Loading story…
The U.S. Department of Justice arrested Oxygen Forensics CEO Lee Reiber and alleged company controller Oleg Sergeyevich Davydov on conspiracy-to-commit-wire-fraud charges, alleging they concealed Russian ownership, control, and Russia-based software development. Prosecutors say five Russian nationals controlled the digital-forensics vendor through a Cyprus holding company and obscured that arrangement after Russia's invasion of Ukraine and expanded U.S. sanctions.
Oxygen, also known as Oxygen US, sold mobile-device forensics software to the Department of Defense and DHS components, including the U.S. Secret Service, Homeland Security Investigations, and the DHS Office of Inspector General. Authorities allege the company obtained more than $2 million in post-sanctions contracts and purchases through certifications that it was not under foreign control; they seized its domains, infrastructure, and bank accounts. DOJ said the complaint does not allege malicious code in Oxygen software or unauthorized access to customer systems or data.
See the reporting duties and controls this puts on the clock.
9 events from the most recent confirmed update back to the earliest known activity.
Lee Reiber was arrested in Boise and released on bond, while Oleg Davydov was arrested in London. They were charged with conspiracy to commit wire fraud over allegations they concealed Russian ownership and Russia-based software development to obtain U.S. government business; DOJ said it would seek Davydov's extradition.
On September 20, U.S. authorities seized about 57 Oxygen-associated domains, cyber infrastructure, and corporate bank accounts, making the company's website unavailable.
Prosecutors allege that Reiber told Department of Homeland Security personnel that no Russians participated in Oxygen software development and that nobody in Russia could access the development environment.
In February 2026, Reiber allegedly continued representing to the National Computer Forensics Institute that Oxygen was U.S.-owned despite prosecutors' allegations of Russian control.
The National Computer Forensics Institute entered a five-year contract with Oxygen in September 2024 after Reiber certified that the company had no immediate or higher-level owner, according to prosecutors.
In July 2024, Reiber allegedly certified to the U.S. Department of War that no foreign person could control the appointment of Oxygen Forensics directors or managers, or direct the company's decisions or activities. Prosecutors allege Russian owners in fact controlled the company.
In November 2023, Reiber allegedly warned Oleg Davydov that media attention to Oxygen's Russian ties could jeopardize a pending National Computer Forensics Institute contract.
Oxygen faced accusations in 2023 that Oxygen US and Oxygen Russia used software code reverse-engineered from Elcomsoft products. Prosecutors say a truthful response would have revealed the entities shared software, developers, and owners.
In March 2022, Oxygen Forensics made Lee Reiber its CEO, president, and board chairman. Prosecutors allege the company then removed Russian owners from public filings while the Russian shareholders retained control over major decisions and finances.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcecyberscoop.com
Open sourceoccrp.org
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. prosecutors charged Russian national **Denis Nikolayevich Obrezko** with conspiracy to commit unauthorized computer access for allegedly providing infrastructure used by the Kremlin-linked espionage group **Void Blizzard**, also tracked as **Laundry Bear**. After his transfer from Thailand to Boston, Obrezko appeared in federal court over accusations that he bought a virtual private server and internet domains through cryptocurrency transactions that enabled intrusions against U.S. and foreign targets. Thai authorities arrested him in Phuket during a joint operation with the FBI and seized laptops, mobile phones, and cryptocurrency wallets. An unsealed FBI affidavit says investigators confirmed compromises at **11 U.S. companies** between June and July 2024, while assessing that the real number of victims is likely higher. Authorities and researchers said Void Blizzard has targeted government, defense, transportation, media, healthcare, educational institutions, NGOs, critical infrastructure, and organizations across Europe, North America, NATO countries, and Ukraine, using stolen credentials, session tokens, VPNs, and U.S.-based proxy services to evade detection. The group has also been linked to spear-phishing with typosquatted Microsoft-themed domains such as `miscrsosoft[.]com` and `micsrosoftonline[.]com`, and to theft of Dutch police staff contact information.
Jun 29, 2026
The United States unsealed charges against two Russian nationals accused of operating the cryptocurrency services **Cryptex** and **PM2BTC**, alleging they ran billion-dollar money-laundering infrastructure used by cybercriminals to process ransomware proceeds, darknet market payments, fraud revenue, and sanctions-evasion transactions. Treasury simultaneously moved against the network: FinCEN labeled PM2BTC a **primary money laundering concern** and barred certain fund transfers involving the service, while OFAC sanctioned Cryptex and alleged facilitator Sergey Sergeevich Ivanov. The action was coordinated with the U.S. Secret Service, Dutch law enforcement, and a State Department reward offer of up to **$10 million** for information on Ivanov. The case extends a broader U.S. campaign against Russian cybercrime finance channels that previously targeted **Hydra Market** and the exchange **Garantex**. Treasury has described Hydra as a major darknet marketplace that enabled ransomware-as-a-service, stolen data sales, and other illicit trade, while Garantex allegedly processed more than **$100 million** tied to illicit actors despite anti-money-laundering deficiencies. Together, the latest charges and sanctions show U.S. authorities escalating efforts to cut ransomware operators and other Russian-linked cybercriminals off from the virtual-currency services they rely on to move and cash out illicit funds.
Jun 29, 2026
A former L3Harris executive, **Peter Williams**, was sentenced to **87 months (about seven years)** in U.S. federal prison after pleading guilty to **theft of trade secrets** tied to the removal and sale of **at least eight zero-day exploit components/cyber tools** from *Trenchant* (L3Harris’ specialized unit supplying exploits to the U.S. government and select allies). Prosecutors said the stolen materials were intended for restricted government use; Williams allegedly leveraged his access over several years, received **about $1.3 million in cryptocurrency**, and the theft was estimated to have caused **$35 million** in losses to the contractor. Court reporting also noted Williams’ prior service with Australia’s signals intelligence community and that Trenchant traces back to L3Harris’ acquisition of Australian exploit-focused firms. The U.S. Treasury’s **OFAC** simultaneously imposed sanctions on **Operation Zero**—a St. Petersburg-based Russian exploit brokerage—and its founder **Sergey Zelenyuk**, citing national security risks from acquiring and reselling zero-days and related tooling that could enable **ransomware** or other malicious activity. U.S. officials said Operation Zero obtained the stolen Trenchant tools and then resold them to **unauthorized users**, and multiple reports linked the sanctions action to the Williams case (where the buyer was previously anonymized in court as “Company 3”). Reporting also described Operation Zero’s public market for high-value mobile and app exploits (including past offers for Android, iOS, and Telegram), its marketing toward **non-NATO** customers and foreign intelligence services, and additional U.S. measures including State Department sanctions and action under the **Protecting American Intellectual Property Act**, plus sanctions on an affiliated UAE entity **Special Technology Services (STS)** and other associated parties.
Jun 29, 2026