Tag: russia
-
Russia-affiliated Secret Blizzard conducting ongoing espionage against embassies in Moscow
A new Microsoft report finds that the long-running threat group has gained positions on state-aligned ISPs and Russian telecoms, while tricking foreign embassy staff to download custom malware. First seen on cyberscoop.com Jump to article: cyberscoop.com/russia-secret-blizzard-espionage-embassies-moscow/
-
Kremlin goons caught abusing ISPs to spy on Moscow-based diplomats, Microsoft says
Russia spying on foreign embassies? Say it ain’t so First seen on theregister.com Jump to article: www.theregister.com/2025/07/31/kremlin_goons_caught_abusing_isps/
-
The Kremlin’s Most Devious Hacking Group Is Using Russian ISPs to Plant Spyware
The FSB cyberespionage group known as Turla seems to have used its control of Russia’s network infrastructure to meddle with web traffic and trick diplomats into infecting their computers. First seen on wired.com Jump to article: www.wired.com/story/russia-fsb-turla-secret-blizzard-apolloshadow-isp-cyberespionage/
-
Russia’s Secret Blizzard APT Gains Embassy Access via ISPs
An ongoing AitM campaign by the infamous Moscow-sponsored cyber threat actor has widened its scope, dropping the dangerous ApolloShadow custom backdoor malware thanks to lawful intercept systems. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/russia-secret-blizzard-apt-embassy-isps
-
LAMEHUG: First AI-Powered Malware Targets Organizations via Compromised Official Email Accounts
The Russian state-sponsored threat actor APT28, also known as Fancy Bear or Forest Blizzard, has deployed LameHug, the first publicly documented malware leveraging large language models (LLMs) for automated command generation and execution. According to a recent CERT-UA report, this campaign targeted Ukraine’s security and defense sectors earlier this month, initiating with spearphishing emails dispatched…
-
32% of exploited vulnerabilities are now zero-days or 1-days
Russian and Iranian threat activity rises: The security industry attributes only some of the newly discovered exploits to known attacker groups, and only some of those groups have known countries of origin. As a result, statistics on the origin of attacks are not perfect.During the first half of 2025, 181 of CVEs added to the…
-
Russia blocks popular US-made internet speed test tool over national security concerns
Speedtest, made by Seattle-based Ookla, collects data that could be exploited for cyberattacks, Russia’s telecom regulator said in blocking the service. First seen on therecord.media Jump to article: therecord.media/russia-bans-speedtest-ookla
-
Cyberattack shuts down hundreds of Russian pharmacies, disrupts healthcare services
The Stolichki pharmacy chain, which operates about 1,000 stores across Russia confirmed that a technical failure that halted its operations on Tuesday was caused by a hack. First seen on therecord.media Jump to article: therecord.media/cyberattack-shuts-down-russian-pharmacies
-
Hackers Deploy Cobalt Strike Beacon Using GitHub and Social Media
A sophisticated cyberattack campaign disrupted the Russian IT industry and entities in several other countries, leveraging advanced evasion techniques to deploy the notorious Cobalt Strike Beacon. Attackers ingeniously concealed payload information within user profiles on platforms like GitHub, Microsoft Learn Challenge, Quora, and Russian social networks, blending malicious data into legitimate user-generated content to bypass…
-
Cyberangriff auf zwei Apotheken-Ketten in Russland
Cyberattacks Force Major Russian Pharmacy Chains to Shut Down First seen on themoscowtimes.com Jump to article: www.themoscowtimes.com/2025/07/29/cyberattacks-force-major-russian-pharmacy-chains-to-shut-down-a90014
-
Russian airline Aeroflot grounds dozens of flights after cyberattack
Aeroflot, Russia’s flag carrier, has suffered a cyberattack that resulted in the cancellation of more than 60 flights and severe delays on additional flights. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/russian-airline-aeroflot-grounds-dozens-of-flights-after-cyberattack/
-
Qilin Ransomware Gains Momentum with Legal Assistance Option for Affiliates
The Qilin ransomware gang has introduced a >>Call Lawyer>legal department
-
Poland says more than 30 suspects face trial over pro-Russian sabotage
Prime Minister Donald Tusk said the suspects were allegedly recruited to conduct attacks aimed at destabilizing the country. First seen on therecord.media Jump to article: therecord.media/poland-32-suspects-pro-russia-sabotage
-
Pro-Ukraine hacktivists claim cyberattack on Russian Airline Aeroflot that caused the cancellation of +100 flights
A cyberattack claimed by Ukrainian group Silent Crow and Belarusian Cyber-Partisans crippled Aeroflot ‘s systems, canceling over 100 flights. On July 28, 2025, a cyberattack claimed by Ukrainian group Silent Crow and Belarusian Cyber-Partisans crippled the systems of Russian state-owned carrier Aeroflot. Over 100 flights were cancelled following the attack, which also caused delays. The…
-
Cyberangriff auf eine staatliche russische Fluggesellschaft
Pro-Ukrainian hackers claim massive cyberattack on Russia’s Aeroflot First seen on reuters.com Jump to article: www.reuters.com/en/pro-ukrainian-hackers-claim-massive-cyberattack-russias-aeroflot-2025-07-28/
-
Aeroflot Hit by Year”‘Long Cyber Operation That Allegedly Wiped 7,000 Servers
Russia’s flagship carrier Aeroflot is reeling from a devastating cyberattack that pro-Ukraine hacking groups claim wiped approximately 7,000 servers and stole over 20 terabytes of sensitive data during a year-long clandestine operation. The airline was forced to cancel dozens of flights Monday morning, leaving passengers stranded at Moscow’s Sheremetyevo Airport amid what officials described as…
-
Rise of Chaos Ransomware Tied to BlackSuit Group’s Exit
Operation Checkmate Disrupts One of the Large Russian-Speaking Ransomware Groups. An international law enforcement operation has disrupted BlackSuit, a ransomware group tied to hundreds of victims and ransom demands that exceeded half a billion dollars. The takedown occurred as security experts tracked the rise of a new group called Chaos, which may be a BlackSuit…
-
Pro-Ukrainian hackers take credit for attack that snarls Russian flight travel
State-owned Aeroflot cancels dozens of flights, stranding travelers throughout Russia. First seen on arstechnica.com Jump to article: arstechnica.com/security/2025/07/pro-ukrainian-hackers-take-credit-for-attack-that-snarls-russian-flight-travel/
-
Russia’s Flag Carrier Cancels Flights After Hack Attack
Aeroflot Hit With Wiper Malware, Claim Pro-Ukrainian Hackers From Belarus. Russia’s largest airline, Aeroflot, canceled dozens of flights on Monday and delayed more due to an IT disruption. Two pro-Ukrainian hacking groups from Belarus claimed to have wiped stolen extensive customer data before wiping 7,000 physical and virtual servers used by the airline. First seen…
-
Cyberattack on Aeroflot causing mass flight disruptions, Russia says
Russian authorities confirmed on Monday that ongoing Aeroflot flight disruptions are due to a cyberattack affecting the nation’s largest carrier. First seen on therecord.media Jump to article: therecord.media/cyberattack-aeroflot-russia-delays
-
Flights grounded as Russia’s largest airline Aeroflot hacked and systems ‘destroyed’
Russian prosecutor said it opened a criminal investigation into the cyberattack targeting Aeroflot, the largest airline in Russia. First seen on techcrunch.com Jump to article: techcrunch.com/2025/07/28/flights-grounded-as-russias-largest-airline-aeroflot-hit-by-cyberattack/
-
Russian Airline Aeroflot Hit by Cyberattack, Hackers Threaten to Leak Passenger Data
Russian airline Aeroflot faced a disruption today (July 28) after cancelling dozens of flights due to what it described as a failure in its information systems. Adding to the concern, a hacking collective known as Silent Crow claimed responsibility for the Aeroflot cyberattack, alleging a yearlong infiltration that severely damaged the airline’s IT infrastructure. First…
-
Inside Laundry Bear: Unveiling Infrastructure, Tactics, and Procedures
Dutch intelligence agencies AIVD and MIVD, alongside Microsoft Threat Intelligence, have identified Laundry Bear also tracked as Void Blizzard as a sophisticated Russian state-sponsored advanced persistent threat (APT) group active since at least April 2024. This actor has focused on espionage operations against NATO countries, Ukraine, and various organizations including the Dutch police, a Ukrainian…
-
Aeroflot aeroflops over ‘IT issues’ after attackers claim year-long compromise
Tags: russiaRussia’s top airline cancels 49 flights, delays affect many more First seen on theregister.com Jump to article: www.theregister.com/2025/07/28/aeroflot_system_compromise/
-
Russian-Aligned Hive0156 Escalates Remcos RAT Attacks on Ukrainian Government Military
The post Russian-Aligned Hive0156 Escalates Remcos RAT Attacks on Ukrainian Government Military appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/russian-aligned-hive0156-escalates-remcos-rat-attacks-on-ukrainian-government-military/
-
Operation CargoTalon targets Russia’s aerospace with EAGLET malware,
Operation CargoTalon targets Russia’s aerospace and defense sectors with EAGLET malware, using TTN documents to exfiltrate data. SEQRITE Labs researchers uncovered a cyber-espionage campaign, dubbed OperationCargoTalon, targeting Russia’s aerospace and defense sectors, specifically Voronezh Aircraft Production Association (VASO), via malicious TTN documents. >>Товарно-транÑÐ¿Ð¾Ñ€Ñ‚Ð½Ð°Ñ Ð½Ð°ÐºÐ»Ð°Ð´Ð½Ð°Ñ>goods and transport invoice>consignment note
-
Cyber Espionage Campaign Hits Russian Aerospace Sector Using EAGLET Backdoor
Russian aerospace and defense industries have become the target of a cyber espionage campaign that delivers a backdoor called EAGLET to facilitate data exfiltration.The activity, dubbed Operation CargoTalon, has been assigned to a threat cluster tracked as UNG0901 (short for Unknown Group 901).”The campaign is aimed at targeting employees of Voronezh Aircraft Production Association (VASO),…
-
Hackers”, hope to defect to Russia? Don’t Google “defecting to Russia.”
Criminals who get caught are, unsurprisingly, not always great at opsec. First seen on arstechnica.com Jump to article: arstechnica.com/security/2025/07/hackers-hope-to-defect-to-russia-dont-google-defecting-to-russia/
-
Key Operator of World’s Largest XSS Dark Web Platform Detained
International law enforcement agencies have dismantled one of the world’s most influential Russian-speaking cybercrime platforms following the arrest of its suspected administrator in a coordinated operation spanning France, Ukraine, and broader European cooperation. The takedown of xss.is represents a significant blow to global cybercriminal networks that have operated with relative impunity on the dark web…
-
Russia turns to Kyrgyzstan’s booming crypto sector to evade sanctions, researchers say
According to a new report by blockchain intelligence firm TRM Labs, Kyrgyz-registered exchanges have repeatedly been used by sanctioned Russian entities. First seen on therecord.media Jump to article: therecord.media/russia-turns-to-kyrgystan-crypto-sanctions