Tag: russia
-
Morphisec warns StealC V2 malware spread through weaponized blender files
StealC V2 spread via malicious Blender files on 3D model sites like CGTrader, abusing Blender’s ability to run hidden Python scripts. Cybersecurity firm Morphisec reported that Russian threat actors are spreading StealC V2 infostealer via weaponized Blender files uploaded to 3D model marketplaces like CGTrader. The malware abuses Blender’s ability to run Python scripts for automation…
-
Russian and North Korean Hackers Forge Global Cyberattack Alliance
Tags: cyber, cyberattack, group, hacker, infrastructure, korea, lazarus, north-korea, russia, threat, warfareState-sponsored hackers from Russia and North Korea are collaborating on shared infrastructure, marking a significant shift in cyber geopolitics. Security researchers have uncovered evidence suggesting that Gamaredon, a Russia-aligned advanced persistent threat (APT) group, and Lazarus, North Korea’s primary cyber warfare unit, may be operating jointly a development with profound implications for global security. Russia…
-
Russian spy ship theories sink after Orkney blackout traced to wind farm fault
Timing of Yantar’s visit sparked gossip, but engineers point to a misbehaving protection system First seen on theregister.com Jump to article: www.theregister.com/2025/11/25/russian_warship_fears_orkney/
-
Malicious Blender model files deliver StealC infostealing malware
A Russian-linked campaign delivers the StealC V2 information stealer malware through malicious Blender files uploaded to 3D model marketplaces like CGTrader. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/malicious-blender-model-files-deliver-stealc-infostealing-malware/
-
Hackers knock out systems at Moscow-run postal operator in occupied Ukraine
Donbas Post, which operates in the Russian-controlled parts of Donetsk and Luhansk, said the incident affected its corporate network, web platform and email systems. The company had restricted access to several services to contain the breach and was working to restore operations. First seen on therecord.media Jump to article: therecord.media/hackers-knock-out-systems-russia-operated-post-ukraine
-
Russian-linked Malware Campaign Hides in Blender 3D Files
Morphisec has observed a new operation embedding StealC V2 malware in Blender project files, targeting users via 3D assets and launching a multi-stage infection chain First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/russian-malware-blender-3d-files/
-
China-Linked APT31 Launches Stealthy Cyberattacks on Russian IT Using Cloud Services
Tags: attack, china, cloud, cyber, cyberattack, government, group, russia, service, technology, threatThe China-linked advanced persistent threat (APT) group known as APT31 has been attributed to cyber attacks targeting the Russian information technology (IT) sector between 2024 and 2025 while staying undetected for extended periods of time.”In the period from 2024 to 2025, the Russian IT sector, especially companies working as contractors and integrators of solutions for…
-
SEC Ends SolarWinds Suit After Major Legal Setbacks
High-Profile Case Ends After Judge Guts SEC’s Cyber Fraud Allegations. The SEC has dropped its remaining claims against SolarWinds and CISO Tim Brown, ending a controversial cyber fraud lawsuit that aimed to expand securities law to cover operational security failures tied to the 2020 Russian hacking campaign. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/sec-ends-solarwinds-suit-after-major-legal-setbacks-a-30101
-
SEC Dismisses Remains of Lawsuit Against SolarWinds and Its CISO
The SEC dismissed the remain charges in the lawsuit filed in 2023 against software maker SolarWinds and CISO Timothy Brown in the wake of the massive Sunburst supply chain attack, in which a Russian nation-state group installed a malicious update into SolarWInds software that then compromised the systems of some customers. First seen on securityboulevard.com…
-
SEC Dismisses Remains of Lawsuit Against SolarWinds and Its CISO
The SEC dismissed the remain charges in the lawsuit filed in 2023 against software maker SolarWinds and CISO Timothy Brown in the wake of the massive Sunburst supply chain attack, in which a Russian nation-state group installed a malicious update into SolarWInds software that then compromised the systems of some customers. First seen on securityboulevard.com…
-
Russia-linked crooks bought a bank for Christmas to launder cyber loot
UK cops trace street-level crime to sanctions-busting networks tied to Moscow’s war economy First seen on theregister.com Jump to article: www.theregister.com/2025/11/21/russia_cybercrime_bank_purchase/
-
Allies Sanction Russian Network Behind Major Cyberattacks
The UK, US, and Australia sanctioned Media Land, a Russian network enabling major cyberattacks. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/allies-sanction-russian-network-behind-major-cyberattacks/
-
Cybersecurity Snapshot: Global Agencies Target Criminal “Bulletproof” Hosts, as CSA Unveils Agentic AI Risk Framework
Tags: access, advisory, ai, android, apple, attack, banking, breach, browser, chrome, cisa, ciso, cloud, compliance, control, credentials, credit-card, crypto, cve, cyber, cybercrime, cybersecurity, data, defense, detection, endpoint, extortion, finance, firewall, firmware, flaw, framework, google, governance, government, group, guide, Hardware, ibm, identity, infection, infrastructure, international, Internet, law, linux, malicious, malware, microsoft, mobile, monitoring, network, open-source, oracle, password, phishing, radius, ransomware, rat, resilience, risk, risk-assessment, risk-management, russia, scam, service, software, switch, technology, threat, tool, update, vulnerability, windowsCyber agencies call on ISPs to help combat “bulletproof” internet hosts that shield cybercriminals. Meanwhile, the CSA introduced a new methodology to assess the risks of autonomous AI. Plus, get the latest on the CIS Benchmarks, drone-detection systems, and malware infections. Key takeaways Crackdown on “bulletproof” hosting: International cyber agencies are urging ISPs and network…
-
Cybersecurity Snapshot: Global Agencies Target Criminal “Bulletproof” Hosts, as CSA Unveils Agentic AI Risk Framework
Tags: access, advisory, ai, android, apple, attack, banking, breach, browser, chrome, cisa, ciso, cloud, compliance, control, credentials, credit-card, crypto, cve, cyber, cybercrime, cybersecurity, data, defense, detection, endpoint, extortion, finance, firewall, firmware, flaw, framework, google, governance, government, group, guide, Hardware, ibm, identity, infection, infrastructure, international, Internet, law, linux, malicious, malware, microsoft, mobile, monitoring, network, open-source, oracle, password, phishing, radius, ransomware, rat, resilience, risk, risk-assessment, risk-management, russia, scam, service, software, switch, technology, threat, tool, update, vulnerability, windowsCyber agencies call on ISPs to help combat “bulletproof” internet hosts that shield cybercriminals. Meanwhile, the CSA introduced a new methodology to assess the risks of autonomous AI. Plus, get the latest on the CIS Benchmarks, drone-detection systems, and malware infections. Key takeaways Crackdown on “bulletproof” hosting: International cyber agencies are urging ISPs and network…
-
China’s APT31 linked to hacks on Russian tech firms
Moscow-based Positive Technologies says a China-linked group tracked as APT31 appears to be responsible for breaches of entities in Russia’s tech sector. First seen on therecord.media Jump to article: therecord.media/russia-report-apt31-china-linked-hacks
-
Russian money launderers bought a bank to disguise ransomware profit
A billion-dollar money laundering network active in the UK funnelled money, including the profits of ransomware attacks, into its own bank to circumvent sanctions on Russia and help fund its attacks on Ukraine First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366634571/Russian-money-launderers-bought-a-bank-to-disguise-ransomware-profit
-
UK drug funds flowed into bank tied to Russian spy services, military
The NCA on Friday confirmed that a money laundering network under investigation was used to purchase Keremet Bank in Kyrgyzstan, which was sanctioned earlier this year. First seen on therecord.media Jump to article: therecord.media/uk-drug-funds-flowed-into-bank-tied-to-russia
-
SEC drops case against SolarWinds tied to monumental breach
The Securities and Exchange Commission on Thursday dropped its case against SolarWinds and its chief information security officer over its handling of an alleged Russian cyberespionage campaign uncovered in 2020, an incident that penetrated at least nine federal agencies and hundreds of companies. The SEC’s decision brings to a halt one of the more divisive…
-
Tsundere Botnet Targets Windows, Linux macOS via Node.js Packages
A Russian-speaking threat actor attributed to the username >>koneko
-
Authorities Sanction Russia-Based Bulletproof Hosting Provider for Aiding Ransomware
The United States, Australia, and the United Kingdom have announced coordinated sanctions against Media Land, a Russia-based bulletproof hosting provider, and related entities for supporting ransomware operations and other cybercrimes. The Department of the Treasury’s Office of Foreign Assets Control (OFAC), working with international partners and the FBI, has designated the company’s leadership team and…
-
Authorities Sanction Russia-Based Bulletproof Hosting Provider for Aiding Ransomware
The United States, Australia, and the United Kingdom have announced coordinated sanctions against Media Land, a Russia-based bulletproof hosting provider, and related entities for supporting ransomware operations and other cybercrimes. The Department of the Treasury’s Office of Foreign Assets Control (OFAC), working with international partners and the FBI, has designated the company’s leadership team and…
-
Coordinated sanctions hit Russian bulletproof hosting providers enabling top ransomware Ops
US, Australia and UK sanctioned 2 Russian bulletproof hosting providers accused of aiding groups like LockBit, BlackSuit and Play. US, Australia and UK sanctioned two Russian bulletproof hosting providers accused of aiding groups like LockBit, BlackSuit and Play. Coordinated sanctions hit Russia-based provider Media Land, its leaders, and sister firms for supplying bulletproof hosting that…
-
Russia blacklists S.T.A.L.K.E.R. game developer, accusing it of aiding Ukraine’s war effort
The Prosecutor General’s Office accused the game’s developer, GSC Game World, of financing Ukraine’s armed forces, alleging it transferred about $17 million to the military in 2022. First seen on therecord.media Jump to article: therecord.media/russia-blacklists-stalker-game-developer
-
Russia blacklists S.T.A.L.K.E.R. game developer, accusing it of aiding Ukraine’s war effort
The Prosecutor General’s Office accused the game’s developer, GSC Game World, of financing Ukraine’s armed forces, alleging it transferred about $17 million to the military in 2022. First seen on therecord.media Jump to article: therecord.media/russia-blacklists-stalker-game-developer
-
UK, US and Australia Sanction Russian Bulletproof Hoster Media Land
Tags: russiaAllies sanction bulletproof hoster Media Land and four executives First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/uk-us-sanction-russian-bulletproof/
-
Iranian APT hacks helped direct missile strikes in Israel and the Red Sea
MuddyWater uses hacked CCTV cameras to help guide missiles: Amazon also found supporting threat intel evidence for another Iran-linked incident involving cyber espionage and missile strikes that has received some official confirmation.After the US strikes against Iran’s nuclear sites in June, Iran retaliated by launching a barrage of missiles against Israel, targeting cities such as…
-
Five Eyes just made life harder for bulletproof hosting providers
An international effort sanctioned Russia-based Media Land and took action against companies and people who helped Aeza Group evade previously issued sanctions. First seen on cyberscoop.com Jump to article: cyberscoop.com/bulletproof-hosting-providers-sanctions-mitigation-media-land/
-
Operation WrtHug hijacks 50,000+ ASUS routers to build a global botnet
Operation WrtHug hijacks tens of thousands of outdated ASUS routers worldwide, mainly in Taiwan, the U.S., and Russia, forming a large botnet. A new campaign called Operation WrtHug has compromised tens of thousands of outdated or end-of-life ASUS routers worldwide, mainly in Taiwan, the U.S., and Russia, pulling them into a large malicious network. SecurityScorecard…
-
US, allies sanction Russian bulletproof hosting services for ransomware support
A popular Russian bulletproof hosting service provider named Media Land was sanctioned by the U.S. Treasury and international partners for its alleged support of ransomware gangs and other cybercriminal operations. First seen on therecord.media Jump to article: therecord.media/bulletproof-hosting-sanctions-ransomware
-
Operation WrtHug hijacks 50,000+ ASUS routers to Bìbuild global botnet
Operation WrtHug hijacks tens of thousands of outdated ASUS routers worldwide, mainly in Taiwan, the U.S., and Russia, forming a large botnet. A new campaign called Operation WrtHug has compromised tens of thousands of outdated or end-of-life ASUS routers worldwide, mainly in Taiwan, the U.S., and Russia, pulling them into a large malicious network. SecurityScorecard…