Tag: russia
-
Russian Airline Aeroflot Hit by Cyberattack, Hackers Threaten to Leak Passenger Data
Russian airline Aeroflot faced a disruption today (July 28) after cancelling dozens of flights due to what it described as a failure in its information systems. Adding to the concern, a hacking collective known as Silent Crow claimed responsibility for the Aeroflot cyberattack, alleging a yearlong infiltration that severely damaged the airline’s IT infrastructure. First…
-
Aeroflot aeroflops over ‘IT issues’ after attackers claim year-long compromise
Tags: russiaRussia’s top airline cancels 49 flights, delays affect many more First seen on theregister.com Jump to article: www.theregister.com/2025/07/28/aeroflot_system_compromise/
-
Inside Laundry Bear: Unveiling Infrastructure, Tactics, and Procedures
Dutch intelligence agencies AIVD and MIVD, alongside Microsoft Threat Intelligence, have identified Laundry Bear also tracked as Void Blizzard as a sophisticated Russian state-sponsored advanced persistent threat (APT) group active since at least April 2024. This actor has focused on espionage operations against NATO countries, Ukraine, and various organizations including the Dutch police, a Ukrainian…
-
Russian-Aligned Hive0156 Escalates Remcos RAT Attacks on Ukrainian Government Military
The post Russian-Aligned Hive0156 Escalates Remcos RAT Attacks on Ukrainian Government Military appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/russian-aligned-hive0156-escalates-remcos-rat-attacks-on-ukrainian-government-military/
-
Operation CargoTalon targets Russia’s aerospace with EAGLET malware,
Operation CargoTalon targets Russia’s aerospace and defense sectors with EAGLET malware, using TTN documents to exfiltrate data. SEQRITE Labs researchers uncovered a cyber-espionage campaign, dubbed OperationCargoTalon, targeting Russia’s aerospace and defense sectors, specifically Voronezh Aircraft Production Association (VASO), via malicious TTN documents. >>Товарно-транÑÐ¿Ð¾Ñ€Ñ‚Ð½Ð°Ñ Ð½Ð°ÐºÐ»Ð°Ð´Ð½Ð°Ñ>goods and transport invoice>consignment note
-
Cyber Espionage Campaign Hits Russian Aerospace Sector Using EAGLET Backdoor
Russian aerospace and defense industries have become the target of a cyber espionage campaign that delivers a backdoor called EAGLET to facilitate data exfiltration.The activity, dubbed Operation CargoTalon, has been assigned to a threat cluster tracked as UNG0901 (short for Unknown Group 901).”The campaign is aimed at targeting employees of Voronezh Aircraft Production Association (VASO),…
-
Hackers”, hope to defect to Russia? Don’t Google “defecting to Russia.”
Criminals who get caught are, unsurprisingly, not always great at opsec. First seen on arstechnica.com Jump to article: arstechnica.com/security/2025/07/hackers-hope-to-defect-to-russia-dont-google-defecting-to-russia/
-
Key Operator of World’s Largest XSS Dark Web Platform Detained
International law enforcement agencies have dismantled one of the world’s most influential Russian-speaking cybercrime platforms following the arrest of its suspected administrator in a coordinated operation spanning France, Ukraine, and broader European cooperation. The takedown of xss.is represents a significant blow to global cybercriminal networks that have operated with relative impunity on the dark web…
-
Russia turns to Kyrgyzstan’s booming crypto sector to evade sanctions, researchers say
According to a new report by blockchain intelligence firm TRM Labs, Kyrgyz-registered exchanges have repeatedly been used by sanctioned Russian entities. First seen on therecord.media Jump to article: therecord.media/russia-turns-to-kyrgystan-crypto-sanctions
-
Authorities in Ukraine nab alleged admin of Russian-language cybercrime forum
Officials accuse the unnamed suspect of running XSS.is, a key and long-running marketplace with more than 50,000 registered users. The suspect allegedly made more than $8.2 million. First seen on cyberscoop.com Jump to article: cyberscoop.com/xss-cybercrime-forum-admin-arrest/
-
European authorities arrest alleged admin of notorious Russian crime forum XSS
French authorities say they wiretapped a server used by the administrator to access their private messages, which revealed activities relating to cybercrime and ransomware attacks. First seen on techcrunch.com Jump to article: techcrunch.com/2025/07/23/european-authorities-arrest-alleged-admin-of-notorious-russian-crime-forum-xss/
-
Suspected Admin of XSS.IS Cybercrime Forum Arrested in Ukraine
Suspected admin of XSS.IS, a major Russian-language cybercrime forum, arrested in Ukraine after years of running malware and data trade operations. First seen on hackread.com Jump to article: hackread.com/suspected-xss-is-admin-cybercrime-forum-arrest-ukraine/
-
French Authorities confirm XSS.is admin arrested in Ukraine
French authorities announced the arrest in Ukraine of an alleged administrator of the long-running cybercrime forum XSS.is. A joint investigation conducted by French police, Ukrainian authorities, and Europol led to the arrest of the suspected administrator of the major Russian-speaking cybercrime forum xss.is. >>The Paris prosecutor’s office announced on Wednesday, July 23, that an individual…
-
Mastermind behind Russian-speaking cybercrime hub arrested in Ukraine
The suspected administrator of xss.is, one of the world’s most influential Russian-speaking cybercrime forums, was arrested in Kyiv, Ukraine, on 22 July. The takedown followed … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/07/23/europol-cybercrime-operation-xss-is-admin-arrest/
-
Ukraine arrests suspected admin of XSS Russian hacking forum
The suspected administrator of the Russian-speaking hacking forum XSS.is was arrested by the Ukrainian authorities yesterday at the request of the Paris public prosecutor’s office. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ukraine-arrests-suspected-admin-of-xss-russian-hacking-forum/
-
Operation CargoTalon Targets Russian Aerospace Defense to Deploy EAGLET Implant
SEQRITE Labs’ APT-Team has uncovered a sophisticated spear-phishing campaign dubbed Operation CargoTalon, targeting employees at Russia’s Voronezh Aircraft Production Association (VASO), a key aerospace entity. The operation leverages malicious attachments disguised as товарно-транÑÐ¿Ð¾Ñ€Ñ‚Ð½Ð°Ñ Ð½Ð°ÐºÐ»Ð°Ð´Ð½Ð°Ñ (TTN) logistics documents, critical for Russian supply chains. Discovered on June 27 via VirusTotal hunting, the campaign employs a malicious EML…
-
Russian Threat Actors Target NGOs with New OAuth Phishing Tactics
A new wave of phishing attacks exploiting Microsoft 365 OAuth tools has been observed impersonating diplomats to steal access codes First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/russian-hackers-target-ngos-oauth/
-
UK government to ban public bodies from paying ransoms to hackers
Tags: attack, computer, cyber, cybercrime, government, hacker, healthcare, international, office, ransom, ransomware, russiaMeasure intended to send message to international cybercriminals ‘that the UK is united in fight against ransomware’The UK government is planning to ban public bodies from paying ransoms to computer hackers, and private companies will be required to inform authorities if they plan to cave into cash demands.The stance, announced on Tuesday by the Home…
-
UK blames Russia’s infamous ‘Fancy Bear’ group for Microsoft cloud hacks
Authentic Antics malware tool to target Microsoft cloud accounts were the handiwork of the notorious Russian Fancy Bear hacking group, the UK’s National Cyber Security Centre (NCSC) has said.Authentic Antics was discovered after a cyberattack in 2023 which prompted an NCSC technical teardown of the malware that it published in May this year. The agency…
-
UK Sanctions 3 Russian Military Cyber Units
Leaders of the Russian Military Intelligence Units of the GRU Also Targeted. The U.K. government on Friday sanctioned three Russian Military Intelligence Service units 29155, 26165 and 74455 in the United Kingdom and Ukraine. The sanctions also targeted 18 Russian officials for their role in GRU cyber operations dating back to 2013. First seen on…
-
Europol Sting Leaves Russian Cybercrime’s ‘NoName057(16)’ Group Fractured
National authorities have issued seven arrest warrants in total relating to the cybercrime collective known as NoName057(16), which recruits followers to carry out DDoS attacks on perceived enemies of Russia. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/europol-sting-russian-cybercrime-noname05716
-
Cyberangriff auf einen Öl- und Gasproduzent in Russland?
Ukrainian hackers wipe databases at Russia’s Gazprom in major cyberattack, intelligence source says First seen on kyivindependent.com Jump to article: kyivindependent.com/ukrainian-intel-hackers-hit-gazproms-network-infrastructure-sources-say-07-2025/
-
Novel malware from Russia’s APT28 prompts LLMs to create malicious Windows commands
Tags: ai, api, attack, computer, control, cyber, cyberattack, cybercrime, data, detection, dos, exploit, government, group, hacking, infrastructure, intelligence, LLM, malicious, malware, military, network, phishing, programming, russia, service, tool, ukraine, vulnerability, windows.pif (MS-DOS executable) extension, though variants with .exe and .py extensions have also been observed.CERT-UA attributes these attacks to a group it tracks as UAC-0001, but which is better known in the security community as APT28. Western intelligence agencies have officially associated this group with Unit 26165, or the 85th Main Special Service Center (GTsSS)…
-
UK ties GRU to stealthy Microsoft 365 credential-stealing malware
The UK National Cyber Security Centre (NCSC) has formally attributed ‘Authentic Antics’ espionage malware attacks to APT28 (Fancy Bear), threat actor already linked to Russia’s military intelligence service (GRU). First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/uk-ties-russian-gru-to-authentic-antics-credential-stealing-malware/
-
Russian alcohol retailer WineLab closes stores after ransomware attack
WineLab, the retail store of the largest alcohol company in Russia, has closed its stores following a cyberattack that is impacting its operations and causing purchase problems to its customers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/russian-alcohol-retailer-winelab-closes-stores-after-ransomware-attack/
-
Fancy Bear Hackers Target Governments and Military Entities with Advanced Tools
Tags: cyber, cyberespionage, cybersecurity, espionage, finance, government, group, hacker, military, russia, toolFancy Bear, designated as APT28 by cybersecurity experts, represents a sophisticated Russian cyberespionage collective operational since 2007, renowned for infiltrating governments, military organizations, and strategic entities globally. This group, also known under aliases such as Sofacy, Sednit, STRONTIUM, and Unit 26165, pursues motivations encompassing financial gain, reputational sabotage, espionage, and political agendas. Their operations frequently…
-
Ukraine Pwns Russian Drone Maker, Gaskar is ‘Paralyzed’
All Your UAVs Are Belong to UKR: Ukrainian Cyber Alliance and Black Owl team up to hack manufacturer of Russian military drones, sources say. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/07/ukraine-hacks-russian-drone-maker-gaskar-richixbw/
-
UK sanctions Russian hackers, spies as US weighs its own punishments for Russia
The hackers were allegedly involved in operations against Ukraine and a Russian on U.K. soil, the latter with malware tied to U.S. 2016 election interference. First seen on cyberscoop.com Jump to article: cyberscoop.com/uk-sanctions-russian-hackers-spies-as-us-weighs-its-own-punishments-for-russia/
-
UK sanctions Russian cyber spies accused of facilitating murders
Eighteen members of Russia’s GRU have been sanctioned by the British government for various operations, including military strikes that killed hundreds of civilians in Ukraine. First seen on therecord.media Jump to article: therecord.media/uk-sanctions-gru-personnel-accused-murder-civilians-ukraine
-
Breaking: UK sanctions Russian cyber spies accused of facilitating murders
Eighteen members of Russia’s GRU have been sanctioned by the British government for various operations, including military strikes that killed hundreds of civilians in Ukraine. First seen on therecord.media Jump to article: therecord.media/uk-sanctions-gru-personnel-accused-murder-civilians-ukraine