinct statutory basis from the § 3252 authority challenged in the companion D.C. Circuit proceeding. The preliminary injunction briefing schedule was set with opening briefs due April 30, 2026, and an answering brief due May 28, 2026, but both deadlines were subsequently cancelled; appellants must file a motion for appropriate relief within 21 days after resolution of Anthropic PBC v. U.S. Department of War, No. 26-1049 (D.C. Cir.), if the stay remains in effect.

Marc Garciaguirre and sixteen other named plaintiffs, on behalf of a proposed class of indirect purchasers, filed suit against Samsung Electronics Co., Ltd., Samsung Semiconductor, Inc., SK Hynix Inc., SK Hynix America Inc., and Micron Technology, Inc. in the Northern District of California, alleging that the three DRAM oligopolists conspired since 2022 to restrict conventional DRAM supply — through coordinated production cuts, a pivot to high-bandwidth memory, and the shutdown of Micron's Crucial consumer brand — driving prices up approximately 700% in violation of Section 1 of the Sherman Act, the California Cartwright Act, and other state antitrust laws. The case was reassigned to District Judge Noel Wise shortly after filing, with answers due from Samsung and SK Hynix by July 21, 2026, and from Micron by July 27, 2026. An initial case management conference is scheduled for September 29, 2026.

Charles McGonigal, a former FBI Special Agent in Charge of the Counterintelligence Division of the New York Field Office, and Sergey Shestakov, a former Soviet and Russian diplomat, were charged in the Southern District of New York with conspiracy to violate the International Emergency Economic Powers Act, substantive IEEPA violations, and money laundering, arising from their alleged work on behalf of sanctioned Russian oligarch Oleg Deripaska. McGonigal pled guilty to a superseding information charging a single count of conspiracy to violate IEEPA and to commit money laundering, and was sentenced to 50 months imprisonment, three years of supervised release, a $40,000 fine, and a $100 special assessment, with a forfeiture money judgment of $17,500 also entered against him. Shestakov's case remains active, with a final pretrial conference scheduled for May 30, 2024, and a jury trial set for June 12, 2024; pretrial motions briefing has been completed.

Linwei Ding, a former Google software engineer, was charged in the Northern District of California with seven counts of theft of trade secrets and seven counts of economic espionage, based on allegations that he uploaded more than 1,000 confidential Google files — covering GPU and TPU chip architecture, related software, and SmartNIC designs — to personal cloud accounts while secretly affiliating with two PRC-based AI startups. A jury trial was held beginning January 7, 2026, and the jury returned its verdict on January 27, 2026. The court denied Ding's motions for judgment of acquittal and for a new trial on most grounds, while reserving for a forthcoming published opinion the question of whether Ding is entitled to acquittal on the economic espionage counts for insufficient evidence of intent to benefit the Chinese government; sentencing is scheduled for September 1, 2026.

3:23-cr-01471 (S.D. Cal.) — Jinchao Wei, a U.S. Navy Machinist's Mate assigned to the U.S.S. Essex at Naval Base San Diego, was charged in the Southern District of California with conspiracy to transmit national defense information to the People's Republic of China, substantive transmission of that information, conspiracy to export defense articles without a license, three counts of unlicensed export of defense articles, and unlawful procurement of citizenship — all arising from an alleged handler/asset relationship with a PRC intelligence officer beginning in February 2022. A jury trial was held beginning August 12, 2025, and Wei was convicted at trial of counts 1 through 6 of the superseding indictment; the jury acquitted him on count 7, the unlawful procurement of citizenship charge. Wei was sentenced on January 12, 2026, to 200 months imprisonment and three years of supervised release on each count, all to run concurrently, with a $600 special assessment and fines waived, and he has appealed.

26-399 (9th Cir.) — Jinchao Wei, a U.S. Navy Machinist's Mate assigned to the U.S.S. Essex, is appealing his conviction for conspiracy to transmit national defense information to aid a foreign government, transmitting such information, conspiracy to export defense articles without a license, and exporting defense articles without a license, after being convicted at trial on all six counts of the superseding indictment and sentenced to 200 months in federal prison, three years of supervised release, and a $600 special assessment; the jury acquitted him on Count 7, unlawful procurement of citizenship. The opening brief is due September 18, 2026, the government's answering brief is due October 19, 2026, and the reply brief is due November 10, 2026.

Eileen Wang, a former Arcadia City Council member, was charged in the Central District of California with one count of acting in the United States as an illegal agent of a foreign government, in violation of 18 U.S.C. § 951, based on allegations that she operated a sham news website and disseminated pro-PRC propaganda at the direction of Chinese government officials from late 2020 through 2022. Wang pled guilty to that single count at a change of plea hearing held on May 29, 2026, and sentencing is scheduled for October 6, 2026.

1:26-cr-00256 (N.D. Ga.) — Tommy Shad English, a Georgia-based IT equipment distributor, is charged with one count of knowingly and willfully attempting to export at least 600 servers containing Nvidia H100 GPUs from the United States to China without the required Commerce Department license, in violation of the Export Control Reform Act, in the U.S. District Court for the Northern District of Georgia. The criminal information alleges that English conspired with co-defendants Stanley Yi Zheng and Matthew Kelly from at least May 2023 through June 2024 to route the export-controlled hardware through Thailand as a transshipment point to conceal its ultimate Chinese destination. English was arraigned on June 10, 2026, and a change-of-plea hearing is scheduled for August 12, 2026.

1:26-cr-00221 (N.D. Ga.) — Matthew Kelly, a New York-based technology consultant, was charged in the Northern District of Georgia with conspiracy to smuggle goods from the United States and to violate the Export Control Reform Act, based on allegations that he worked with co-conspirators Stanley Yi Zheng and Tommy Shad English to illegally export Nvidia H100 GPU servers to China through Thailand as a transshipment point, without the required export licenses. Kelly pled guilty to Count 1 of the information on July 9, 2026, and sentencing is scheduled for December 10, 2026.

1:26-cr-00271 (N.D. Ga.) — Stanley Yi Zheng is charged in the Northern District of Georgia with conspiracy to smuggle goods from the United States and to violate the Export Control Reform Act, based on allegations that he worked with co-conspirators Tommy Shad English and Matthew Kelly to illegally export Nvidia H100 GPU servers — controlled under U.S. export regulations — to China through Thailand-based intermediaries without the required licenses. A criminal information was filed and a waiver of indictment was held on June 12, 2026, and a change-of-plea hearing is scheduled for July 28, 2026.