US Charges Russian Ex-Kaspersky Employee With Hacking in Finance Sector
Background and Details of the Hacking Case
By Raphael Satter and Anton Zverev
July 15 (Reuters) - A computer expert facing U.S. hacking charges previously held a senior position at Moscow-based antivirus firm Kaspersky Lab, according to a person familiar with the matter and records reviewed by Reuters.
Denis Obrezko’s Employment History
Denis Obrezko, who last week pleaded not guilty to computer crimes at a hearing in Boston, worked as a senior specialist for Kaspersky between 2017 and 2019, according to leaked salary documents and a former colleague. U.S. prosecutors have said that Obrezko spent the preceding five years working for Russia's domestic intelligence service, known as the FSB.
Kaspersky’s Relationship with the Russian Government
Although the alleged hacking activity took place after he left Kaspersky, Obrezko's background is likely to draw further attention to the company's relationship with the Russian government. One of the world's leading antivirus makers, Kaspersky was a significant presence in the United States before concerns over its ties to the Kremlin effectively froze it out of the American market.
Kaspersky’s Official Statement
In a statement, Kaspersky said, "An employee with the name specified worked at the company between 2017-2019, and we have no information on the individual’s current status. The offenses charged cannot be related to the individual’s role or responsibilities during the employment at Kaspersky."
Obrezko's lawyer, Max Nemtsev, said in an email that he was not in a position to comment on Obrezko's employment history. The FSB could not be reached for comment. The Russian Embassy in Washington has not responded to repeated questions about Obrezko's case. Russia generally denies responsibility for hacking campaigns.
Technical School Ties to Hacking
TECHNICAL SCHOOL TIES TO HACKING
Reuters could not determine Obrezko's exact responsibilities at Kaspersky during his employment there. An account on Russian social media network VKontakte that used one of his email addresses identifies him as a graduate of Moscow's Bauman University, a technical school that a consortium of European journalists last year identified as a key training ground for Russian government hackers. His specialization was information security, according to the VKontakte account and to leaked resume data reviewed by Reuters.
Bauman University did not return a message seeking comment.
Void Blizzard Hacking Campaign
VOID BLIZZARD HACKING CAMPAIGN
Documents filed by U.S. prosecutors accuse Obrezko of participation in a newly discovered hacking group known as "Void Blizzard" or "Laundry Bear." The group is alleged to have carried out the mass theft of emails and other communications from NATO-aligned European government agencies and at least 11 U.S. companies at the behest of the Russian government beginning in 2023.
Obrezko’s Role at Yutek-NN
A U.S. indictment filed last week attributes Void Blizzard to a Russian cybersecurity company called Yutek-NN, where Obrezko worked as deputy director from 2024 onward. The indictment made no mention of Obrezko's previous connection to Kaspersky, which is reported here for the first time.
Yutek describes itself on its website as a multipurpose IT firm that uses "cutting-edge technology, innovative concepts, and creative design." Russian corporate records show that the firm, which is based in the city of Nizhny Novgorod, is licensed by the FSB to develop, sell or acquire "special technical means for the covert acquisition of information."
Yutek did not return repeated messages seeking comment.
Industry and Government Reactions
Stefan Soesanto, a lecturer at the Lucerne University of Applied Sciences and Arts in Switzerland, said the prosecution of Obrezko was "a vindication for all those that are already highly critical of Kaspersky."
US and European Regulatory Actions
Kaspersky has always said it maintains its independence from the Kremlin, but the U.S. Commerce Department banned its software in 2024 over security concerns and European authorities have warned against the company.
Cybersecurity Industry and Intelligence Community Overlap
Soesanto said that the walls separating the cybersecurity industry from the intelligence community were porous, and that a revolving door between the two would not be unique to Kaspersky.
"It's really similar to how the U.S. works. It's just that the Russians don't really indict American former spies," he said.
(Reporting by Anton Zverev in London and Raphael Satter in Washington; Additional reporting by Nate Raymond in Boston and AJ Vicens in Detroit; Editing by Matthew Lewis)
