Kudos to Microsoft & Cloudflare for taking action against RaccoonO365 Here's the link to relevant legal files with a bunch of seized domains & other interesting details (via Health ISAC) noticeofpleadings.com/RaccoonO365/

APT or Another Phishing Training? Seqrite reported an attack on the Kazakhstani oil company KazMunayGas attributed to a new group NoisyBear www.seqrite.com/blog/operati... Yet the company later argued that this was a simulated attack orda.kz/planovoe-mer... This looks plausible: 1/2

defense.gov now redirects to war.gov, but the page won't load at the moment

Y'all are missing out on the BRICS+ Fashion Summit

Since May Russia regularly shuts down mobile Internet to counter the drone threat Shutdowns disrupt taxis, food delivery, ATMs, remote work & upset ppl Now the gov't wants to create white list of services that would be available even during shutdowns www.interfax.ru/russia/1040184

My take (in Russian) on this week's cyber attack against Aeroflot. The key idea is pretty simple: to solve the problem of cyber war, information security measures alone are not enough; it needs to be adressed politically, too, through conflict resolution www.forbes.ru/mneniya/5430...

Trump says he "ordered two Nuclear Submarines to be positioned in the appropriate regions" in response to ex-President Medvedev's provocative statements (probably his recent tweet) This reminded me of the 2020 report by Alexi Drew & @heatherwilly.bsky.social www.kcl.ac.uk/csss/assets/...

A major cyber incident in Russia: two groups, Cyber Partisans & Silent Crow, took credit for a cyber attack on Aeroflot, claiming they destroyed its internal IT systems. Aeroflot didn't acknowledge the attack but canceled nearly 100 flights & delayed some more due to an 'outage'

A cyber attack disrupted the operation of a Russian network of volunteer-run service centers that jailbreak commercial DJI drones making them fit for warfighting. Although no one took credit for this hack it looks like a highly targeted sabotage operation fromcyberia.substack.com/p/hackers-di...

Can a cyber operation have an impact on drone warfare? Probably yes, but in a not-so-obvious way. In a new post, I review a reported disruption of a network of service centers that weaponize commercial DJI drones with a customized firmware. open.substack.com/pub/fromcybe...

QiAnXin reports on a new APT, NightEagle, active since 2023 & targeting Chinese tech & gov't orgs. QAX claims that the attackers exploited an unknown Exchange vuln "Considering the target and interests of the attack, we think the group is from a country in North America" github.com/RedDrip7/Nig...

Professionals in most countries borrowed the term APT from the U.S. But France uses the acronym MOA instead, which stands for 'mode opératoire d'attaque.' This term emphasizes the unique set of TTPs of the attacker rather than its skills or persistence cyber.gouv.fr/le-cyberdico

NoName057(16) is selective with its "love" intel471.com/blog/nato-su... PS: They targeted the Netherlands again yesterday, mainly because of the NATO summit www.telegraaf.nl/binnenland/p...

Update on the REvil case: Bessonov, Golovachuk, Muromskiy, Korotayev plead guilty & were sentenced to time served (Not for ransomware attacks but for carding) The court also decided to confiscate 2 Benzes & $1.2 mil from Bessonov, a BMW from Korotayev tass.ru/proisshestvi...

Reupping my piece on Cyber Espionage Among Friends following @meghara.bsky.social NYT story on Chinese cyber operations targeting Russia I dig into Russian reports about Chinese APTs & vice versa & provide context on why there's no political backlash fromcyberia.substack.com/p/cyber-espi...

Cyber threat intelligence has evolved primarily as a private domain driven by cyber security vendors and researchers. Is this about to change? My reflections on several recent publications about whether threat intelligence is becoming 'nationalized' fromcyberia.substack.com/p/nationaliz...

Today is the 15th anniversary of the discovery of Stuxnet by Belarusian firm VirusBlokAda It was only 2 weeks later that they disclosed it publicly, specifically the LNK zero-day vulnerability (CVE-2010-2568) EN web.archive.org/web/20100717... RU web.archive.org/web/20100717...

When Russia declares an author a 'foreign agent' their books can still be sold but their status must be indicated on the cover (books by Alexander Arkhangelsky on Russian poetry & by Nikolay Epple on nations dealing with their difficult past)

In the past few months Russia has been routinely switching off mobile Internet for entire regions to counter drone strikes Now Ukraine considers doing the same thing — a working group has been set up in Rada reportedly at the initiative of the military nv.ua/ukraine/poli...

State Duma has just passed a bill on the national messaging app (smth like a Russian version of WeChat) www.interfax.ru/russia/1030583 Acc. to this bill the gov't is supposed to pick a company to develop this app. But the decision has already been made to use Max, a new app from VK

China's public attribution is evolving. A report by CVERC & 360 on Taiwanese APTs is quite unique. For the 1st time it combines in a single document: — technical analysis — political accusation against Taiwan, DPP, U.S. — arrest warrant — military threat www.cverc.org.cn/head/zhaiyao...

Old infosec books often describe "logic bombs," but we rarely see those mentioned in contemporary reports. Kaspersky discovered that Belarusian Cyber Partisans' wiper was programmed to activate on specific dates & was likely used against Grodno Azot ics-cert.kaspersky.com/publications...

Russia has just declared undesirable the Association for Slavic, East European, and Eurasian Studies (ASEEES) Simply put it's now illegal for Russian scholars to participate in ASEEES's activities such as conferences or publications

Russian defense scholars have been worried for years that high-precision weapons including UAVs could be used (by the U.S.) to target strategic nuclear forces. E.g. this paragraph in a 2021 article by researchers of the academies of General Staff & RVSN elibrary.ru/item.asp?id=...

Ilya Gorbunov, former head of Prigozhin's Patriot media holding (aka 'troll farm'), sentenced to 10 years on extortion and drug trafficking charges www.rbc.ru/politics/30/...

It's quite unusual for any country to mention UN cyber norms outside of a UN meeting. Yesterday not one but two governments did so, the Czech Republic in its accusation & China in its rebuttal. Not that it made any difference CZ mzv.gov.cz/jnp/en/issue... CN cz.china-embassy.gov.cn/cze/xwdt/202...

NEW: More than a decade ago, Kaspersky discovered a mysterious "elite" hacking group it called Careto (aka “The Mask”), which then vanished and only resurfaced last year. We can now reveal that the researchers who investigated it were confident that the Spanish government was behind it.

Short thread (hopefully in plain English) on the nuclear deterrence dynamics in the India-Pakistan relationship and where this goes if escalation continues. <1>

Here's a working link to my substack: subscribe here. profradchenko.substack.com.

Did you know that there is a monument to NotPetya in Moscow? It was installed by INVITRO, a Russian medical firm & one of the victims of the 2017 global attack initially aimed at Ukraine. INVITRO's PR goal was to remind the world that it knows how to fight viruses

Sovereign Internet meets drone warfare: at the demand of regional authorities mobile operators in Rostov oblast reduce the speed of mobile Internet at night to 512 kb/s due to Ukrainian UAV attacks. Officials considered complete night-time shutdowns too www.kommersant.ru/doc/7677443

Government funding needed for MITRE to develop + maintain its flagship Common Vulnerabilities and Exposures Program will expire Wednesday, the company confirmed. CVE provides a global standard for identifying cyber vulnerabilities. It was first launched in 1999. www.nextgov.com/cybersecurit...

Harbin authorities accuse 3 'NSA agents' for their alleged role in cyber attacks on Asian Winter Games & CI in Heilongjiang cn.chinadaily.com.cn/a/202504/15/... The attacks were described in a recent CVERC report (cverc.org.cn/head/zhaiyao...) which is not very specific even by Chinese measures

I've updated my list of APT groups targeting Russia. It's based on private sector reports on cyber attacks that target Russian organizations. The collection now features around 130 reports covering activities of 49 APTs cyberguerre.notion.site/3ca6753fc47d...

Recently a major Russian UAV-focused project posted a video about capturing some Ukrainian drones equipped with USB killers and/or malware to prevent reuse t.me/projectArcha... The video has migrated through X & Reddit & informed this Forbes article www.forbes.com/sites/vikram...

We are looking forward to organising the 8th edition of our Conference on International Cyber Security on 4 and 5 November 2025! The Call for Papers is now out! This year's theme? ➡️ Order, disorder, re-order? Geopolitics and the transformation of cyberspace: www.thehagueprogram.nl/news/2025-co...

Russia's largest private energy company Lukoil was hit by a ransomware attack today & hasn't recovered yet. The full scale of impact is unknown but the attack has reportedly paralyzed Lukoil's offices in Moscow & forced gas stations to only accept cash www.rbc.ru/technology_a...

Russia declares @theeln.bsky.social an undesirable organization www.rbc.ru/politics/25/...

A DDoS attack on the Russian provider Lovit, claimed by IT Army of Ukraine, disrupted clients' access to the Internet but also to smart intercoms & cameras. In some houses it's essentially a monopoly provider, so clients seek help from the anti-trust body ria.ru/20250323/zhi...

As for Gen Z, I’m not great at keeping up with all these new social media platforms, but I’m glad I finally made it to BlueSky! I’ll be posting here about cyber stuff and life in Ukraine during the war. Follow me!

Big day for Chinese threat intel MSS outs 4 alleged members of Taiwan's Information, Communications & Electronic Force Command, links them to cyber attacks QiAnXin & Antiy release 2 separate reports on Taiwan-linked APT-Q-20/APT-C-01/GreenSpot/PoisonVine 🧵w/ links & details

BI ZONE researchers discovered a spear phishing attack by APT37/ScarCraft (dubbed Squid Werewolf) apparently targeting Russian companies. The attackers used a fake job offer as a lure and a rather long and evasive infection chain bi.zone/eng/expertis...

Good to know America is strongly committed to non-proliferation usun.usmission.gov/remarks-at-t...

In a rare move, the FSB officially accuses UA defense intel (GUR) of hacking into email correspondence btw Russian patriotic youth orgs & using an intercepted doc in a phishing attack on schools. The alleged goal: to recruit students for spying & sabotage www.fsb.ru/fsb/press/me...

In late December, Mikhail Matveev a.k.a. Wazawaka was sentenced to 1.5 years of restriction of freedom for building ransomware (art. 273 of the Criminal Code); essentially he's not allowed to travel & change residence without permission. No mention of any victims whatsover

According to Qihoo 360, 'North American' and 'Eastern European' APTs are far less active compared to 'East Asian' and 'South Asian' ones (and even to one well-known 'Southeast Asian' APT) 360.net/research/rep...

Since Alexander Ermakov was tagged in yesterday's statements on zservers sanctions, you might wonder what happened to the criminal case against him in Russia? Well, he was sentenced to 2 years of restriction of freedom for spreading malware; no victims mentioned in the sentence

Sergey Rogov, a long time head and then academic director of the Institute of U.S. and Canada Studies, passed away today iskran.ru/9-fevralya-2...

I came across a 1990s interivew with Filipp Bobkov (ex-KGB) about KGB's efforts against AIDS; acc. to him he sought to dispel the allegations about AIDS's lab origin & was instrumental in persuading Soviet health officials to take the epidemy seriously & seek foreign aid