U.S. sanctions Russian companies linked to FSB

Officials are targeting companies and individuals that they say worked with Russia's Federal Security Service. Some of the companies have offices in the U.S.

The U.S. sanctioned five Russian entities and three Russian individuals on Monday under the authority of an Obama-era executive order for “engaging in significant malicious cyber-enabled activities.”

The government is targeting companies and individuals that they say worked with Russia’s Federal Security Service (FSB), the country’s chief intelligence agency. Officials claim those sanctioned helped assist Russian-linked hacking operations. Some of the affected companies currently boast offices located inside the U.S..

The chief target of the sanctions appears to be Digital Security, an ambiguously named Russia-based cybersecurity company, which Treasury says “worked on a project that would increase Russia’s offensive cyber capabilities for the Russian Intelligence Services, to include the FSB.”

Two other cybersecurity companies, ERPScan and Embedi, were sanctioned as well. Both are subsidiaries of Digital Security, according to the Treasury Department. The firms have addresses in or around California’s Silicon Valley.

“The United States is engaged in an ongoing effort to counter malicious actors working at the behest of the Russian Federation and its military and intelligence units to increase Russia’s offensive cyber capabilities,” Treasury Secretary Steven Mnuchin said in a statement.

Spokespeople for ERPScan and Embedi responded to the sanctions news Monday.

“I woke up and was shocked by such news,” ERPScan’s founder and CTO Alexander Polyakov told CyberScoop. “The only accusation about ERPScan is that we are subsidiary of other company … As of 2014 ERPScan is a private company registered in the Netherlands and is not a subsidiary of any company listed in this document.”

Polyakov said that ERPScan, which is known for discovering software vulnerabilities in the SAP enterprise platform, will “continue with helping the world to protect critical software.”

“All these news came to us as an unpleasant surprize [sic],” Alex Kruglov, Embedi’s head of marketing and public relations, wrote in an email. “We never worked for Russian government, but indeed we have some former Russian researchers in our Research Team (some of them are former employees of Digital Security).”

Kruglov noted that the company’s CEO, Ilia Medvedowski, is a former employee of Digital Security. He also said that most of the former employees of Digital Security who now work for Embedi are vulnerable researchers and security analysts. Embedi itself, however, is not a subsidiary of Digital Security, Kruglov said.

Embedi’s work involves finding potent zero-day exploits in popular software. But Kruglov described the company as “entirely white hat” and said they have no connection to any government and have never sold an exploit.

The company’s U.S.-based future is unclear at this point. In the past, Embedi has worked with U.S. vendors including Microsoft, Cisco, Symantec, IOActive and Schneider Electric.

Kvant Scientific Research Institute, located in St. Petersburg, Russia, was sanctioned for being “owned or controlled by the FSB. Kvant is identified as “the prime contractor on a project for which the FSB was the end user.” There is no further explanation of what the project is.

The Treasury Department did not respond to a request for further information prior to this article’s publication.

Divetechnoservices was specifically sanctioned “for providing material and technological support to the FSB” over the course of a decade, allegedly in service of the FSB’s ongoing efforts to conduct undersea espionage. Undersea communications cables carry the majority of the world’s data.

The three individuals sanctioned are all said to be Divetechnoservices managers. Aleksandr Lvovich Tribun is a general director, Oleg Sergeyevich Chirikov is a program manager and Vladimir Yakovlevich Kaganskiy is the owner.

In a press release intended for media, the U.S. government cited a wide range of recent malicious Russian cyber activity, including the NotPetya attack, “global compromises of network infrastructure devices” as well as intrusions against the American energy grid.

Chris Bing contributed to this story.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure