Tag: russia
-
CERT-UA reports PLUGGYAPE cyberattacks on defense forces
CERT-UA reported PLUGGYAPE malware attacks on Ukraine’s defense forces, linked with medium confidence to Russia’s Void Blizzard group. The Computer Emergency Response Team of Ukraine (CERT-UA) reported new cyberattacks against Ukraine’s defense forces using PLUGGYAPE malware. Government experts attributed the attack with medium confidence to the Russian-linked group Void Blizzard (aka Laundry Bear, UAC-0190), active…
-
Poland says it repelled major cyberattack on power grid, blames Russia
Poland narrowly avoided a large-scale power outage by thwarting what officials described as the most serious cyberattack on its energy infrastructure in years. First seen on therecord.media Jump to article: therecord.media/poland-cyberattack-grid-russia
-
Hacker Claims Full Breach of Russia’s Max Messenger, Threatens Public Leak
A hacker claims a full breach of Russia’s Max Messenger, threatening to leak user data and backend systems if demands are not met. First seen on hackread.com Jump to article: hackread.com/hacker-russia-max-messenger-breach-data-leak/
-
PLUGGYAPE Malware Uses Signal and WhatsApp to Target Ukrainian Defense Forces
The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of new cyber attacks targeting its defense forces with malware known as PLUGGYAPE between October and December 2025.The activity has been attributed with medium confidence to a Russian hacking group tracked as Void Blizzard (aka Laundry Bear or UAC-0190). The threat actor is believed…
-
Senior military cyber operator removed from Russia task force
The officer was “relieved for cause” due to disagreements over operations by the organization’s chief. First seen on therecord.media Jump to article: therecord.media/senior-military-cyber-op-removed-russia-task-force
-
Russia’s Crackdown on Probiv Data Leaks May Have Fed the Beast Instead
Explore how Russia’s efforts to control the probiv market highlight the challenges of data leaks, insider threats, and the conflict between control and security. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/01/russias-crackdown-on-probiv-data-leaks-may-have-fed-the-beast-instead/
-
Russian BlueDelta (Fancy Bear) Uses PDFs to Steal Logins in Just 2 Seconds
New research from Recorded Future reveals how Russian state hackers (BlueDelta) are using fake Microsoft and Google login portals to steal credentials. The campaign involves using legitimate PDF lures from GRC and EcoClimate to trick victims. First seen on hackread.com Jump to article: hackread.com/russian-bluedelta-fancy-bear-pdfs-steal-login/
-
Botnet Threat Update July to December 2025
Botnet Command & Controller (C&C) activity increased 24% this period, with Remote Access Trojans (RATs) accounting for 42% of the Top 20 malware associated with botnets. Learn which Russia-based registrar saw a +9,608% surge in botnet C&C domains”, and which major cloud providers are taking action. Read the full report. First seen on securityboulevard.com Jump…
-
Sweden detains ex-military IT consultant suspected of spying for Russia
A 33-year-old former IT consultant for Sweden’s Armed Forces has been detained on suspicions of spying for Russian intelligence, Swedish prosecutors said. First seen on therecord.media Jump to article: therecord.media/sweden-detains-it-consultant-russia
-
Illicit Crypto Economy Surges Amid Increased Nation-State Activity
Cybercriminal cryptocurrency transactions totaled billions in 2025, with activity from sanctioned countries like Russia and Iran causing the largest jump. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/illicit-crypto-economy-surges-nation-states
-
Iran-linked MuddyWater APT deploys Rust-based implant in latest campaign
Rust offers evasion advantages: CloudSEK researchers said RustyWater was developed in Rust, which they said is increasingly used by malware authors for its memory safety features and cross-platform capabilities, according to the blog post. Other state-sponsored groups, including Russia’s Gossamer Bear and China-linked actors, have also deployed Rust-based malware in recent campaigns, according to security…
-
Credential-harvesting attacks by APT28 hit Turkish, European, and Central Asian organizations
Russia-linked cyberespionage group APT28 targets energy, nuclear, and policy staff in Turkey, Europe, North Macedonia, and Uzbekistan with credential-harvesting attacks. Between February and September 2025, Recorded Future’s Insikt Group observed Russia-linked group APT28 (aka UAC-0001, Fancy Bear, Pawn Storm, Sofacy Group, Sednit, BlueDelta, and STRONTIUM) running credential-harvesting campaigns. Targets included Turkish energy and nuclear agency staff, European think tank personnel, and organizations…
-
Basketball player arrested for alleged ransomware ties freed in Russia-France prisoner swap
Daniil Kasatkin, 26, was seen in a video shared by Russian state news outlet TASS emerging from a plane that was then used to send French researcher Laurent Vinatier back to France. First seen on therecord.media Jump to article: therecord.media/france-frees-russian-basketball-player-ransomware-swap
-
Illicit Crypto Economy Surges as Nation-States Join in the Fray
Cybercriminal cryptocurrency transactions totaled billions in 2025, with activity from sanctioned countries like Russia and Iran causing the largest jump. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/illicit-crypto-economy-surges-nation-states
-
Russian APT28 Runs Credential-Stealing Campaign Targeting Energy and Policy Organizations
Russian state-sponsored threat actors have been linked to a fresh set of credential harvesting attacks targeting individuals associated with a Turkish energy and nuclear research agency, as well as staff affiliated with a European think tank and organizations in North Macedonia and Uzbekistan.The activity has been attributed to APT28 (aka BlueDelta), which was attributed to…
-
Russia’s Fancy Bear APT Doubles Down on Global Secrets Theft
The notorious Russian state-sponsored group relies on basic techniques that are highly effective, often delivering greater ROI than more complex malware-heavy operations. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/russian-apt-credentials-global-targets
-
Notorious Russian APT Nabs Credentials From Global Targets
Fancy Bear relies on basic techniques that are highly effective, often delivering greater ROI than more complex malware-heavy operations. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/russian-apt-credentials-global-targets
-
BlueDelta Espionage: Russian Hackers Abuse Free Apps to Target Energy Sector
The post BlueDelta Espionage: Russian Hackers Abuse Free Apps to Target Energy Sector appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/bluedelta-espionage-russian-hackers-abuse-free-apps-to-target-energy-sector/
-
Cyber Retaliation Risks Rise After US-Venezuela Operation
CISA Warns of Retaliatory Cyber Action From Hostile State Actors After Venezuela. Federal cybersecurity officials are warning of a likely uptick in retaliatory cyber activity from China and Russia-linked threat actors after the U.S. military raid in Venezuela, urging infrastructure operators to brace for disruptive probing and attacks. First seen on govinfosecurity.com Jump to article:…
-
BlueDelta Hackers Target Microsoft OWA, Google, and Sophos VPN to Steal Credentials
A sophisticated credential-harvesting operation conducted by BlueDelta, a Russian state-sponsored threat group linked to the GRU’s Main Directorate, targeted critical infrastructure organizations and research institutions throughout 2025, according to a comprehensive investigation by Recorded Future’s Insikt Group. The campaign, spanning February through September 2025, represents a significant evolution in the group’s persistent credential-theft operations, with…
-
DDoSia Powers Affiliate-Driven Hacktivist Attacks
Pro-Russian group NoName057(16) uses a custom denial-of-service tool to mobilize volunteers and disrupt government, media, and institutional sites tied to Ukraine and the West. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/ddosia-powers-volunteer-driven-hacktivist-attacks
-
Fake Booking.com emails and BSODs used to infect hospitality staff
Suspected Russian attackers are targeting the hospitality sector with fake Booking.com emails and a fake >>Blue Screen of Death
-
Russia-linked APT UAC-0184 uses Viber to spy on Ukrainian military in 2025
Tags: apt, data, espionage, government, intelligence, malicious, military, monitoring, russia, spy, threat, ukraineRussia-linked APT UAC-0184 targets Ukrainian military and government bodies via Viber, delivering malicious ZIP files for espionage in 2025. Russia-linked threat actor UAC-0184 (aka Hive0156) is targeting Ukrainian military and government entities, using Viber messages to deliver malicious ZIP files as part of ongoing intelligence-gathering operations in 2025. >>Recent monitoring data from the 360 “‹”‹Advanced…
-
Russia-linked APT UAC-0184 uses Viber to spy on Ukrainian military in 2025
Tags: apt, data, espionage, government, intelligence, malicious, military, monitoring, russia, spy, threat, ukraineRussia-linked APT UAC-0184 targets Ukrainian military and government bodies via Viber, delivering malicious ZIP files for espionage in 2025. Russia-linked threat actor UAC-0184 (aka Hive0156) is targeting Ukrainian military and government entities, using Viber messages to deliver malicious ZIP files as part of ongoing intelligence-gathering operations in 2025. >>Recent monitoring data from the 360 “‹”‹Advanced…
-
Russia-linked APT UAC-0184 uses Viber to spy on Ukrainian military in 2025
Tags: apt, data, espionage, government, intelligence, malicious, military, monitoring, russia, spy, threat, ukraineRussia-linked APT UAC-0184 targets Ukrainian military and government bodies via Viber, delivering malicious ZIP files for espionage in 2025. Russia-linked threat actor UAC-0184 (aka Hive0156) is targeting Ukrainian military and government entities, using Viber messages to deliver malicious ZIP files as part of ongoing intelligence-gathering operations in 2025. >>Recent monitoring data from the 360 “‹”‹Advanced…
-
Russian hackers target European hospitality industry with ‘blue screen of death’ malware
The scheme starts with a fake reservation cancellation that impersonates a popular booking site, and eventually prompts victims with an error message and “Blue Screen of Death” page. First seen on therecord.media Jump to article: therecord.media/russian-hackers-europe-hospitality-blue-screen