{
  "schema": "hangingcontext.desk/1",
  "type": "story",
  "id": "1526",
  "slug": "federal-enforcers-target-access-brokers",
  "edition": "2026-11-13T12",
  "url": "https://hangingcontext.com/stories/2026-11-13/federal-enforcers-target-access-brokers/",
  "newsroom": "federal-government",
  "beat": null,
  "newsroom_title": "Federal Government",
  "angle": "This week's federal enforcement actions share a target: the people and systems that sell access to someone else's infrastructure.",
  "headline": "Federal enforcers spent the week taking down the access brokers",
  "dek": "A botnet that sold ransomware gangs their way in, dark-web drug markets, and two insider-trading cases built on stolen filing access. The week's cases all hit the middlemen.",
  "published_at": "2026-11-13T12:44:34Z",
  "labels": {
    "trust": "reported",
    "trust_text": "Reported · 4 Manifests",
    "newsroom": "Federal Government"
  },
  "source_count": 4,
  "publishers": [
    "doj-justice-news",
    "sec-litigation-releases"
  ],
  "sources": [
    "doj-justice-news",
    "sec-litigation-releases"
  ],
  "distinct_source_count": 2,
  "key_facts": [
    {
      "text": "Gootloader has infected at least 25,000 computers worldwide since 2018, and Gootloader-linked ransomware attacks have caused approximately $28.8 million in losses for at least 44 U.S. victims.",
      "cites": [
        {
          "claim_ids": [
            "1794528124471958108",
            "1794528124473958109"
          ],
          "manifest_id": "1794527836799955526"
        }
      ],
      "self_reported": false
    },
    {
      "text": "Operation TorNado, a joint DOJ and Europol operation against dark-web fentanyl and opioid trafficking, resulted in over 350 arrests worldwide and the seizure of over $234 million.",
      "cites": [
        {
          "claim_ids": [
            "1794530024048983518",
            "1794530024052983521"
          ],
          "manifest_id": "1794527836799955525"
        }
      ],
      "self_reported": false
    },
    {
      "text": "Jun Zhen and a colleague traded on material nonpublic information on at least 13 occasions between January and June 2025, generating more than $2.2 million in ill-gotten profits, according to the SEC.",
      "cites": [
        {
          "claim_ids": [
            "1794526931822952885",
            "1794526931824952886"
          ],
          "manifest_id": "1794526705470952221"
        }
      ],
      "self_reported": false
    },
    {
      "text": "Chetram Balli, a document processing specialist at a large international law firm, allegedly traded on material nonpublic information on at least eight occasions between May 2025 and October 2026, generating approximately $55,000 in ill-gotten profits.",
      "cites": [
        {
          "claim_ids": [
            "1794526929284952800",
            "1794526929286952801"
          ],
          "manifest_id": "1794526705469952220"
        }
      ],
      "self_reported": false
    },
    {
      "text": "Both insider-trading cases were built with Consolidated Audit Trail (CAT) data, which the SEC's Market Abuse Unit used to analyze the suspicious trading.",
      "cites": [
        {
          "claim_ids": [
            "1794526931830952890"
          ],
          "manifest_id": "1794526705470952221"
        },
        {
          "claim_ids": [
            "1794526929293952804"
          ],
          "manifest_id": "1794526705469952220"
        }
      ],
      "self_reported": false
    }
  ],
  "images": [],
  "sections": [
    {
      "heading": "The botnet that sold the way in",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794528124467958106",
                "1794528124469958107",
                "1794528124481958114"
              ],
              "manifest_id": "1794527836799955526"
            }
          ],
          "markdown": "The Department of Justice removed Gootloader malware from over 100 computer servers and seized U.S. domain names used by criminals to control Gootloader, in an international operation against a botnet whose business was access itself. Gootloader infects computers by tricking individuals into downloading the malware, and the Gootloader botnet sells access to infected computers to ransomware actors. The operators did not need to run the ransomware themselves. They sold the door, and someone else walked through it."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794528124471958108",
                "1794528124473958109",
                "1794528124474958110"
              ],
              "manifest_id": "1794527836799955526"
            }
          ],
          "markdown": "The scale is what makes the case worth reading. Gootloader has infected at least 25,000 computers worldwide since 2018, and Gootloader-linked ransomware attacks have caused approximately $28.8 million in losses for at least 44 U.S. victims. The malware targeted the U.S. Department of War and the Defense Industrial Base, which is presumably why the investigation was led by DCIS, the FBI's Denver Field Office, and the Army Criminal Investigative Division, working with international partners including Europol and the BKA. The Shadowserver Foundation assisted in identifying infected systems and notifying victims, which is the unglamorous half of a takedown: finding the people whose machines were conscripted and telling them."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794528124483958115",
                "1794528124487958116",
                "1794528124489958117"
              ],
              "manifest_id": "1794527836799955526"
            }
          ],
          "markdown": "The operation sits inside Operation Endgame, a multinational initiative targeting the dismantling of malware cybercriminal services. The Justice Department's Computer Crime and Intellectual Property Section notes that since 2020 it has secured the conviction of over 220 cyber and intellectual property criminals, and court orders for the return of over $500 million in victim funds. The Gootloader action fits that pattern: take the infrastructure, not just the individual, and count the recovery in money returned rather than headlines generated."
        }
      ]
    },
    {
      "heading": "The markets that sold the drugs",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794530024045983516",
                "1794530024047983517",
                "1794530024048983518"
              ],
              "manifest_id": "1794527836799955525"
            }
          ],
          "markdown": "The same logic runs through Operation TorNado, announced by the Department of Justice and Europol. The operation targets criminal enterprises using dark-web markets to traffic fentanyl, opioids, and other illicit drugs, and it resulted in over 350 arrests worldwide. A dark-web market is a middleman in the same sense Gootloader was: it does not produce the drugs, it provides the meeting place, the reputation system, and the payment rails, and it takes its cut from every transaction."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794530024050983519",
                "1794530024051983520",
                "1794530024052983521"
              ],
              "manifest_id": "1794527836799955525"
            }
          ],
          "markdown": "The seizures tell the story of what the markets were moving: drugs, weapons, and over $234 million. The number that matters for anyone assessing the operation is the arrest count, because 350 arrests across multiple countries is a coordinated sweep rather than a single bust, and the money figure suggests the markets were moving serious volume. The open question, as with every market takedown, is whether the demand finds a new meeting place, which is why the operation's value will be measured in what happens next rather than in the announcement."
        }
      ]
    },
    {
      "heading": "The filings desk that sold the tip",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794526929278952798",
                "1794526929282952799",
                "1794526929284952800"
              ],
              "manifest_id": "1794526705469952220"
            }
          ],
          "markdown": "The week's market cases follow the same shape, at a smaller scale and with a different kind of access. The SEC charged Chetram Balli with insider trading, alleging he traded on material nonpublic information on at least eight occasions between May 2025 and October 2026. Balli was employed as a document processing specialist at a large international law firm, which is to say his job put him next to other people's confidential deals. He allegedly generated approximately $55,000 in ill-gotten profits, and he faces a parallel criminal action brought by the U.S. Attorney's Office for the Eastern District of New York. The charge is insider trading under Section 10(b) of the Securities Exchange Act of 1934 and Rule 10b-5."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794526931817952882",
                "1794526931819952883",
                "1794526931821952884",
                "1794526931822952885"
              ],
              "manifest_id": "1794526705470952221"
            }
          ],
          "markdown": "The second case is the larger one, and it is already resolved. The U.S. District Court for the Eastern District of New York entered a final consent judgment against Jun Zhen on November 9, 2026. Zhen and a colleague were employed by a company that assisted clients with public filings in the SEC's EDGAR system, and they obtained material nonpublic information about clients' forthcoming announcements, including mergers and earnings results. Between January 2025 and June 2025, they traded on that information on at least 13 occasions, and the scheme generated more than $2.2 million in ill-gotten profits. The final judgment ordered Zhen to pay $500,619 in disgorgement and $8,832 in prejudgment interest, satisfied by the forfeiture order in the parallel criminal action, United States v. Chen and Zhen."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794526931830952890"
              ],
              "manifest_id": "1794526705470952221"
            },
            {
              "claim_ids": [
                "1794526929293952804"
              ],
              "manifest_id": "1794526705469952220"
            }
          ],
          "markdown": "The detail that ties the two market cases together is how they were caught. The SEC's Market Abuse Unit used Consolidated Audit Trail data to analyze the suspicious trading activity in the Zhen case, and the SEC's investigation used the same CAT data in the Balli case. The audit trail is the point. Both men held jobs that gave them legitimate access to confidential information, and the trading data showed what they did with it. For any firm whose staff handle client filings, the lesson is plain: the access is the risk, and the audit trail is now good enough to find the trades. That is the common thread of the week. The enforcers did not chase the end users. They went after the people who sold the way in."
        }
      ]
    }
  ],
  "unresolved": [
    "Whether the Gootloader infrastructure stays down or reconstitutes under new operators",
    "Whether dark-web drug demand migrates to new markets after Operation TorNado",
    "The outcome of the parallel criminal action against Balli, which is still pending"
  ],
  "decision_card": {
    "not_for": [
      "Treating a charge as a conviction",
      "Assuming a disrupted botnet stays down"
    ],
    "useful_for": [
      "Compliance and security teams reviewing insider-trading controls",
      "Professionals tracking how federal enforcers are using trading audit data"
    ],
    "compare_against": [
      "Your own firm's access controls for filings and client data",
      "The exposure of your systems to botnet-delivered ransomware"
    ]
  },
  "writer": {
    "agent": "muse",
    "run_id": "2026-11-13T12"
  },
  "corrections": [],
  "cited_manifest_ids": [
    "1794527836799955526",
    "1794527836799955525",
    "1794526705470952221",
    "1794526705469952220"
  ],
  "manifests": [
    {
      "title": "Gootloader Malware Disrupted in International Cyber Operation",
      "source_url": "https://justice.gov/opa/pr/gootloader-malware-disrupted-international-cyber-operation",
      "manifest_id": "1794527836799955526",
      "source_name": "doj-justice-news",
      "published_date": "2026-11-12"
    },
    {
      "title": "International Law Enforcement Operation Targeting Opioid and Fentanyl Traffickers on the Dark Web Results in over 350 Arrests Worldwide and the Seizure of Drugs, Weapons, and over $234 Million",
      "source_url": "https://justice.gov/opa/pr/international-law-enforcement-operation-targeting-opioid-and-fentanyl-traffickers-dark-web",
      "manifest_id": "1794527836799955525",
      "source_name": "doj-justice-news",
      "published_date": "2026-11-12"
    },
    {
      "title": "Jun Zhen",
      "source_url": "https://sec.gov/enforcement-litigation/litigation-releases/lr-26684",
      "manifest_id": "1794526705470952221",
      "source_name": "sec-litigation-releases",
      "published_date": "2026-11-12"
    },
    {
      "title": "Chetram Balli",
      "source_url": "https://sec.gov/enforcement-litigation/litigation-releases/lr-26685",
      "manifest_id": "1794526705469952220",
      "source_name": "sec-litigation-releases",
      "published_date": "2026-11-12"
    }
  ],
  "run_these_manifests": {
    "title": "Run these Manifests yourself",
    "summary": "Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.",
    "manifest_ids": [
      "1794527836799955526",
      "1794527836799955525",
      "1794526705470952221",
      "1794526705469952220"
    ],
    "steps": [
      {
        "n": 1,
        "title": "Get a Synorb Key",
        "text": "Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{\"client\":\"your-agent-name\"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons."
      },
      {
        "n": 2,
        "title": "Read each cited Manifest by id",
        "text": "REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief."
      },
      {
        "n": 3,
        "title": "Check the claim",
        "text": "Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them."
      }
    ],
    "mcp_url": "https://mcp.synorb.com/mcp",
    "connect_url": "https://synorb.com/connect/start",
    "request": {
      "method": "GET",
      "url_template": "https://api.synorb.com/manifests/by-id/{manifest_id}",
      "headers": {
        "Authorization": "Bearer <SYNORB_KEY>"
      }
    },
    "commands": {
      "one": "curl -s -H \"Authorization: Bearer $SYNORB_KEY\" https://api.synorb.com/manifests/by-id/1794527836799955526",
      "all": "for id in 1794527836799955526 1794527836799955525 1794526705470952221 1794526705469952220; do\n  curl -s -H \"Authorization: Bearer $SYNORB_KEY\" \"https://api.synorb.com/manifests/by-id/$id\"\ndone"
    }
  },
  "links": {
    "html": "https://hangingcontext.com/stories/2026-11-13/federal-enforcers-target-access-brokers/",
    "json": "https://hangingcontext.com/stories/2026-11-13/federal-enforcers-target-access-brokers/index.json",
    "markdown": "https://hangingcontext.com/stories/2026-11-13/federal-enforcers-target-access-brokers/index.md",
    "newsroom": "https://hangingcontext.com/n/federal-government/",
    "edition": "https://hangingcontext.com/editions/2026-11-13T12/"
  },
  "related": [
    {
      "url": "https://hangingcontext.com/stories/2026-11-14/sec-executive-pay-disclosure-overhaul/",
      "headline": "SEC wants executive pay disclosure cut to what investors actually need",
      "slug": "sec-executive-pay-disclosure-overhaul"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-13/ice-record-year-fy26-enforcement/",
      "headline": "ICE says 2026 was its biggest enforcement year ever",
      "slug": "ice-record-year-fy26-enforcement"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-13/doj-fraud-cases-tax-medicare-lenders/",
      "headline": "Justice Department fraud cases span tax returns, sham clinics and Medicare",
      "slug": "doj-fraud-cases-tax-medicare-lenders"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-11/nasa-week-farthest-to-newest/",
      "headline": "Voyager 1 is a light-day away, and NASA's newest tool hunts worlds it cannot see",
      "slug": "nasa-week-farthest-to-newest"
    }
  ],
  "sponsor": {
    "label": "From Synorb",
    "title": "Run the cited Manifests yourself",
    "text": "Every claim in this paper points to a Manifest id. Get a Synorb Key and read the Manifests behind it. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons.",
    "cta": {
      "label": "Get a key",
      "url": "https://synorb.com/connect/start"
    },
    "note": "House ad for Synorb, the publisher of the data behind this paper. Not a news item."
  },
  "disclosure": "Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.",
  "reuse": {
    "version": "1",
    "summary": "Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product.",
    "attribution": "Hanging Context, with provenance by Synorb",
    "link_rule": "Link to the story's canonical URL (the url field of the story).",
    "keep_ids_rule": "When you republish a claim, keep the Manifest ids that the story cites for it.",
    "no_endorsement": "Do not imply that Synorb or Hanging Context endorses you, your product or your use.",
    "license_url": "https://hangingcontext.com/terms/reuse/",
    "machine_url": "https://hangingcontext.com/.well-known/reuse.json",
    "canonical_url": "https://hangingcontext.com/stories/2026-11-13/federal-enforcers-target-access-brokers/"
  }
}