In December 2024, Russian cybersecurity giant Kaspersky Lab completed its exit from the US market after being banned the from doing business in the United States by the Bureau of Industry and Security. Regulators notified Kaspersky in June 2024 that it needed to exit the US market by December 2024 due to the national security risks it posed to the United Sates. In September 2024, overnight and without their permission, Kaspersky anti-virus users in the United States were automatically transferred to UltraAV anti-virus software, which is owned by Pango Group. Unlike Kaspersky, Pango Group is an obscure company, and little information is publicly available about who controls the group and whether Kaspersky plays a role in the company.

FiveBy found that Pango Group and its associated companies have a history of partnering with Kaspersky, presenting cybersecurity and regulatory risks for users and companies with a US nexus.

Note: Kaspersky Lab is part of a group of companies under the Kaspersky corporate umbrella. This article uses “Kaspersky” to refer to this group of companies.

Background  

In September 2024, US users of Kaspersky Antivirus saw their antivirus software switch overnight to UltraAV, an antivirus product from an obscure company, Pango Group. The switch came after US regulators warned in June 2024 that Kaspersky and all its affiliates would be banned from selling its products in the United States starting in December 2024.

Pango Group and its web of associated companies carry a two-fold risk, despite not being under the Kaspersky brand:

• Regulatory: Risk of fines and penalties by US regulators as UltraAV may be controlled by and may share user data with Kaspersky and its third parties.
• Cybersecurity: A high risk that data could be exposed to Russian intelligence and military organizations.

In-depth research, such as the below report, paired with a risk assessment tailored to a company’s regulatory and cybersecurity compliance standards can help companies determine whether doing business with Pango Group and its associated companies fits their risk appetite.

Pango Group’s Kaspersky Connection

Since its ban from operating in the United States, along with export controls that could result in civil penalties for companies with a US nexus, Kaspersky has completed several transitions and mergers that position it to continue benefiting from its legacy products while exposing its users to multiple risks. One of the most notable changes involves Kaspersky Labs and Pango Group.

In September 2024, Kaspersky Labs reached an agreement with Pango Group to automatically transition all US Kaspersky customers to Pango’s UltraAV antivirus product, which included different features than Kaspersky’s product and has not been tested by the Anti-Malware Testing Standards Organization, the international cybersecurity industry’s testing standard.

Kaspersky and Pango did not publicly disclose the details of their agreement, including which Pango Group company was specifically involved in the transition and whether Kaspersky would profit from the agreement. Despite lack of an official disclosure, FiveBy was able to identify Pango Group’s corporate structure.

A Tangled Web of Tech Companies

The companies behind the UltraAV antivirus software have gone by many names, including Aura, Pango Group, and Point Wild. In July 2019, Intersections Inc. and iSubscribed combined services and renamed themselves Aura. In July 2020, Aura merged with Pango Group. In September 2024, Pango and Aura separated. Pango and Kaspersky Labs also agreed to transition all US Kaspersky users to UltraAV.

Finally, in December 2024 Pango Group merged with Total Security to form Point Wild, its current form. Point Wild is a holding company for UltraAV and other brands. UltraAV antivirus software can be traced back to Max Secure Software India Private Limited, which was acquired by Aura Group in March 2023.

Kaspersky Partnerships

UltraAV, Aura, and Pango have a history of partnering with Kaspersky, though FiveBy did not find evidence showing that Kaspersky controls these companies.

• Pango: Pango CTO Dr. Zulfikar Ramzan stated that Pango has partnered with Kaspersky for many years, with Kaspersky licensing Pango’s VPN technology. Pango’s AnchorFree technologies are used in the Kaspersky Secure Connection service.
• AnchorFree: In 2019, US Senators raised concerns about foreign VPNs impacting state security, highlighting the long-standing partnership between Kaspersky Lab and AnchorFree. Senators asked the head of federal cybersecurity to investigate the potential impact of unvetted foreign VPN services upon the security of the United States government.

National Security and Cybersecurity Risks

UltraAV’s obscurity has raised questions about its connection to the Kaspersky Group, particularly whether purchasing and using the product ultimately benefits Kaspersky Group despite the change in name. These questions are vital for UltraAV users; if UltraAV is still connected with the Kaspersky Group, user data might be accessed by Russia’s military and intelligence, creating a risk for US national security.

Kaspersky Group’s associations with Russia’s military and intelligence led to US restrictions on the company. When regulators at the newly created US Office of Information and Communications Technology and Services (OICTS) announced a ban on Kaspersky from selling its products in the United States, OICTS’ overseeing department, US Commerce’s Bureau of Industry and Security (BIS), added three Kaspersky entities to its Entity List due to these concerns about its collaboration with Kremlin cyber intelligence.

Separate from the OICTS restrictions barring Kaspersky from operating in the United States, BIS Entity List restrictions require US companies to comply or face penalties. US companies doing business benefiting Kaspersky, even indirectly, risk fines, criminal penalties, and reputational damage.

Industry Implications for Customer Due Diligence and Risk Management

• Risk Management: FiveBy’s findings highlight several cybersecurity and regulatory issues with UltraAV software and transacting with its associated companies.
• Regulatory Compliance: The OICTS Kaspersky ban underscores the importance of staying ahead of geopolitical and regulatory changes that could impact cybersecurity operations.
• Vendor Due Diligence: UltraAV’s possible ties to Kaspersky and Russian military and intelligence illustrates the need for rigorous cybersecurity assessments of third-party vendors, especially when automatic software replacements occur.

Conclusion

UltraAV’s links to Kaspersky warrant continued vigilance. Businesses need to conduct a thorough risk assessment and due diligence to prevent regulatory or legal consequences. The UltraAV case demonstrates the complex interplay of technology, regulation, and global security. FiveBy recommends embracing risk-based due diligence practices to navigate the ever-changing landscape.

FiveBy Solutions supports businesses in determining their risk appetite and risk exposure through risk assessment and investigation services Our risk intelligence teams include sanctions and export controls experts with regional and linguistic expertise specializing in highly sanctioned regions such as Russia and China and can help ensure that firms are fully compliant with US and international regulations.