[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIfJQzQU5nUEilurHCMgVnq-5DgQyQFdOkzYIwEpTNjQ":3},{"article":4,"iocs":55,"watch_terms":56,"solutions":57,"lesson":60},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"08519625-d30c-451a-8a44-f39dcd55694f","Phone-hacking company that won U.S. security agency contracts hid Russian ownership, DOJ alleges","phone-hacking-company-that-won-u-s-security-agency-contracts-hid-russian-ownersh-cfcbb5","The Justice Department said two leaders of the company have been arrested and face conspiracy to commit wire fraud. The post Phone-hacking company that won U.S. security agency contracts hid Russian ownership, DOJ alleges appeared first on CyberScoop.","The U.S. Justice Department has arrested two leaders of Oxygen Forensics, a company accused of masking its Russian ownership to secure millions in contracts with U.S. security agencies like the Defense Department and Homeland Security. The company allegedly presented a U.S. CEO while Russian nationals secretly controlled operations, a fact that would have disqualified them from government contracts, especially after sanctions were imposed following Russia's invasion of Ukraine. This revelation raises concerns about sensitive data extraction technology being used by both U.S. law enforcement and Russian agencies against dissidents.","DOJ arrests two leaders of Russian-owned phone hacking firm Oxygen Forensics for hiding ownership from US agencies.","https:\u002F\u002Fcyberscoop.com\u002Foxygen-forensics-ceo-arrested-russian-ownership-fraud\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F09\u002FGettyImages-2252317890.jpg","2026-09-24T17:07:31+00:00","2026-09-24T20:00:36.443544+00:00",8,[17,20,23,25,28,30],{"name":18,"type":19},"Oxygen Forensics","product",{"name":21,"type":22},"Oxygen US","vendor",{"name":24,"type":22},"Oxygen Russia",{"name":26,"type":27},"Kremlin agencies","threat_actor",{"name":29,"type":27},"Russian Federal Security Service",{"name":31,"type":27},"DOJ","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,24,18],{"controls":58,"vendors":59},[],[],{"slug":61,"title":62,"body":63,"framework_refs":64,"framework_notes":75},"hidden-russian-ownership-exposes-critical-supply-chain-risk-in-us-security-contracts","Hidden Russian Ownership Exposes Critical Supply Chain Risk in U.S. Security Contracts","Oxygen Forensics allegedly concealed Russian national control of its operations behind a U.S.-facing CEO, allowing it to win sensitive government contracts it would have been categorically denied under proper vetting. This case illustrates how adversarial actors can exploit gaps in vendor due diligence to embed themselves inside the national security apparatus, gaining access to sensitive data extraction tools and potentially the data itself. The dual-use nature of the forensic technology — used by both U.S. law enforcement and Russian agencies against dissidents — amplifies the geopolitical damage. It matters because the trust placed in government vendors must be backed by rigorous, continuous ownership verification, not just surface-level disclosures at contract inception.",[65,66,67,68,69,70,71,72,73,74],"NIST SP 800-161 (Supply Chain Risk Management)","NIST SP 800-53 SA-12 (Supply Chain Protection)","NIST SP 800-53 AC-2 (Account Management)","CIS Control 15 (Service Provider Management)","CMMC Level 2 - SC.L2-3.13.1 (Supply Chain Risk)","DFARS 252.204-7012 (Safeguarding Covered Defense Information)","Executive Order 13873 (Securing the Information and Communications Technology Supply Chain)","GDPR Article 28 (Processor Obligations and Sub-processing Transparency)","ITIL Service Design – Supplier Management Process","FAR 52.204-23 (Prohibition on Contracting for Hardware\u002FSoftware from Certain Entities)",{"NIST SP 800-53 AC-2 (Account Management)":76,"CIS Control 15 (Service Provider Management)":77,"NIST SP 800-161 (Supply Chain Risk Management)":78,"NIST SP 800-53 SA-12 (Supply Chain Protection)":79,"CMMC Level 2 - SC.L2-3.13.1 (Supply Chain Risk)":80,"ITIL Service Design – Supplier Management Process":81,"DFARS 252.204-7012 (Safeguarding Covered Defense Information)":82,"GDPR Article 28 (Processor Obligations and Sub-processing Transparency)":83,"FAR 52.204-23 (Prohibition on Contracting for Hardware\u002FSoftware from Certain Entities)":84,"Executive Order 13873 (Securing the Information and Communications Technology Supply Chain)":85},"Managing accounts for vendor personnel limits what a supplier with hidden foreign control can access within government systems.","Service provider management includes due diligence on ownership and control, the gap exploited to win sensitive contracts.","Supply chain risk practices include verifying supplier ownership and control, which would have exposed Oxygen Forensics' concealed Russian control.","Supply chain protection requires vetting suppliers and their ownership before awarding sensitive contracts for forensic tools.","CMMC requirements push contractors to manage supply chain risk, including understanding who controls the tools and vendors they rely on.","Supplier management includes verifying vendor background and ownership, which would have revealed the concealed Russian control.","This clause requires safeguarding covered defence information, which is at risk when a vendor with concealed foreign ownership handles it.","Controllers must know their processors and sub-processors, so concealed foreign control over a data-handling vendor undermines that transparency.","This rule bars contracting for equipment from certain entities, showing why accurate ownership disclosure by vendors is essential.","This order targets ICT products from foreign adversaries, the risk created when a vendor hides Russian control."]