A sysadmin and his partner pleaded guilty this week to being part of a “massive” international ring that sold software licenses worth $88 million for “significantly below the wholesale price.”

Brad and Dusti Pearce admitted one count of conspiracy to commit wire fraud and each face a maximum penalty of 20 years in prison. After agreeing to a plea deal, the Pearces must also forfeit at least $4 million as well as gold, silver, collectible coins, cryptocurrency, and a vehicle, and “make full restitution to their victims,” the US Department of Justice said.

The pair from Tuttle, Oklahoma – a city better known for its cattle ranchers and alfafa hay than pirated software – were alleged to have sold pirated Avaya business telephone system software licenses.

The licenses were then used to unlock features of the popular telephone system, which is used by thousands of companies around the globe. Dusti Pearce was said by prosecutors to have looked after the accounting side of the business, although only the wire fraud charge remains under the plea deal.

Brad Pearce had previously worked as a customer service employee at Avaya, and was said to have used his admin privileges to “generate tens of thousands of ADI software license keys” that he sold to his main customer, Jason Hines, as well as “other customers, who in turn sold them to resellers and end users around the globe,” said the DoJ.

Hines, an Avaya reseller from Caldwell, New Jersey, was the Pearces’ biggest client, say the feds, buying over 55 percent of the stolen licenses – and “significantly influenced how the scheme operated.” Hines ran Direct Business Services International (DBSI), a de-authorized Avaya reseller, in New Jersey.

The DoJ claims Hines suggested he and Brad Pearce work together to “corner” the market in licenses – with Pearce supposedly telling Hines that customers could not obtain same-day ADI software licenses “from anyone else for anything even close to the Pearces’ prices.”

The Pearces are said to have funneled their ill-gotten gains through PayPal (under a false name) to multiple bank accounts, after which they transferred the money to numerous other accounts as well as buying “large quantities of gold bullion and other valuable items.”

The FBI is still investigating some aspects of the case.

As we mentioned earlier this year, Avaya filed for Chapter 11 bankruptcy protection in February, but it emerged in May with a new board following a restructure, after which it hired more C-suite execs and inked a deal with purchasing consortium Sourcewell.

Microsoft is warning of an increase in adversary-in-the-middle (AiTM) phishing techniques, which are being propagated as part of the phishing-as-a-service (PhaaS) cybercrime model.

In addition to an uptick in AiTM-capable PhaaS platforms, the tech giant noted that existing phishing services like PerSwaysion are incorporating AiTM capabilities.

“This development in the PhaaS ecosystem enables attackers to conduct high-volume phishing campaigns that attempt to circumvent MFA protections at scale,” the Microsoft Threat Intelligence team said in a series of posts on X (formerly Twitter).

Phishing kits with AiTM capabilities work in two ways, one of which concerns the use of reverse proxy servers (i.e., the phishing page) to relay traffic to and from the client and legitimate website and stealthily capture user credentials, two-factor authentication codes, and session cookies.

A second method involves synchronous relay servers.