Tag: russia
-
Signal Phishing Campaign Targets German Officials in Suspected Russian Operation
Suspected Russian phishing via Signal targeted German officials, exploiting trust to access accounts and sensitive political communications. A new wave of cyber operations targeting European political leadership is once again highlighting how modern espionage increasingly relies on deception rather than technical exploits. Recent investigations by German authorities point to a large-scale phishing campaign conducted via…
-
Signal Phishing Campaign Targets German Officials in Suspected Russian Operation
Suspected Russian phishing via Signal targeted German officials, exploiting trust to access accounts and sensitive political communications. A new wave of cyber operations targeting European political leadership is once again highlighting how modern espionage increasingly relies on deception rather than technical exploits. Recent investigations by German authorities point to a large-scale phishing campaign conducted via…
-
Signal Phishing Campaign Targets German Officials in Suspected Russian Operation
Suspected Russian phishing via Signal targeted German officials, exploiting trust to access accounts and sensitive political communications. A new wave of cyber operations targeting European political leadership is once again highlighting how modern espionage increasingly relies on deception rather than technical exploits. Recent investigations by German authorities point to a large-scale phishing campaign conducted via…
-
VECT: Ransomware by design, Wiper by accident
ey Takeaways Background VECT Ransomware is a Ransomware-as-a-Service (RaaS) program that made its first appearance in December 2025 on a Russian-language cybercrime forum. After claiming their first two victims in January 2026, the group got back into the public eye due to an announcement of a partnership with TeamPCP, the actor behind several supply-chain attacks…
-
Fake YouTube Downloads Spread Vidar Malware to Steal Corporate Logins
A new Vidar infostealer campaign is abusing fake software download links on YouTube to compromise corporate employees and sell their stolen credentials on Russian cybercrime marketplaces. In the investigated case, the victim was searching for software on YouTube and likely followed a link in the video description that led to a third”‘party file”‘sharing service. From…
-
PhantomCore Exploits TrueConf Vulnerabilities to Breach Russian Networks
A pro-Ukrainian hacktivist group called PhantomCore has been attributed to attacks actively targeting servers running TrueConf video conferencing software in Russia since September 2025.That’s according to a report published by Positive Technologies, which found the threat actors to be leveraging an exploit chain comprising three vulnerabilities to execute commands remotely on susceptible First seen on…
-
Breach Roundup: Myanmar Scam Compound Managers Charged
Also, Europol Cracks DDoS Networks, Mythos Finds Bugs, France Portal Hit. This week, scam compounds. Attackers exploit flaws pre-disclosure. A crackdown on DDoS-for-hire. No Mythos for CISA, yes for Mozilla. France ID portal breach. Israeli and Venezuelan critical infrastructure targeted. Russian hacking in Ukraine. An Apache flaw. A ransomware negotiator aided BlackCat. First seen on…
-
RAMP Uncovered: Anatomy of Russia’s Ransomware Marketplace
Leaked data from RAMP reveals Russia’s ransomware ecosystem, analyzing 1,732 threads, 7,707 users, and 340,000 IP records from the forum. RAMP was not just another dark web forum. It was one of the clearest examples of how ransomware has become an organized marketplace, with sellers, buyers, brokers, and recruiters all playing different roles in the…
-
Russian Hacking Reaches New Levels of Hostility
Nation-State Hits Now Comprise Majority of Serious Incidents Probed by Government. British intelligence officials said they investigate about four major incidents per week, with the majority involving nation-state actors. Officials said the shape and scope of how cyberattacks are being wielded by the nation’s adversaries continues to change as fast as the technology evolves. First…
-
Russians Hacking Reaches New Levels of Hostility
Nation-State Hits Now Comprise Majority of Serious Incidents Probed by Government. British intelligence officials said they investigate about four major incidents per week, with the majority involving nation-state actors. Officials said the shape and scope of how cyberattacks are being wielded by the nation’s adversaries continues to change as fast as the technology involves. First…
-
Hackers Tie Iranian Espionage to CastleRAT and ChainShell
A direct operational link between Iran’s MuddyWater espionage group and the Russian TAG-150 CastleRAT malware-as-a-service (MaaS) platform, showing how state and criminal ecosystems are now tightly intertwined. Investigators recovered 15 malware samples, including at least two CastleRAT “builds” and a PowerShell script named reset.ps1 that deploys a previously undocumented JavaScript/Node.js agent dubbed ChainShell. On this server, two native…
-
EU targets two Russian propaganda networks with new sanctions
The measures target Euromore, a media outlet that EU officials say amplifies Kremlin narratives, and the Foundation for the Support and Protection of the Rights of Compatriots Living Abroad (Pravfond), a Moscow-funded group accused of promoting propaganda aligned with Russia’s foreign policy. First seen on therecord.media Jump to article: therecord.media/eu-targets-russian-propaganda-networks-sanctions
-
EU targets two Russian propaganda networks with new sanctions
The measures target Euromore, a media outlet that EU officials say amplifies Kremlin narratives, and the Foundation for the Support and Protection of the Rights of Compatriots Living Abroad (Pravfond), a Moscow-funded group accused of promoting propaganda aligned with Russia’s foreign policy. First seen on therecord.media Jump to article: therecord.media/eu-targets-russian-propaganda-networks-sanctions
-
Ukraine busts ‘bot farm’ supplying thousands of fake Telegram accounts to Russian spies
Ukrainian authorities have dismantled a so-called “bot farm” that police say was supplying thousands of fake social media accounts to Russian intelligence services for use in disinformation campaigns against Ukraine. First seen on therecord.media Jump to article: therecord.media/ukraine-sbu-busts-bot-farm-supplying-russian-spies
-
Crypto Exchange Grinex Blames Western Spies for $13m Theft
Russian crypto-exchange Grinex claims Western intelligence agencies were behind a $13m heist First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/crypto-exchange-grinex-western/
-
Crypto Exchange Grinex Blames Western Spies for $13m Theft
Russian crypto-exchange Grinex claims Western intelligence agencies were behind a $13m heist First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/crypto-exchange-grinex-western/
-
Kyrgyzstan-based crypto exchange Grinex shuts down after $13.7M cyber heist, blames Western Intelligence
Grinex halted operations after a $13.7M hack, blaming Western intelligence. Stolen funds came from wallets of Russian users on the platform. Kyrgyz crypto exchange Grinex halted operations after a threat actor stole $13.7 million in a cyber attack that the company attributes to Western intelligence agencies. The stolen funds belonged to Russian users, as the…
-
JUMPSEC Unmasks Iranian ‘Muddy Water’ Using Russian ‘CastleRAT’ Malware
The post JUMPSEC Unmasks Iranian ‘Muddy Water’ Using Russian ‘CastleRAT’ Malware appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/muddy-water-castlerat-chainshell-malware-alliance/
-
Sweden blames Russian hackers for attempting ‘destructive’ cyberattack on thermal plant
Sweden’s minister for civil defense said Russian hackers are “now attempting destructive cyber attacks against organizations in Europe.” First seen on techcrunch.com Jump to article: techcrunch.com/2026/04/15/sweden-blames-russian-hackers-for-attempting-destructive-cyberattack-on-thermal-plant/
-
Sweden reports cyberattack attempt on heating plant amid rising energy threats
Sweden says a pro-Russian group attacked a heating plant in 2025. The failed cyberattack highlights growing threats to Europe’s energy infrastructure. Sweden has blamed a pro-Russian group linked to Russian intelligence for a failed cyberattack on a heating plant in 2025. Officials say the incident is part of a broader wave of attacks targeting critical…
-
Mirax RAT Targets Android Devices Through Meta Apps
Malware-as-a-Service Operations Favors Russian-Speaking Customers. An emerging remote access Trojan targeting Android devices in Spanish-speaking nations is propagating fraudulent advertisements as an initial access point on Meta-owned applications. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/mirax-rat-targets-android-devices-through-meta-apps-a-31421
-
Russia appears to block social media platform Bluesky amid wider internet restrictions
Russian digital rights organization RKS Global told Recorded Future News that Bluesky had been added to the registry of banned websites maintained by Russia’s communications watchdog Roskomnadzor. First seen on therecord.media Jump to article: therecord.media/russia-cracks-down-bluesky-internet
-
State-sponsored threats: Different objectives, similar access paths
A look at 2025 state-sponsored threats, exploring how actors linked to China, Russia, North Korea, and Iran use vulnerabilities, identity, and trusted access paths to achieve their goals. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/state-sponsored-threats-different-objectives-similar-access-paths/
-
UK says it exposed Russian submarine activity near undersea cables
A Russian attack submarine and vessels from the country’s Main Directorate of Deep Sea Research (GUGI) were involved in what the UK Ministry of Defence called “nefarious activity over critical undersea infrastructure elsewhere.” First seen on therecord.media Jump to article: therecord.media/uk-says-it-exposed-russian-submarine-activity
-
MuddyWater Uses Russian MaaS in New ChainShell Attack
MuddyWater is now weaponizing a Russian malware-as-a-service (MaaS) platform to run a new operation dubbed “ChainShell”, blending Iranian state targeting with commercially developed cybercrime tooling. The assessment is based on a misconfigured command”‘and”‘control (C2) web server, 15 malware samples, and a previously undocumented JavaScript/Node.js payload named ChainShell. Investigators conclude that MuddyWater is running at least…
-
Russia’s ‘Fancy Bear’ APT Continues Its Global Onslaught
Victims don’t need to match the cybercrime group’s technical sophistication, experts say. But patching and some form of zero trust are now non-negotiable. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/russias-fancy-bear-apt-continues-global-onslaught
-
Inside the FBI’s router takedown that cut off APT28’s ‘tremendous access’
FBI cyber chief Brett Leatherman told CyberScoop the Russian GRU campaign was unique in how it could propagate from routers to beyond. First seen on cyberscoop.com Jump to article: cyberscoop.com/fbi-operation-masquerade-russian-gru-router-takedown-brett-leatherman/
-
Russia accuses former Radio Free Europe journalist of aiding cyberattacks for Ukraine
In a statement to state-owned media, the FSB said the suspect joined a Telegram channel controlled by the Security Service of Ukraine (SBU) and passed information about a local print publication covering Russia’s war in Ukraine. First seen on therecord.media Jump to article: therecord.media/russia-accuses-radio-free-europe-journalist-aiding-ukraine-cyberattack