Russian national accused of developing, selling malware appears in U.S. court

Dariy Pankov faces up to 47 years in prison on charges linked to credential sales and offering access to the NLBrute malware.

A Russian national accused of developing and licensing the “NLBrute” malware and selling at least 35,000 compromised logins appeared in a Florida federal court on Tuesday facing charges of conspiracy, access device fraud and computer fraud.

Dariy Pankov, also known as “dpxaker,” was arrested in the Republic of Georgia on Oct. 4, 2022 and was recently extradited to the United States, U.S. Attorney Roger B. Handberg said in a statement Wednesday. Pankov faces a maximum of 47 years in federal prison if convicted on all counts, Handberg said.

Pankov stands accused of developing NLBrute — also known as nl.exe or nlbrute.exe — and advertising it for sale on an underground forum as early as June 2016, according to an indictment unsealed this week. During that time he also sold more than 35,000 compromised login credentials for access to systems around the world, including in the United States, France, the United Kingdom, Italy and Australia. At least two of those sales were to undercover U.S. law enforcement officers, according to the indictment, and involved login credentials for two separate Florida-based law firms.

Credentials sold by Pankov were “used to facilitate a wide range of illegal activity, including ransomware attacks and tax fraud,” Handberg’s statement said.

Between August 2016 and January 2019 Pankov netted nearly $360,000 from both credential sales and offering access to NLBrute, prosecutors allege. The indictment was originally filed in April 2019 and includes notice that the government intends to take $358,437 in restitution.

“Mr. Pankov maintains his innocence and looks forward to his day in court,” his attorney, Igor Litvak, told CyberScoop in an email. “He has plead not guilty.”

Updated Feb. 23, 2023: This story has been updated to include a statement from Pankov’s attorney, Igor Litvak.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• FBI raises alarm over deceptive phishing campaign targeting prominent people

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure