I spent some time this week digging into Kaspersky's report on Lotus Wiper & its likely connection to the December attack on the Venezuelan oil company PDVSA. In this post, I explain my findings & speculate about U.S. involvement & potential implications fromcyberia.substack.com/p/pdvsa-was-...

Lotus Wiper was likely used to attack PDVSA One important thing that the Kaspersky report omits is that pdvsa[.]com is hardcoded into OhSyncNow.bat, a file that triggers the wiping operation (HT @benread.bsky.social). This is used to limit the attack to the specified domain 1/11

I think actors on this random slide from a presentation on LotL techniques are more or less representative of Russia's threat landscape: 1/3 Chinese espionage; 1/3 Ukrainian espionage; 1/3 Ukrainian destructive attacks Add on top some DPRK & U.S. espionage + cyber crime

Kaspersky discovered a new wiper uploaded from Venezuela in mid-December. The campaign likely targeted utilities and energy sector Evidence suggests it was months in the making There are no explicit links to previously reported incidents in Venezuela securelist.com/tr/lotus-wip...

Following the recent reports by U.S. & allied intel & law enforcement agencies attributing DNS hijacking via TP-Link routers to APT28 the Russian Foreign Ministry criticizes the United States for not talking to RU privately through the UN PoC Directory mid.ru/ru/foreign_p...

My take on the Grinex heist & their claim that they were hacked by Western intelligence losing 1B rubles ($13M) I examine several versions and the Western one doesn't look very plausible. So far we have limited info, so I'm just speculating in RU t.me/cyberguerre/...

While the backlash against internet restrictions in Russia is real, there is no evidence that the Kremlin plans to reconsider its policy. Quite the contrary, Russian authorities have already spent billions & are going to spend even more to tighten control www.bloomberg.com/news/article...

I've updated my list of APTs & politically motivated groups targeting Russia. It includes 67 actors & 250 reports spanning more than a decade With the total N of reports per group, it's now easy to see who's most talked about (not necessarily top threat) cyberguerre.notion.site/3ca6753fc47d...

Russia just banned Stanford by declaring it an undesirable organization Coincidentally, Stanford is the alma mater of Russia's chief negotiator with the United States Kirill Dmitriev www.rbc.ru/politics/10/...

Alex Gostev co-authored a book (under a pen name) covering the history of Kaspersky & some of GReAT's investigations. Nothing sensational, but a useful read especially for Russia where there's not a lot of non-technical infosec literature If interested, DM me—I have a copy in DC

WeChat was declared a model for Max a year ago when the Russian messenger was launched. But in practice it's now imperfectly modeled on Telegram which it's trying hard to replace

OSW also proposes to stop sharing counterterrorism intel w/ Russia like the U.S. did in 2024 Whoever wrote this should be ashamed of themselves For RU & U.S., the obvious lesson from the failures to prevent attacks on the Boston Marathon & Crocus is to preserve these contacts

This FBI alert is indicative of a broader trend. The rest of the world have for a long time felt uneasy about their dependence on U.S. tech (hence you get data localization, digital sovereignty, etc.). Now America is also realizing its vulnerability www.ic3.gov/PSA/2026/PSA...

This was a great discussion, make sure to sign up to future events if you are interested in cyber conflict & policy

Polish gov't think tank OSW proposes that the West conduct more offensive cyber operations against Russia to weaken its gov't system & mess with its security services Along with dozens other recommendations to exploit Russia's "weak points" www.osw.waw.pl/pl/publikacj...

Tufts University & Fletcher School are now banned in Russia www.forbes.ru/education/55...

DDoS-Guard confirms to Kommersant that the Handala's leak site used its DDoS protection "for some time" but this is not a link to Russia www.kommersant.ru/doc/8551841 What's not said is that they should have the original IP. So the U.S. can potentially try to request it from Russia

True. Every state presents itself as a victim of cyber attacks, not an attacker. To get a full picture you need reports from all sides If you're curious who's targeting Russia, see my list cyberguerre.notion.site/3ca6753fc47d... (Also Eagle Werewolf is likely linked to Ukraine, not America)

NYT's description of Handala's link to Russia is inaccurate. WHOIS shows an IP of DDoS-Guard (Russia's Cloudflare alternative) that can mask the real IP, i.e. the server could be elsewhere Like Cloudflare, DDoS-Guard is often abused by threat actors www.nytimes.com/2026/03/27/u...

Future of assault troops seen by some Russian military scholars

Found it at UC San Diego, anyone from there?

I'm searching for this short paper, but wasn't able to find it neither online nor in the libraries. If anyone has a scan I'd greatly appreciate it! cisac.fsi.stanford.edu/publications...

Kaspersky confirms Coruna link to Operation Triangulation securelist.com/coruna-frame...

Can't disagree with this more. The surge of cyber attacks in Ukraine & Russia during the war was definitely driven by political & war-related motivations. This is clear from commercial security research & my own close observations over the years www.ft.com/content/4e88... 1/2

Russian cyber police detains a suspected LeakBase creator & admin Ministry of Interior's statement & media reports don't mention the LeakBase takedown in early March by Europol, EU LEAs & FBI Still, maybe Russia was tipped off by the West? tass.ru/proisshestvi...

Russia has for the 1st time officially declared its commitment to maintaining human control over nuclear weapon use While AI is not explicitly mentioned, this is Russia's response to recent AI/nuclear debates & it aligns with the 2024 Biden-Xi statement docs-library.unoda.org/Treaty_on_th...

At RSAC Conference —> Google’s threat intelligence arm officially launched its anticipated disruptive cyber unit on Monday, which comes as the Trump admin seeks to create a more offensive, proactive US culture against hackers. www.nextgov.com/cybersecurit...

A 1997/1998 forecast of warfare in the information age. To the authors some attacks seemed 'farfetched,' but most are routine today apps.dtic.mil/sti/tr/pdf/A...

State Department (re)launches the cyber bureau with an expanded portfolio that now also includes space, AI, quantum, etc. The establishment of the Bureau of Emerging Threats was first announced almost a year ago, in April 2025 abcnews.com/Politics/sta...

Dmitry Medvedev philosophizing about how drone warfare removes risks for its participants as if it's not happening right here right now in a way that's opposite to "clean" and "riskless" expert.ru/mnenie/novye...

Deterrence is in the eye of the beholder www.cnn.com/2026/03/12/p...

With ties at their strongest since the Cold War, Russia and North Korea have effectively built an alliance. But it doesn't extend into cyberspace. Here are my quick thoughts on two recent articles overstating cyber cooperation between Moscow and Pyongyang. fromcyberia.substack.com/p/moscow-pyo...

I wouldn't read too much into attacks of pro-Russian groups like NoName057(16) in support of Iran. They routinely & opportunistically target all kinds of states But if you look for examples, there are plenty. Last week, Z-Pentest claimed a hack of an Israeli pump control system

SCOOP: The iPhone mass hacking toolkit used by Russian spies was developed at U.S. military contractor L3Harris, former employees said. The Coruna toolkit was used against Ukrainians and by Chinese cybercriminals, according to Google. But the toolkit was initially developed for Western governments.

Great video by Billy Elliss showing how the Coruna infection works (the criminal version) for non-technical people like myself. Maybe threat intel researchers should also consider producing something like this in addition to technical reports www.youtube.com/watch?v=XQvZ...

The White House released President Trump’s Cyber Strategy for America HT @ddimolfetta.bsky.social "Cyberspace was born in America" "President Trump will continue showing those who harm our interests and attack our values in cyberspace place themselves at risk" www.whitehouse.gov/wp-content/u...

Kaspersky recently produced a podcast on Operation Triangulation, basically a story of the investigation Things that I haven't seen mentioned elsewhere: — Triangulation malware existed for >10 years — Some technical details similar to the Equation Group www.youtube.com/watch?v=j4pC...

On Feb 4, Qatar became the 1st state to ratify the UN Convention against Cybercrime. Albeit with some reservations, most notably it doesn't consider itself bound by the provisions of Art. 14, 15, 16. Simply put, it narrowed the scope from 11 to 8 crimes treaties.un.org/Pages/ViewDe...

A 1999 assessment by DoD OGC briefly mentions a draft treaty on information warfare that circulated on the Internet in 1995. Does anyone have any idea what it was or where on the Internet it could have been circulated? (Source: nsarchive.gwu.edu/document/214...)

Iran in the Cold War. A useful background read from To Run the World. open.substack.com/pub/profradc...

Russia declares UC Berkeley & the Russian American Science Association (RASA) undesirable organizations, making it illegal to participate in their activities & even to share information from them. It's the 4th U.S. higher ed organization banned by Russia (Bard College, Yale, GW)

While some cyber attacks from Iran might increase, keep in mind that many Iranian hackers face Internet shutdowns, instability caused by U.S./Israeli strikes, etc. So they won't be very active Note this from a recent F6 report on Persian ransomware www.f6.ru/blog/c77l-ra...

Russian gov't is drafting a major bill on AI One of the ideas is to categorize AI into 'sovereign models' that would have to be built entirely within RU & use only RU datasets and 'national models' that can use open source components & non-RU data www.kommersant.ru/doc/8463730

Scoop: Rubio has ordered US diplomats to fight data sovereignty initiatives worldwide www.reuters.com/sustainabili...

Weird cyber story from Russia: a Moscow resident Ruslan Satuchin faces criminal charges for allegedly contacting Conti under the pretense of the FSB & extorting money for protection. Now he's investigated for fraud No word of legal action against Conti www.rbc.ru/society/25/0...

US Treasury sanctions Russian exploit broker Operation Zero home.treasury.gov/news/press-r...

There are few things that Russian & Ukrainian security services agree on. But both detest Telegram basically for the same reason: it's being used by the adversary Russia considers blocking Telegram & Ukraine is not there yet RU rg.ru/2026/02/24/t... UA interfax.com.ua/news/general...

I'm looking for VeriSign iDefense's threat intelligence reports. Came across a couple PDFs available here and there. But maybe someone has an archive of those?

"The portal could also put Washington in the unfamiliar position of appearing to encourage citizens to flout local laws." U.S. efforts to help people in other countries circumvent Internet censorship (often enshrined in law) date back to 2009 or earlier www.reuters.com/world/us-pla...

A bit surprised to see this para on Killnet in the recent GTIG report. No doubt there are multiple attempts to target drone warfare. But these Killnet's attacks weren't verified. And Killnet is known for exaggerating their claims. So at least add a caveat cloud.google.com/blog/topics/...