US Accuses Russian Cybersecurity Specialist D.O. of Void Blizzard Attacks on European Governments and US Companies, Kaspersky Ties Emerge

American authorities have charged Russian information security specialist D.O. with participating in cyberattacks by the Void Blizzard group, also known as Laundry Bear, targeting NATO-aligned European government agencies and at least 11 US companies since 2023. D.O., who previously held a senior position at one of Russia’s largest cybersecurity firms widely identified as Kaspersky, did not plead guilty during a court hearing in Boston. The US Department of Commerce banned the company’s software in 2024 over national security concerns, while European agencies had issued similar warnings earlier. Prosecutors also linked D.O. to a Nizhny Novgorod IT company where he served as deputy director from 2024, although his earlier Kaspersky employment was confirmed through salary records and a former colleague rather than the indictment itself. D.O. graduated from Bauman Moscow State Technical University with a degree in information security, an institution previously flagged by European journalists as a potential training ground for state-linked operatives. Experts note that movement between commercial cybersecurity roles and intelligence structures occurs across countries, but D.O.’s guilt remains to be proven in court.

securitylab_nTranslated from Russian

Read at source

American authorities have formally accused Russian information security specialist D.O. of involvement in a series of cyberattacks attributed to the hacking group Void Blizzard, also known as Laundry Bear. The charges, presented in a Boston court, allege that the group has been stealing emails and other communications from government organizations in European countries cooperating with NATO, as well as from at least eleven American companies, beginning in 2023.

D.O. did not enter a guilty plea during the court proceedings. According to information drawn from social media profiles and publicly available resumes, he graduated from the Bauman Moscow State Technical University with a specialization in information security. European journalists have previously described the university as one of the institutions that may train personnel later involved in operations conducted by state structures, although the university itself has not commented on these claims.

The accused previously held a senior position at one of Russia’s largest cybersecurity companies, widely understood to be Kaspersky. The exact nature of his role within the company has not been disclosed. His employment there ended several years before the start of the hacking campaign described by prosecutors. In 2024 the US Department of Commerce prohibited the sale and use of the company’s software in the United States, citing national security threats. European authorities had earlier issued similar risk warnings.

The indictment also connects D.O. to a second IT company based in Nizhny Novgorod, where he served as deputy director starting in 2024. Although the indictment itself does not mention his earlier work at the major cybersecurity firm, this information surfaced later through salary documents and confirmation from a former colleague. The defense attorney declined to discuss the defendant’s employment history.

Specialists observe that transitions between commercial cybersecurity companies and state intelligence structures occur in various countries. Nevertheless, until the court delivers a final ruling, D.O.’s alleged participation in the Void Blizzard operations remains unproven.

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in State-Sponsored & APT

North Korean WaterPlum Group Infects 30,000 Computers Across 100 Countries via Fake Coding Tests
US Offers $10 Million Reward for Iranian IRGC Cyber Commander Amir Yaryab
APT28 Expands Espionage with New HOOKEDGE Backdoor Targeting European Organizations