Tag: russia
-
OpenAI says it disrupted Russian and Iranian influence ops that used ChatGPT
A Latin American propaganda operation run by Russians and a cluster of Iranian fake journalist identities each had help from now-closed ChatGPT accounts, OpenAI’s safety team said. First seen on therecord.media Jump to article: therecord.media/openai-disrupts-russian-iranian-operations-chatgpt
-
Man admits to running network of 15,000 money mules for cybercriminals
A Ukrainian-Russian dual citizen has pleaded guilty to running a massive money laundering operation that laundered millions for cybercriminals worldwide. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ukrainian-russian-dual-citizen-admits-to-laundering-millions-for-cybercriminals/
-
Hackers Target Hikvision Cameras in Ukraine With RCE Exploits Amid Russian Airstrikes
Hackers targeted Hikvision surveillance devices in Ukraine during a concentrated surge of remote command execution attempts that coincided with Russian missile and drone strikes. GreyNoise documented a nine-day increase in exploitation activity from September 23 to October 1, 2026, following preliminary reconnaissance conducted on September 21. However, researchers could not establish a direct connection between…
-
OpenAI says Iran, Russia used AI journalists, think tanks to influence Western media
The two campaigns were rated 4 and 5 out of 6 for severity, the first time OpenAI has reported what it considers a high-impact influence campaigns. First seen on cyberscoop.com Jump to article: cyberscoop.com/openai-disrupts-russia-iran-ai-influence-operations/
-
Russian Spies Give ‘MatchBoil’ Malware a Stealthy Facelift
Cyber-espionage actor UAC-0099 has been steadily refining its flagship dropper in campaigns targeting Ukrainian organizations. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/russian-spies-matchboil-malware-facelift
-
Leaked chats show Russian extortion gang sending ‘agents’ into US law firms
In leaked chats, members track dozens of victims, haggle over multimillion-dollar payments and direct operatives based in the United States whom they call “agents.” First seen on therecord.media Jump to article: therecord.media/leaked-chats-show-russian-extortion-gang-sending-agents-to-law-firms
-
UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML
The Russia-aligned threat actor known as UAC-0099 has been attributed to a previously undocumented .NET infostealer and remote access trojan (RAT) codenamed ASHVEIN.According to TrendAI, the malware has been put to use in attacks targeting Ukrainian government personnel. The cybersecurity company is tracking the cluster under the name Earth Sirrush (previously SHADOW-EARTH-065).ASHVEIN, First seen on…
-
Russian-aligned spies upgrade malware used in attacks on Ukrainian transport, energy firms
Russian-aligned hackers have targeted Ukrainian transportation, manufacturing and energy companies with a constantly evolving malware strain designed to harvest system data, according to new research. First seen on therecord.media Jump to article: therecord.media/russia-ukraine-malware-transportation
-
Russia-Aligned UAC-0099 Evolves MATCHBOIL Malware
Russia-aligned UAC-0099 has steadily upgraded its MATCHBOIL downloader since 2024 First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/russia-aligned-uac-0099-evolves/
-
Major Yandex data center in Russia hit by Ukrainian drone strike
A drone strike on a large Yandex data center caused a significant disruption to the Russian tech giant’s network, with connectivity reportedly falling to around 70 percent of normal levels. First seen on therecord.media Jump to article: therecord.media/yandex-russia-drone-ukraine
-
Sandworm-Linked Group Sharpens Matchboil Downloader
Malware Has Hit Ukrainian Transport, Energy and Manufacturing Firms. Eset says Russia-aligned UAC-0099 has spent since at least 2024 refining Matchboil, a downloader used against Ukrainian organizations that now supports recurring command-and-control traffic, stronger evasion and delivery of the Matchwok backdoor. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/sandworm-linked-group-sharpens-matchboil-downloader-a-33037
-
Public sector risk and double standards over occupied Palestine
The UK bans cloud and software for Russia, but sanctions illegal Israeli settlements only narrowly while AWS, Google and Microsoft run the IT infrastructure for the occupation First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366651837/Public-sector-risk-and-double-standards-over-occupied-Palestine
-
What is MATCHBOIL? The Russia-aligned malware that installs a spying backdoor
ESET researchers traced almost two years of changes to MATCHBOIL, a downloader that the Russia-aligned group UAC-0099 uses to plant a second program on Windows machines in … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/08/matchboil-malware-uac-0099/
-
Russian cyberattacks against UK are ‘Putin Tax’ costing $3.3 billion, says lawmaker
A report by a Labour MP and an academic argues that if the British public cannot see what Russian activity costs, it cannot weigh that burden against the cost of defending against it. First seen on therecord.media Jump to article: therecord.media/russia-cyberattacks-on-britain-putin-tax-graeme-downie
-
Russian-Speaking CyberXero Uses AI Agent Swarm to Attack Ukrainian Energy Infrastructure
CyberXero, a Russian-speaking initial access broker combining conventional exploitation tools with AI agents to pursue global website compromises and targeted intrusions against Ukrainian energy infrastructure. The findings describe an active, financially motivated operation rather than a confirmed state-sponsored campaign. Its selective interest in Ukrainian utilities raises questions about potential access buyers, but researchers found no…
-
Russian-Speaking CyberXero Uses AI Agent Swarm to Attack Ukrainian Energy Infrastructure
CyberXero, a Russian-speaking initial access broker combining conventional exploitation tools with AI agents to pursue global website compromises and targeted intrusions against Ukrainian energy infrastructure. The findings describe an active, financially motivated operation rather than a confirmed state-sponsored campaign. Its selective interest in Ukrainian utilities raises questions about potential access buyers, but researchers found no…
-
Earth Sirrush Espionage Activity May Support Sandworm Operations Against Ukraine
Tags: cyber, defense, espionage, government, infrastructure, phishing, russia, spear-phishing, threat, ukraineRussia-aligned threat actor Earth Sirrush has sustained spear-phishing operations against Ukrainian government, defense, border security, and logistics organizations since at least 2022. TrendAI Research’s analysis, covering activity through July 2026, identifies an evolving espionage toolkit whose persistent development and infrastructure patterns connect seemingly separate campaigns. Previously tracked as SHADOW-EARTH-065, the intrusion set overlaps with CERT-UA’s…
-
Gentlemen Ransomware Affiliate Uses MCP as C2 Channel in Live Cyberattacks
A Russian-speaking Gentlemen ransomware affiliate used the Model Context Protocol (MCP) to execute commands during live intrusions, turning an AI coding assistant’s tool interface into an operational command-and-control channel. CloudSEK identified the activity while investigating exposed infrastructure belonging to an operator calling himself Azazel. Azazel also operated LEAKNED, an independent leak site that allegedly diverted…
-
Belarusian hacktivists spent two years inside Russian healthcare network, researchers say
Russian cybersecurity researchers attributed a quiet two-year espionage campaign to the Belarusian Cyber Partisans, a group better known for public attacks against governments and infrastructure. First seen on therecord.media Jump to article: therecord.media/belarusian-hacktivists-two-years-Russian-healthcare-network
-
Star Blizzard Targets 100+ Organizations with Phishing and RedFlick Technique
Russian group Star Blizzard expands phishing campaigns with a new malware delivery RedFlick technique, using scheduled tasks to deliver the CosmicPulse backdoor. First seen on hackread.com Jump to article: hackread.com/star-blizzard-organizations-phishing-redflick-technique/
-
Breach Roundup: Cisco SD-WAN Flaw Under Attack
OpenAI Agents Target Canada, ShinyHunters Suspect Arrested. This week: Cisco SD-WAN, OpenAI agents target Canada, ShinyHunters suspect arrested in Amsterdam, Japanese railway ransomware, AI labs investigated, an accused Chinese hacker misses his cellphone. Russian hackers, an ATM jackpotting network sanctioned and former airmen sentenced for BEC. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/breach-roundup-cisco-sd-wan-flaw-under-attack-a-33001
-
Russian state hackers use new RedFlick technique to push malware
The Russian state actor Star Blizzard has been using a new malware installation tactic dubbed “RedFlick” to deploy its signature CosmicPulse backdoor. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/russian-state-hackers-use-new-redflick-technique-to-push-malware/
-
Russia’s Star Blizzard Ditches ClickFix to Widen Phishing Net
The APT actor is using a new tactic, dubbed RedFlick, against Ukrainian-linked targets such as NGOs, think tanks, and journalists to deploy its CosmicPulse backdoor. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/russia-star-blizzard-apt-ditches-clickfix-widen-phishing-net
-
Mobile malware warning from Ukrainian researchers includes iPhone exploit kit
‘Hit and run’ iPhone malware known as DarkSword is part of a wave of Russian attacks on iOS and Android devices, according to Ukraine’s SSSCIP. First seen on therecord.media Jump to article: therecord.media/ukraine-ssscip-mobile-malware-warning-ios-android
-
Oxygen Forensics, A Russian-run forensics firm spent a decade inside European police departments
DOJ charges against Oxygen Forensics reveal the Russian-linked firm also sold forensic software to EU projects and European police forces for years. Last week’s Justice Department indictment of Oxygen Forensics looked, at first, like an American procurement scandal. CEO Lee Reiber and Russian co-founder Oleg Davydov stand accused of hiding that the company was Russian-owned…
-
RedFlick Uses Scheduled Tasks and Password-Protected Archives to Deploy CosmicPulse Backdoor
Russian state-linked threat actor Star Blizzard has expanded its cyberespionage operations in 2026 with a phishing and malware-delivery technique tracked by Microsoft as RedFlick. Microsoft Threat Intelligence reported that the group, which CISA attributes to Russia’s Federal Security Service (FSB) Center 18, conducted at least 13 phishing campaigns between January and August 2026. The activity…
-
Russian FSB-linked hackers scale up phishing attacks against Ukraine supporters
The Russian state-backed hacking group Star Blizzard has expanded its phishing operations this year, using a new technique that makes it easier to infect victims with malware. First seen on therecord.media Jump to article: therecord.media/russia-hackers-ukraine-blizzard
-
Russian hackers Star Blizzard expand targeting, change up tactics to reach Ukraine and beyond
Microsoft says the cyberespionage campaign has hit U.S. and U.K. targets, relying on sheer volume and requiring only a single victim interaction. First seen on cyberscoop.com Jump to article: cyberscoop.com/microsoft-star-blizzard-redflick-phishing-campaigns/
-
Russia’s Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor
Russian state hackers known as Star Blizzard have been using fake event invitations to trick people into installing a backdoor on their Windows computers, according to Microsoft.The campaigns, aimed at people and organizations tied to Ukraine, have affected more than 100 organizations since January, mostly in the U.S. and U.K. At least one computer was…
-
Pro-Russia Hacktivists Increase OT Intrusion Claims Across EU
ENISA Says NoName057(16) Drove 48% of Incidents, Targeting Critical Infrastructure. The European Union Agency for Cybersecurity warns of rising intrusion claims against operational technology and industrial environments as hacktivist campaigns increasingly target critical sectors. ENISA found that ideology-driven malicious cyberattacks accounted for 57.3% of all incidents. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/pro-russia-hacktivists-increase-ot-intrusion-claims-across-eu-a-32966