Topic · enforcement

Enforcement

DOJ Civil Cyber-Fraud Initiative cases, False Claims Act settlements, qui tam actions, court rulings, regulator fines. Use this for actions and settlements ONLY — NOT for general CISA news or routine KEV additions.

RSS feed ↗

trade-press
Vardanyan pleads guilty in $1.2M Ryuk ransomware case
The headline number is restitution, but the larger Ryuk haul dwarfs the amount tied to this plea.
Karen Serobovich Vardanyan, an Armenian national extradited from Ukraine last year, pleaded guilty to computer fraud and conspiracy to commit fraud and extortion for 2019 and 2020 Ryuk ransomware attacks, CyberScoop reported, citing DOJ. He agreed to nearly $1.2 million in restitution and faces up to 15 years. The admitted victims included U.S. companies and a Texas school; prosecutors said the broader crew received about 1,160 bitcoin, then worth more than $15 million.
JUL 10
judicial
Canadian-owned firms settle SBIR FCA claims for $223,618
This is SBIR eligibility hygiene dressed as fraud enforcement, important for documentation but not a new DOJ targeting theory.
Advanced Global Services, Paradigm Shift Technologies and Gennady Yumshtyk agreed to pay $223,618 to settle False Claims Act allegations tied to Small Business Innovation Research awards funded by the Air Force and Navy. Contractors and counsel should treat SBIR eligibility representations as FCA-sensitive contract records. The settlement is modest and SBIR-specific, so it signals continued DOJ attention rather than a broader Civil Cyber-Fraud Initiative shift.
JUL 10
trade-press
Ryuk operator pleads as Blackcat/AlphV conspirator gets 70 months
The cases show ransomware crews still get charged and sentenced through ordinary conspiracy and computer-fraud machinery.
The Record reports that a man accused of deploying Ryuk ransomware pleaded guilty Wednesday in Oregon federal court to conspiracy and computer fraud. Separately, a Florida federal court sentenced another man to 70 months for helping the Blackcat/AlphV gang extort multiple victims. The operational lesson is narrow but real: extortion infrastructure changes names faster than the charging theories do.
JUL 10
judicial
Court gives former ransomware negotiator 70 months for BlackCat conspiracy
The notable move is not the sentence length; it is DOJ treating a negotiator as part of the ransomware crew.
A federal court sentenced Angelo Martino, a 41-year-old former ransomware negotiator from Land O’Lakes, Florida, to 70 months for conspiring with BlackCat/ALPHV actors to extort multiple U.S. victims and with other former cybersecurity professionals to attack additional victims in 2023. Contractors, managed service providers and executives should read this as an insider-risk case, not just another ransomware plea. DOJ’s target was the person inside the negotiation channel, not merely the criminals outside it.
JUL 9
judicial
DOJ sentences BlackCat ransomware negotiator to 70 months
The insider threat model just moved into the negotiation room, where privilege and operational trust are supposed to reduce blast radius.
DOJ sentenced Angelo Martino, 41, of Land O’Lakes, to 70 months for conspiring with BlackCat/ALPHV actors to extort multiple victims and with other former cybersecurity professionals to attack additional victims in 2023. Contractors, managed service providers, C3PAOs and counsel should read this as counterparty-risk news: the person negotiating a ransomware demand may also understand exactly how to weaponize the response process.
JUL 9
trade-press
DOJ extradites Peter Stokes in Scattered Spider case
The operational lesson is less exotic than the travel photos: social engineering crews are still beating mature companies through humans.
The Justice Department says Peter Stokes, 19, was extradited to the United States last week and remains jailed in Chicago on conspiracy, cyber intrusion and fraud charges tied to Scattered Spider. Officials say the group has hit more than 100 businesses since 2022 and extorted more than $100 million worldwide. The alleged victims include a luxury jewelry retailer and a U.S. insurance company, which keeps this in the incident-response lane, not just the cybercrime gossip column.
JUL 2
judicial
LOGZONE pays $507,144 over Navy DFARS cyber failures
DOJ is converting DFARS control gaps into fraud exposure, which is a different problem than a bad assessment score.
LOGZONE Inc., a Huntsville, Alabama defense contractor, agreed to pay $507,144 to resolve False Claims Act liability for knowingly failing to meet DFARS cybersecurity requirements on Navy contracts. Primes, defense-industrial-base suppliers and counsel should read this as more than a contract compliance miss. DOJ’s Civil Cyber-Fraud Initiative is again treating covered defense information controls as payment-integrity conditions, with no public answer yet on whether any data was compromised.
JUN 18
trade-press
Conti developer pleads guilty over $150M ransomware conspiracy
The plea narrows a real accountability gap, while Tennessee public-sector victims remain unnamed and exposed to the case machinery.
Oleksii Oleksiyovych Lytvynenko pleaded guilty to wire fraud conspiracy after admitting he developed malware used by Conti, which the FBI ties to more than $150 million in ransom payments worldwide. Prosecutors say Tennessee victims paid about $634,000 in Bitcoin, including an undisclosed government entity whose compromise reached a sheriff’s department, emergency medical services and police. Sentencing is set for Sept. 10, with other Conti defendants still in the system.
JUN 12
judicial
Oleksii Lytvynenko pleads guilty in Conti ransomware case
The plea keeps ransomware prosecution pointed at the operators behind network failures that can spill through contractor supply chains.
Oleksii Oleksiyovych Lytvynenko, 44, pleaded guilty Wednesday to conspiracy to commit wire fraud for his role in deploying Conti ransomware, which infected more than 1,000 computers and networks worldwide. Contractors, primes and defense-industrial-base suppliers get no new compliance checklist from the plea. They do get another DOJ signal that ransomware crews are being treated as prosecutable supply-chain actors, not just faceless post-incident indicators.
JUN 12
judicial
David Duggin pleads guilty in IC kickback case
The charge is simple procurement corruption, and the release leaves almost everything operationally useful off the page.
Former intelligence community contractor David Duggin, 55, of Orrtanna, Pennsylvania, pleaded guilty in federal court in Maryland to conspiracy charges tied to a kickback scheme. DOJ says he conspired to commit offenses against the United States by soliciting and accepting kickbacks. For contractor counsel, the useful fact is the charge language; the release supplies little detail beyond it.
JUN 12
trade-press
DOJ seizes 13 alleged Chinese-intelligence domains targeting clearance holders
Federal layoffs have given foreign recruiters a cleaner opening, and DOJ is treating the job market as collection infrastructure.
Nextgov/FCW reports that the FBI and Justice Department seized 13 domains allegedly used by Chinese intelligence to recruit clearance holders through fake consulting firms. The sites advertised high-paying analyst and policy roles to current and former U.S. officials, military personnel and contractors. The risk is practical for laid-off or transitioning cleared workers: a résumé, credential handoff or paid research assignment can become the collection channel before it looks like espionage.
JUN 10
trade-press
TIGTA flags ICE safeguard gaps before 42,695 IRS disclosures
The audit turns safeguard paperwork into litigation evidence once agencies move federal tax data before closing known gaps.
FedScoop reports that the Treasury Inspector General for Tax Administration found Immigration and Customs Enforcement (ICE) did not meet Internal Revenue Service (IRS) safeguarding standards before the agencies signed their April 2025 data-sharing memorandum of understanding. Open findings from a November 2023 safeguard review had no Corrective Action Plan before signing. The transfer later yielded a court finding of roughly 42,695 unauthorized taxpayer-address disclosures, making safeguard closure a litigation fact for agency counsel, CISOs and support contractors.
JUN 9
judicial
Broadway, Cornerstone agree to $21.3M set-aside settlement
The personal payments matter as much as the corporate check: DOJ named the CEO and president in the False Claims Act resolution.
Broadway Electric Inc., Cornerstone Contracting Inc., CEO John Oehler and President Christian Blake agreed to pay $21.3 million to resolve False Claims Act allegations that they improperly obtained federal contracts reserved for service-disabled veteran-owned small businesses and other eligible small businesses. The source does not describe the alleged certification defects, so the usable lesson is narrower: set-aside eligibility allegations can pull companies and senior executives into the same settlement.
JUN 9
judicial
Nevada man pleads guilty in $1.8M Air Force bid-rigging scheme
The plea keeps DOJ’s procurement-collusion strike force pointed at base-level facility buys, where modest contracts still carry felony exposure.
Scott G. Srodes, a former shelving and storage distributor employee, pleaded guilty in the Middle District of Georgia to bid rigging and conspiracy to defraud the government. DOJ says collusive bids covered more than $1.8 million in Air Force healthcare projects at Moody Air Force Base and aircraft maintenance facilities at Nellis, funded through the Defense Logistics Agency’s Facilities Maintenance, Repair, and Operations Program. It is the second guilty plea in the investigation, with individual employees squarely in DOJ’s frame.
JUN 2
judicial
Romanian national gets 56 months for selling Oregon government network access
DOJ's willingness to extradite and prosecute foreign actors for selling stolen government access is now a data point state CISOs can put in a threat briefing.
A Romanian national was sentenced to 56 months in federal prison for breaching an Oregon state government office network in 2021 and selling that access, along with access to other U.S. victims. The case is a concrete DOJ Civil Cyber-Fraud Initiative precedent: transnational intrusion-for-sale operations targeting state and local government draw criminal prosecution and extradition, not just civil settlement. The initial access vector has not been publicly disclosed, leaving open whether the same vulnerabilities affect other state networks.
MAY 27
regulator
CISA ED 26-03 orders FCEB agencies to patch Cisco SD-WAN after active exploits
Four CVEs, one previously undisclosed authentication bypass, and a binding emergency directive mark CISA's fourth such escalation in 14 months targeting federal network infrastructure.
CISA issued Emergency Directive 26-03 requiring all Federal Civilian Executive Branch (FCEB) agencies to inventory, patch, and conduct compromise assessments on Cisco SD-WAN systems following active exploitation of four vulnerabilities, including CVE-2026-20127, a previously undisclosed authentication bypass used for initial access, and CVE-2022-20775, used for privilege escalation. CVE-2026-20133 and CVE-2026-20182 were added to the Known Exploited Vulnerabilities (KEV) Catalog in April and May 2026, respectively. Contractors and managed service providers supporting federal networks face compliance obligations or risk contract suspension. ED 26-03 includes a companion Supplemental Direction with prescriptive hunt-and-hardening guidance.
MAY 27
trade-press
CISA compresses CIRCIA town halls into four June sessions
Four days in June is the last structured window to shape mandatory incident reporting rules that lock in May 2026, so the session schedule is also a signal about how much scope remains open.
CISA consolidated its CIRCIA rulemaking town hall series from eight sessions spread across multiple months into four concentrated sessions June 15-18, after the original February schedule was cancelled during the DHS shutdown. Critical infrastructure operators and their contractors have until those sessions to weigh in on the four-day incident reporting window and 24-hour ransom payment notification requirements before the final rule publishes in May 2026. The compression from eight sessions to four, all in a single week, suggests CISA has narrowed its remaining decision surface rather than reopened the file.
MAY 23
trade-press
Contractor GitHub repo exposed privileged CISA credentials
A public repository named "Private-CISA" held AWS GovCloud and internal system credentials dating to November, and Congress is not satisfied with CISA's response.
GitGuardian discovered a public GitHub repository last week, apparently maintained by a Nightwing contractor, containing privileged AWS GovCloud credentials and internal CISA system credentials dating back to November. The repository was named "Private-CISA." CISA says no sensitive data was confirmed compromised; the researcher who found it rated it among the worst leaks he has seen and cited state-actor persistence as the primary risk. House Homeland Security ranking members Thompson and Ramirez, plus Sen. Hassan, sent separate letters Tuesday demanding briefings on affected systems, forensic findings, and contractor accountability. Both Hill letters named CISA staffing and budget cuts as a potential contributing factor.
MAY 22
trade-press
Contractor-linked GitHub leak exposes CISA, DHS credentials
A "Private CISA" repository connected to contractor Nightwing sat publicly accessible long enough that Hill Democrats are now demanding a briefing on remediation and contractor accountability.
Researcher Brian Krebs reported Monday that a GitHub repository labeled "Private CISA," linked to government contractor Nightwing, publicly exposed authentication credentials, AWS GovCloud data, and internal CISA/DHS build-and-deploy documentation. The repository has since been removed. House Homeland Security ranking member Rep. Bennie Thompson and cyber subcommittee ranking member Rep. Delia Ramirez sent a Tuesday letter to acting CISA Director Nick Andersen demanding a briefing on the breach's scope, remediation steps, and corrective actions against contractor personnel. A separate letter came from Sen. Maggie Hassan. Nightwing referred questions to CISA; CISA declined to comment on congressional correspondence. Thompson and Ramirez also flagged CISA's recent workforce reductions as a potential contributing factor. Government Executive and Nextgov/FCW have not independently verified the repository's contents.
MAY 22
trade-press
Contractor exposed CISA credentials on public GitHub repo
House Democrats want answers on how Nightwing left CISA's internal access data publicly readable, and whether staff cuts set the conditions.
Researcher Brian Krebs reported Monday that a GitHub repository linked to government contractor Nightwing exposed CISA and DHS authentication credentials, AWS GovCloud access data, and internal build-and-deploy documentation, stored in a repo labeled "Private CISA" that was later removed. Reps. Bennie Thompson and Delia Ramirez, the top Democrats on the House Homeland Security Committee and its cyber subcommittee, sent CISA acting Director Nick Andersen a letter Tuesday demanding a briefing on how the exposure occurred, what was accessed, and what corrective action is planned for the contractor personnel involved. Sen. Maggie Hassan sent a separate letter the same day. Nextgov has not independently verified the repository's contents; Nightwing referred inquiries to CISA, which declined to comment publicly.
MAY 22
trade-press
USDA OIG finds AI systems deployed without required ATOs or governance
The department has a chief AI officer and an AI inventory. It doesn't have policies, risk controls, or authority-to-operate approvals for almost any of it.
A USDA OIG report released last week found the Agriculture Department has deployed AI across supply chain risk, crop yield estimation, and permitting without completing required cybersecurity and governance controls. Almost none of the AI use cases in the FY2024 inventory carried an authority to operate. USDA has no generative AI policy, hasn't updated agency-level AI policies, and hasn't implemented minimum risk management practices for high-risk AI systems, as required by OMB guidance. The OIG also flagged shadow AI risk, noting the department relies solely on an annual employee self-report to track AI use. USDA agreed with all recommendations.
MAY 22
regulator
CISA adds Langflow, Trend Micro Apex One CVEs to KEV catalog
BOD 22-01 remediation deadlines now apply to both; non-FCEB orgs should treat the listing as a prioritization signal.
CISA added two actively exploited CVEs to the Known Exploited Vulnerabilities catalog: CVE-2025-34291 (Langflow origin validation error) and CVE-2026-34926 (Trend Micro Apex One directory traversal). FCEB agencies must remediate by the posted due dates under BOD 22-01. Non-federal organizations are not bound but CISA urges prioritized patching for both.
MAY 22
regulator
CISA adds Cisco SD-WAN auth bypass to KEV Catalog
Emergency Directive 26-03 is already live; this KEV addition raises the remediation floor for FCEB agencies.
CVE-2026-20182, an authentication bypass in Cisco Catalyst SD-WAN Controller, is now in the KEV Catalog under active exploitation. FCEB agencies must remediate per BOD 22-01. CISA has also issued Emergency Directive 26-03 and supplemental hunt-and-hardening guidance specific to Cisco SD-WAN; follow both. If mitigations are unavailable, CISA says discontinue use.
MAY 22
regulator
CISA adds Microsoft Exchange XSS to KEV Catalog
FCEB agencies have a mandatory remediation deadline; everyone else has a strong nudge.
CISA added CVE-2026-42897, a Microsoft Exchange Server cross-site scripting vulnerability with evidence of active exploitation, to the KEV Catalog on May 15. BOD 22-01 requires FCEB agencies to remediate by the posted due date. Non-federal operators are not bound but should treat KEV listing as a prioritization signal in their vulnerability management programs.
MAY 22
regulator
CISA adds seven CVEs to KEV Catalog, two from 2026
Five of the seven entries are legacy vulnerabilities from 2008-2010, suggesting active exploitation of unpatched older systems alongside two current Microsoft Defender flaws.
CISA added seven CVEs to the Known Exploited Vulnerabilities Catalog on May 20, citing evidence of active exploitation. Five are legacy flaws dating to 2008-2010: a Microsoft Windows buffer overflow (CVE-2008-4250), a DirectX null-byte overwrite (CVE-2009-1537), an Adobe Acrobat heap buffer overflow (CVE-2009-3459), and two Internet Explorer use-after-free vulnerabilities (CVE-2010-0249, CVE-2010-0806). The two current entries are a Microsoft Defender elevation-of-privilege (CVE-2026-41091) and a Defender denial-of-service (CVE-2026-45498). BOD 22-01 requires FCEB agencies to remediate by the posted due dates. All others: check your KEV posture now.
MAY 22
trade-press
NIST splits AI incident response into two separate guidance tracks
The first federal framework to distinguish attacks on AI systems from harms caused by AI systems creates two distinct playbook obligations, and leaves liability allocation unresolved.
NIST announced two parallel work streams on AI incident response at a May 14 workshop in Gaithersburg: one updating existing cybersecurity guidelines to cover attacks on AI systems, a second establishing new recommendations for AI-induced incidents including misuse, malfunction, and unintentional harms. Federal contractors and defense industrial base organizations deploying AI will eventually face more granular playbook requirements than traditional NIST 800-171 incident response controls demand. Who bears liability across the developer-deployer-user stack remains an open question NIST has not yet answered.
MAY 21
trade-press
GAO finds uneven search methods hide China-linked equipment on agency networks
Four agencies reporting zero findings while DOD and DOE found covered devices is a methodology gap, not a clean bill of health.
A May 19 GAO report on six federal agencies' compliance with the Section 899 NDAA prohibition on China-linked telecom and video surveillance equipment found that only DOD conducted physical searches, and only DOD and DOE found covered devices. DHS, DOJ, State, and Treasury all reported zero findings, but none ran physical searches. GAO identified procurement record gaps, supply-chain opacity, and rebranding as structural limits on every agency's search approach. The divergence in methods makes the zero-finding results hard to read as actual risk clearance.
MAY 21
trade-press
Draft EO sets 2030-2031 federal PQC migration deadlines for agencies and contractors
For the first time, post-quantum cryptography gets binding deadlines with teeth, closing the three-year gap since NSA told agencies to migrate without requiring them to.
A White House draft executive order would require federal agencies to migrate key establishment systems to post-quantum cryptography (PQC) by Dec. 31, 2030, and digital signatures on high-impact systems by Dec. 31, 2031. "Covered contractors" face the same 2030 key establishment deadline under NIST PQC standards. The order tasks OMB with issuing implementation guidance. Critical open questions remain: whether "covered contractors" sweeps in all subcontractors or only primes above a threshold, and what enforcement mechanism OMB will specify, the same gap that made NSA's 2022 quantum-resistant guidance effectively optional for four years.
MAY 21