CID identifies Delaware company used to mask hackers behind $2.5 Million Treasury fraud

By Darshana Sanjeewa Balasuriya

Colombo, May 11 (Daily Mirror) - Criminal Investigation Department (CID) investigators have identified the company allegedly used to conceal the hackers linked to the disappearance of $2.5 million from Sri Lankan Treasury funds, which were transferred to multiple bank accounts in two different states in the United States.

According to investigators, the funds were routed through a third-party entity identified as “Biz Solutions,” a company reportedly involved in online business registration services. The company had been registered in the state of Delaware, USA.

Investigations revealed that four separate business accounts had been maintained under the company’s name at a branch of TD Bank. While most of the accounts have reportedly been emptied, one account still contains a balance of approximately $200.

The cyber breach targeted the Department of External Resources (ERD) and involved unauthorized access to official email communication channels. Through the breach, hackers allegedly intercepted and redirected funds linked to a $22.9 million bilateral debt repayment to Australia.

Police investigations have found that four out of six payment vouchers intended for submission to Australian authorities as part of the debt settlement process had been diverted to the hackers.

Police suspect that Treasury official Ranga Rajapaksa, who recently passed away, had been the primary contact person who responded to the initial emails that triggered the fraudulent transfer.

It was reported that although Delaware had been used to register the company due to its comparatively lenient business regulations, one of the final transaction vouchers was connected to another U.S. state where banking regulations are significantly stricter.

With the company now identified, investigators are working with international security agencies to uncover the individuals behind the Delaware-based registration and trace those responsible for operating the accounts.

Investigations are ongoing to determine the identities of those involved, including the individuals who registered the company, those managing it, and the timeline of the account operations.

Last week, the CID sought assistance from the United States Federal Bureau of Investigation (FBI) to expand the cyber fraud investigation. The Australian Federal Police are also assisting Sri Lankan authorities with the probe.