U.S. Charges Sensitive Software Contractor for Allegedly Hiding its Russia Ties, Including to the FSB

By Ian Talley, Ryan Bacic, and Kharon Research

The U.S. arrested the CEO of a Northern Virginia-based software company this week, charging him with conspiracy to commit wire fraud for allegedly concealing the Russian ownership and control of his firm to acquire government contracts.

The Justice Department said that Lee Reiber, 55, and Russian national Oleg Davydov, who was arrested Sunday in London, had also concealed that the company’s software was developed in Russia.

The affidavit alleges that Alexandria, Va.-based Oxygen Forensics, Inc. had presented itself to the government, including the Defense Department and Department of Homeland Security, “as being an independent, U.S.-based company” while, in fact, “Davydov and four other Russian nationals owned and controlled the company through a holding company based in Cyprus.”

Kharon research had traced Oxygen Forensics’ ownership up through that Cypriot company. It revealed a network with links to the Russian state — including to the Russian Federal Security Services, or FSB — beyond what the U.S. describes.

Quick bio: According to legal documents filed by Oxygen Forensics in a separate civil matter, the company provides the software and services used to tap into smartphones, computers, cloud accounts, drones, vehicles, and other electronic devices for law enforcement, national security agencies and the military.

Oxygen Forensics has secured dozens of contracts over more than a decade, according to a federal procurement database and Oxygen Forensic’s legal filings, including for the Secret Service, the Defense Department, the State Department, the Federal Bureau of Investigation, the Department of Homeland Security, and the Treasury Department.

Why it matters: Such software access could provide insight into detailed operations of the federal government’s most important national security agencies.

The parent company: While Oxygen Forensics operates in the U.S., it is a wholly owned subsidiary of Cyprus-based Oxygen Forensics Limited, according to the latter’s 2024 annual report.

Among the parent company’s main shareholders is the Virginia company’s chairman and president, listed as a Turkish national named Osman Fatih. The remaining shareholders in Cyprus are a group of Russian citizens who previously owned a Moscow-based digital-forensics software company, MKO Systems LLC.

MKO Systems, originally established in 2001 as Oksidzhen Softver ZAO (Oxygen Software CJSC), was restructured and rebranded in 2015. According to an archived version of MKO Systems’ website, its clients as of 2021 included Russia’s FSB, Ministry of Internal Affairs, and Ministry of Justice.

A chart headlined "A Chain of Russians in a U.S. Contractor's Network" shows how Oxygen Forensics connects to Russian owners and Russian companies, including one (MKO Systems) that has sold to the Russian government.

The allegations: After the onset of U.S. sanctions in early 2022, “Davydov, Reiber, and the Russian co-conspirators agreed to conceal Oxygen Forensics’ true ownership and the development of its software in Russia,” the Justice Department said Wednesday. “Reiber was installed as the company’s CEO, president, and chairman of the board in March 2022. The Russian owners were then removed from the company’s public corporate filings,” though they still “controlled its decisions.”

According to a complaint affidavit filed by a Commerce Department special agent, Oxygen Forensics falsely claimed in its contract certifications that it had no immediate or higher-level owner, despite its Russian founders and owner directing and controlling the company.

Reiber, a former Boise police officer, also denied Russian ownership in a March recorded call with undercover agents posing as DHS contracting personnel, the agent said.
“Procurement officials have stated that they would not have awarded or renewed contracts for the FORENSIC SOFTWARE had they known OXYGEN US was Russian-owned or controlled,” the agent said.

The Justice Department said the complaint does not allege that Oxygen Forensics’ software contained malicious code, nor that it was used to gain unauthorized access to any customers’ computer systems or data. But a former Oxygen Forensics employee said in separate civil-court filings that he had warned U.S. security officials and government clients that the company’s Russian ties, including to the FSB, represented a supply chain risk and advocated for the company to be sanctioned.

Neither Oxygen Forensics nor Reiber’s attorneys immediately responded to requests for comment.

What Kharon research shows: Another founder of MKO’s predecessor firm was the Moscow Research Institute of Radio Communication, a state-licensed developer of aviation and space technology. It’s currently led by Eduard Benderskiy, a sanctioned former FSB official who has also been connected to the sanctioned cybercriminal syndicate Evil Corp.

“Benderskiy leveraged his status and contacts to facilitate Evil Corp’s developing relationships with officials of the Russian intelligence services,” the U.S. Treasury Department wrote when designating him in 2024.
Benderskiy is the father-in-law of Evil Corp leader Maksim Yacubets, whom Treasury sanctioned in 2019. Yacubets is wanted by the FBI under a $5 million bounty for allegedly using malware and ransomware to steal over $100 million.

An FBI notice for Maksim Yacubets says he is "wanted for his involvement with computer malware that infected tens of thousands of computers in both North America and Europe, resulting in actual financial losses in the tens of millions of dollars."

A reshuffle: On paper, it’s no longer clear who owns MKO Systems, the U.S. firm’s apparent affiliate in Moscow. The Russian owners of Oxygen Forensics’ Cyprus-based parent — Sergey Sokolov, Galina Rabotenko, and Oleg Davydov, the man authorities arrested in London — all sold their stakes in MKO in November 2023, according to a corporate registry of Russian entities.

Yet MKO’s owner since then, records say, has been a Russian joint stock company that was formed just a month before. It does not disclose its ownership.

Meanwhile: MKO Systems was a listed partner for a July conference in St. Petersburg on countering digital crime. Other participants, according to the conference’s website, included multiple Russian military contractors and government entities.

The FSB was among them.

Read more from The Brief:

Back to The Brief