JEDI-SEC | Security Research & Digital Defense

Tag: Department of Justice (DOJ)

  • Defense and aerospace firm settles with government over allegedly failing to meet cybersecurity contract requirements

    A Delaware-based defense and aerospace company has settled a case with U.S. agencies over government allegations that the firm neglected its cybersecurity obligations in its contracts.

    ILC — the name the government uses to collectively refer to ILC Dover and ILC Astrospace — agreed to pay $13 million to resolve the False Claims Act allegations involving its contracts with the Department of the Army, Missile Defense Agency and National Aeronautics and Space Administration.

    ILC, according to the government, submitted false or fraudulent claims for payment on contracts with the agencies because it knew it hadn’t complied with the contracts’ cybersecurity requirements over a period between 2018 and 2024.

    For instance, ILC allegedly used a third-party company to store sensitive data in the cloud without proper safeguards, and didn’t develop and update mandated security plans for each of its covered information systems.

    “The best response to cyberattacks is to prevent them from happening in the first place,” Benjamin Wallace, U.S. Attorney for the District of Delaware, said in a news release Tuesday. “The obligations that ILC violated exist to prevent bad actors from taking advantage of the United States’ technical innovation.” 

    American industrial manufacturing giant Ingersoll Rand, the parent company of ILC Dover, said it inherited the issue when it purchased the firm.

    “We became aware of this matter following our acquisition of ILC Dover in June 2024, took prompt action to address the identified issues, and were in compliance with applicable requirements by October 2024,” said Sara Hasell, a spokesperson for Ingersoll Rand. “We have agreed to resolve this matter with the U.S. Department of Justice without an admission of liability and remain committed to maintaining strong cybersecurity practices.”

    The $13 million settlement is one of the bigger settlements since the Justice Department began using the False Claims Act in 2022 to penalize contractors over cybersecurity shortcomings. The False Claims Act is a Civil War-era law passed to deal with fraudulent contractors.

    “To protect sensitive information from cyber threats, defense and aerospace contractors must comply with the cybersecurity requirements in their federal contracts and subcontracts,” said Assistant Attorney General Brett Shumate of the Justice Department’s Civil Division. 

    Under the law, a private citizen can raise allegations that the contractor defrauded the government and is entitled to receive a portion of any settlement. The whistleblower in the ILC case, Philip Root, the company’s former director of cybersecurity, will receive $2.35 million.

    Government contract attorneys say that a forthcoming regulatory overhaul could expose more companies to False Claims Act punishments.

    Source: CyberScoop · 2026-11-03

  • Defense contractor pleads guilty to aiding North Korean remote worker scheme

    A defense contractor with top secret security clearance pleaded guilty to aiding North Korea’s remote worker scheme by allowing co-conspirators to use his identity to apply for jobs, including positions with national security implications, the Justice Department said Wednesday. 

    John Allen Kurrle Jr. participated in a short-lived but prolific conspiracy that spanned at least 88 job applications at U.S.-based companies, resulting in nine job offers, according to court records.

    The 62-year-old allowed co-conspirators to use his identity and government clearance for prospective sensitive work, often with U.S. government contractors. The nine job offers Kurrle’s co-conspirators received between June and October 2025 had annual salary ranges of $120,000 to $190,000.

    The scheme had a limited success rate. The longest and most lucrative job a co-conspirator landed under Kurrle’s identity lasted about three weeks, netting a total pay of $4,800.

    His identity was also used to gain employment as a software engineer at a Ventura, California-based company to work on a generative AI project for a component of the U.S. military. The company sent a laptop to Kurrle’s residence in Gainesville, Virginia, where he received and hosted laptops shipped by multiple victim companies, enabling co-conspirators to remotely access the devices from outside the United States.

    Yet, during a video call to verify employment eligibility, the company noticed that the person who appeared on the video call did not match Kurrle’s age or physical characteristics, according to court records. The unnamed company terminated the employment of Kurrle’s co-conspirator before he did any work on the military contract and Kurrle shipped the laptop back to the company. 

    The company paid Kurrle’s co-conspirator almost $2,200 for 32 hours of onboarding, which Kurrle is now ordered to pay in restitution along with the $4,800 received from the other company. 

    Kurrle also, as part of his plea agreement, admitted to using the identity of a third person, without their consent, to apply for some remote work positions. He doesn’t dispute that the scheme likely benefitted North Korea, but claims he wasn’t aware of the connections to North Korea during the duration of his involvement in the conspiracy.

    Michael Barnhart, nation state investigator at DTEX, said researchers previously identified Kurrle as a facilitator for North Korea’s remote worker scheme. Yet, until recently, he wasn’t sure if Kurrle was a victim or impersonated. 

    The case underscores North Korea’s efforts to gain access to roles with a strategic intelligence requirement, as it focuses on contractor roles because those present the path of least resistance.

    Kurrle joins a growing list of people who have been charged or jailed for supporting the North Korea regime’s scheme that generates hundreds of millions of dollars annually for the country’s military and organizations involved in its weapons programs.

    Authorities have been cracking down on the malicious insider activity by seizing cryptocurrency linked to the theft, and targeting U.S.-based facilitators who provided forged or stolen identities and hosted laptop farms for North Korean operatives. 

    Some of that money is also funneling through a web of front companies and intermediaries, including sanctioned entities, that partly fund Russia’s war effort against Ukraine, DTEX said in a report in July. This includes manufacturing weapons and supplying them to Russia’s military, according to the security firm.

    The countermeasures are stacking up, but the scheme is widespread and has infiltrated an undetermined number of businesses, including hundreds of Fortune 500 companies.

    Federal judges previously sentenced other people to prison for their involvement in the scheme, including Matthew Issac Knoot and Erick Ntekereze Prince; Keija Wang and Zhenxing Wang; Audricus Phagnasay, Jason Salazar and Alexander Paul Travis; Oleksandr Didenko and Christina Chapman. 

    Kurrle pleaded guilty to conspiracy to commit wire fraud and faces up to 20 years in prison upon sentencing, which is currently scheduled for Jan. 28, 2027.

    Source: CyberScoop · 2026-10-30

  • Syrian hacker who served Assad regime gets 42 months in US prison

    A Syrian man who prosecutors say was a central figure in a hacking operation run from former President Bashar Assad’s inner circle was sentenced Thursday to 42 months in federal prison.

    Ahmad Umar Agha, 42, carried out the conspiracy from as early as Aug. 24, 2011, until Jan. 31, 2024, according to the Justice Department. The operation was organized and led by members of Assad’s circle, including the commander of Syria’s General Intelligence Directorate.

    Agha hacked approximately 47 media entities, businesses, nongovernmental organizations and U.S. and allied government bodies, prosecutors said. The motives included punishing news organizations for reporting on Syrian government atrocities during the Arab Spring and the civil war that followed, spreading fear and confusion among the regime’s opponents, collecting intelligence and trying to persuade members of the U.S. military to refuse their orders.

    “Agha deployed his hacking skills in the service of Assad’s regime to silence reporting on the regime’s atrocities, intimidate its opponents, and incite U.S. servicemembers to refuse their orders,” said Assistant Attorney General for National Security John A. Eisenberg.

    The most damaging intrusion came April 23, 2013. Prosecutors said Agha accessed the Twitter account belonging to the Associated Press to post a false claim that President Barack Obama had been injured in two explosions at the White House. The post triggered a flash crash, briefly erasing $136 billion in value from the stock market. 

    In another intrusion, Agha, who used the hacker handle, “Th3 Pr0,” compromised the company hosting the U.S. Marine Corps’ recruitment website and redirected about 3,500 visitors to an image urging Marines to refuse their orders and fight alongside the Syrian Army. On two occasions, he stole usernames and passwords for White House staff email accounts in attempts to take control of the White House’s social media accounts. In one instance he succeeded, prosecutors said.

    The costs to victims were significant. One company that works with online publishers lost about $35,000 a day for roughly six months. A global nongovernmental organization spent about $250,000 on new network monitoring products, retrained more than 800 staff members and suffered $480,000 in total losses.

    “This case emphasizes the grave threat posed by cyber criminals and especially those serving regimes hostile to the United States,” said First Assistant U.S. Attorney Theophani K. Stamos for the Eastern District of Virginia.

    Agha and coconspirator Firas Dardar were first charged by criminal complaint June 12, 2014, and indicted May 17, 2018. Dardar remains a fugitive. He was also charged in 2015 in a separate conspiracy alongside Peter Romar, a Syrian national then living in Germany, that involved computer intrusion, extortion, money laundering and violations of the Syrian Sanctions Regulations. Romar was extradited from Germany and pleaded guilty in 2016.

    Assad’s regime collapsed in December 2024, and the former president fled the country.

    Source: CyberScoop · 2026-10-30

  • Officials seize domain of top bulletproof hosting provider Virtualine

    Authorities seized the domain of Virtualine, a bulletproof hosting provider that cybercriminals used to commit a large-scale sextortion scheme, ransomware, data theft, malware hosting and money laundering, the Justice Department said Tuesday. 

    Virtualine facilitated prolific criminal activity, including the distribution of child sexual abuse material (CSAM), the Justice Department said. The Russian-speaking bulletproof hosting provider was among the most active this year in crypto-related crime in particular, researchers said. 

    The site and its associated infrastructure stands out among the dozens of bulletproof hosting providers currently tracked by TRM Labs. “It was not among the largest by total inflows, but it received the most illicit-attributed value in 2026 to date,” the blockchain and cryptocrime research firm wrote in a blog post.

    Virtualine received almost one-fifth of all illicit-attributed inflow among bulletproof hosting providers tracked by TRM this year to date.

    A Russian drug marketplace accounted for nearly 44% of the direct payments Virtualine received from customers and attributed counterparties so far this year, according to TRM. A sextortion scheme accounted for nearly 17% of direct payments to Virtualine, followed by a cryptocurrency mixer at almost 13%, ransomware at nearly 5%, cybercrime services at 3% and malware at 2%.

    “Virtualine is another example of Russia’s illicit economy at work: darknet markets, ransomware groups, non-compliant exchanges, and brokers all feeding the same ecosystem,” Ari Redbord, global head of policy at TRM Labs, said in a prepared statement. 

    “Bulletproof hosting is the connective tissue. Seizing a domain matters, but the blockchain record doesn’t disappear with it. It shows who is paying, who is getting paid, and where they go next,” he added. 

    Virtualine attracted many criminals as customers. Ransomware groups, including Coinbase Cartel, The Gentlemen, INC, DragonForce and Qilin all paid the site’s operators, according to TRM. The bulletproof hosting provider also received payments from the StealC infostealer, the Matanbuchu loader, bot and malware-distribution services and sites linked to CSAM. 

    The FBI and prosecutors got a court order to seize Virtualine’s primary domain, which was also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech.

    Officials said Virtualine continued hosting services for a customer that distributed CSAM and a hack-for-hire service after it received numerous notices from law enforcement in Germany, Canada, Australia, the National Center for Missing and Exploited Children and a victim’s attorney.

    TRM underscores that Virtualine was disrupted, but not completely shut down. “A domain seizure disrupts how customers find and access a service,” researchers wrote. “It does not, by itself, establish that the operator has stopped working, or that customers have lost access to all underlying infrastructure.”

    Source: CyberScoop · 2026-10-29