Putin appoints Rostec cybersecurity specialist linked to GRU hackers from Fancy Bear as aide to Sergei Shoigu in Russia’s Security Council Andrei Kozlov led Rostec’s cybersecurity center in 2022 and held security clearance issued through Military Unit 26165, which is connected to Fancy Bear/APT28.

🚨DDoS Alert: 🇺🇸 313 Team claims to have targeted the website of Cloudflare (dash.cloudflare.com).

The further Putinisation of America. The government has TV shows which hurt the Dear Leader's delicate feelings cancelled.

EXKLUSIV: Russlands wichtigste Trollfabrik wagt den Schritt ins echte Leben und verantwortet Aktionen unter falscher Flagge – darunter die Autosabotage, die den Grünen zugeschoben werden sollte. Wikipedia-Klon soll außerdem KI-Systeme manipulieren. Recherche mit @larswienand.bsky.social Mehr folgt.

In den Niederlanden wurden zwei IT-Unternehmer verhaftet, weil diese gegen #EU-Sanktionen verstoßen haben sollen. Im Fokus der Ermittlungen steht ein Unternehmen, über dessen Rolle in #Russlands hybridem Krieg CORRECTIV berichtet hatte.

Gegenüber @volkskrant.nl bestritt er, von den pro-russischen Angriffen über seine Infrastruktur gewusst zu haben, und erklärte, er habe seine Zusammenarbeit mit den Neculitis direkt nach den Sanktionen beendet. www.volkskrant.nl/binnenland/h...

Yours truly threat-modeled Russia's new super-app. TL;DR: you should probably be concerned even if you live outside Russia and never download the app.

"Cyber is a canary in a coal mine, it gives you a sense of adversary intentions. It's the first tool they'll pull out of their toolkit because it's covert, deniable, and perceived to have very little cost to it." (7:05) Listen to the latest episode of #ShiftingGround. #OrbisJournal

RBC and Kommersant both report that Russian authorities have postponed a plan to introduce surcharges for more than 15GB/month of international Internet traffic until after the Duma elections in September. The measure stems from Putin’s directive to stop use of VPNs to evade censorship.

Around a third of Russian companies are using Western software acquired before 2022, before Russia's invasion of Ukraine. Most of the software doesn't receive technical support and security updates www.kommersant.ru/doc/8673186

This hits close to home. Good thing I’m not popular. 😉

The Russian Central Bank has called on financial institutions to pay more attention to clients dealing in large volumes of cash, noting that this could be a sign of illegal activity. Gosh, do ya think? kommersant.ru/doc/8674668

How have I never seen this self portrait before? Leave it to Dürer to both embody and masterfully capture the bloom of youth to which most of us could only aspire. More than 500 years ago.

💬 “If there’s one thing the Russians are good at, it’s identifying their opponents’ weaknesses and exploiting them.” 1/2🧵 www.politico.eu/article/frie... #russia #germany

Der Krieg gegen die #Ukraine verschärft die Spannungen innerhalb der russischen Eliten und Putins Machtgefüge aus verschiedenen Clans gerät ins Wanken. Das russische Investigativmedium @istories.bsky.social, Kooperationspartner von CORRECTIV, analysiert die einflussreichsten Clans und ihre Macht.

🇦🇹 An Austrian court found former intelligence officer Egisto Ott guilty of spying on Wednesday in a case in ‌which he was accused of helping #Russia hunt down opponents and selling it state laptops and phones at the behest of suspected Moscow agent Jan Marsalek. www.reuters.com/world/austri...

Last fall, hackers replaced a popular FPV firmware app on the developer's website with an infected version, acc. to Ukraine's National Security and Defense Council www.rnbo.gov.ua/files/2026/N... I wasn't able to find additional details, but see my analysis here t.me/cyberguerre/...

🚨Data Breach Alert ‼️ 𝗧𝗲𝗮𝗺𝗣𝗖𝗣 𝗖𝗹𝗮𝗶𝗺𝘀 𝗦𝗮𝗹𝗲 𝗼𝗳 𝗚𝗶𝘁𝗛𝘂𝗯 𝗜𝗻𝘁𝗲𝗿𝗻𝗮𝗹 𝗦𝗼𝘂𝗿𝗰𝗲 𝗖𝗼𝗱𝗲 TeamPCP hacking group claimed the compromise and sale of GitHub internal data, allegedly including around 4,000 private repositories containing source code related to GitHub’s main platform and internal organizations.

Welches sind die besten deutschsprachigen Erzählwerke zwischen 1924 und 2024? Gemeinsam mit einer vierköpfigen Literaturjury haben wir eine Entscheidung getroffen: Hier sind die Bücher, die ein Jahrhundert geprägt haben.

‼️🚨 BREAKING: GitHub has been compromised by TeamPCP. GitHub has confirmed the internal breach. A poisoned VS Code extension on an employee device exfiltrated ~3,800 internal repositories. TeamPCP is already selling the data on a cybercrime forum.

В государственном мессенджере Max обнаружили функции тотальной слежки за пользователями. Max собирает список контактов и установленных программ, может делать скриншоты переписок, вести скрытую запись звука, создавать фейковые чаты и стирать сообщения прямо с телефона без следа.

Microsoft takes down Signing Cloud, a service that sold digital signing certificates obtained through fake accounts on Microsoft's Artifact Signing service This was broadly used by Rhysida and other ransomware groups blogs.microsoft.com/on-the-issue...

Verizon's famed DBIR is out for 2026. www.verizon.com/about/news/b...

Russia struck a Ukrainian air defense position with online-controlled Shahed drone, defense ministry adviser Serhii "Flash" Beskrestnov reported The strike illustrates a growing threat: Russia is piloting Shaheds in real time from its own territory euromaidanpress.com/2026/05/19/f...

1/ A warning from the Russian government that the Ukrainians are trying to take over Russian Telegram channels has attracted scepticism from Russian nationalist warbloggers. They see it as a possible plot by Russian intelligence agencies to discredit inconvenient "patriots". ⬇️

The group that was planning a military coup in Romania last year to back a pro-Kremlin candidate was using ChatGPT to translate text from Romanian to Russian, and even got a meeting with Russian FSB Director Alexander Bortnikov www.libertatea.ro/stiri/proces...

В мессенджере Max нашли слежку за установленными приложениями, адресной книгой и скрытую запись звука habr.com/ru/articles/... 🔸 нежиданно 😲

Bitcoin Depot, the US' largest crypto ATM operator, is shutting down citing anti-fraud measures it had to roll out ...and now you know why these things existed in the first place www.globenewswire.com/news-release...

In Primorye in the Russian Far East, two hackers aged 30 and 35 have been sentenced to 2 years of restricted freedom (not incarceration) for sending links to malware to hotels in order to steal access credentials. Restricted freedom seems to be a common sentence for 1st time offenders.

Another day, another Russian hacking case against a man accused of hacking Gosuslugi accounts. In Omsk, a 20yo man got access to 31 accounts by buying used SIM cards; he predictably took out loans using the illicit access. He will be tried soon.

The Russian MVD announced today the arrest of 88 persons around the country for contributing to fraud infrastructure by running SIM-boxes or registering phone numbers for them or by fulfilling other tasks “for Ukrainian intelligence services.”

A reminder that the idea that Crimea is 'naturally' Russian ignores the fact that Stalin deported the indigenous Crimean Tatar population, & that Putin is now doing his best to destroy their identity again.

A good primer on the new Bitlocker exploit. solcyber.com/bitlocker-in...

DOXA has a nice overview of how conspiracy theories are wielded by all factions in Russian politics from the government to the opposition. Not a new phenomenon, but particularly pervasive now. doxa.team/articles/con...

I’m sure this Roman Catholic parish will be a big money maker for that ransomware group. Sheesh. Was there no orphanage to attack?

The UK government has sanctioned two Russian disinformation groups for attempts to destabilize Armenia's pro-western government www.gov.uk/government/n...

More insights on how The Gentlemen ransomware is structured (from their recent internal leak) ransom-isac.org/blog/the-gen...

Not sure the current administration is capable of understanding, much less mustering, a whole-of-government multifaceted approach to implementing foreign policy, or really acting on policy in general. Just being realistic.

Putin signed a decree simplifying Russian citizenship for residents of Transnistria. The move follows Russia’s adoption of a law allowing the army to be used to “protect Russians” abroad, creating a direct threat near Ukraine’s southern border with Moldova. #Russia

🔎🇷🇺 A 10-day Moldova–Moscow trip by MAGA influencers from the US, UK and Canada was leveraged in a Kremlin-linked influence operation named “Matushka”. No proof the influencers knowingly took part – but we uncovered their many ties to Russia. VSquare.org

I think @doctorow.pluralistic.net makes this point well when he talks about what will be left to salvage after the AI* bubble pops. doctorow.medium.com/https-plural...

🚨Cyber Alert ‼️ 🇺🇸USA - 𝗘𝗹𝗶 𝗟𝗶𝗹𝗹𝘆 𝗔𝗻𝗱 𝗖𝗼𝗺𝗽𝗮𝗻𝘆 TeamPCP allegedly breached Eli Lilly, claiming the theft of more than 1,200 internal repositories totalling over 80 GB of source code, along with 40 GB of documents allegedly taken from the company’s Veeva Vault environment.

More Russian hacker cases today. In Tomsk, a 25yo man has confessed to hijacking 56 accounts on Gosuslugi in 2025. A court is deciding his sentence. 1/

Ransomware trends and tactics - IT-Online it-online.co.za/2026/05/13/r...

The Doppelgänger (aka Social Design Agency (SDA)) campaigns are a coordinated series of online influence operations attributed to Russian-linked actors and associated with the technical operator, Structura. DomainTools Investigations dti.domaintools.com/research/sda... @domaintools.bsky.social

Microsoft *and* Europol takedown doesn’t actually take down a cybercrime service. Typical.

There's some interesting details from an analysis of Shai-Halud code in here, one part that caught my eye was them using Fulcio/Rekor for provenance and also targeting Kubernetes secrets amongst other things securitylabs.datadoghq.com/articles/sha...

-Run dark web market for years -Stay in hiding for years after the FBI seizes your market -Take all the market's bitcoin and move it to one singular wallet -Convert the funds into gold bars -Send gold to your real home address 🤣 NEVER CHANGE CRIMINALS!! NEVER CHANGE www.justice.gov/usao-ndga/pr...

1/ Russian programmers are reporting that GitHub, the world's largest cloud platform for IT projects and collaborative development, is becoming increasingly inaccessible for them. The reasons aren't clear, but it's a looming disaster for Russian military and civilian IT. ⬇️