RU Consul General in NY said the FBI notified the Consulate General about Denis Obrezko's arrest on June 9 He complained that the U.S. ignored bilateral law enforcement mechanisms Curiously, he didn't mention that Obrezko is wanted in Russia tass.ru/politika/277...

Denis Obrezko, arrested in Thailand last fall at the U.S. request on hacking charges & alleged connection to Void Blizzard, made an appearance in federal court in Boston, @nateraymond.bsky.social reports In Jan, Russia filed a competing extradition request but lost www.reuters.com/legal/govern...

AI firms put a lot of effort into creating safety mechanisms to prevent LLMs from generating harmful outputs Malware developers can exploit the same guardrails by hiding payload behind nuclear & bio weapons-linked instructions to trick AI-driven scanners socket.dev/blog/mini-sh...

Russia's new Antifraud bill requires banks to decline transfers if the client's device is infected with malware. To scan for malware the banks would need to provide their clients with a security tool (antivirus?). The implementation is not entirely clear www.interfax.ru/business/109...

A bit contradictory The German officer: yeah, we can learn from the Ukrainians. But their narrative in this game wasn't consistent, so they lost A Ukrainian participant: but there is no consistent narrative in the real world, that's what you could learn www.ft.com/content/cda1...

U.S. concerns about China's prepositioning in critical systems are somewhat similar to Soviet/Russian fears in the early 90s that the U.S. could change parity through backdoors in imported tech Here's one example from an article by military officer turned scholar Rafael Yusupov

Join me on a little 30-second rabbit hole... 🕳️🐇 There’s something weird about the Chinese Ministry of Foreign Affairs’ statement in response to the Five Eyes security bulletin, as shared below. Have a close read, if you can see it. I myself didn't until I added the statement to my copy. [1/11]

Russia's Supreme Court will consider designating Belarusian Cyber Partisans & Silent Crow extremist organizations—the 1st time extremism legislation might be applied to cyber actors This is likely because of the attack on Aeroflot claimed by both groups www.rbc.ru/rbcfreenews/...

Davis Center's abandoned domain for the Working Group on the Future of U.S.-Russia Relations is now a "Russian dating site." Sweet that the new owner still pays homage to the original project & keeps US-Russia Future in the head

TIL that, in 2002, Kazakhstan & China signed an agreement on the Prevention of Dangerous Military Activities (DMA) Because it's modeled on the 1989 Soviet-U.S. DMA, it includes procedures for ship-to-ship communications Which is very helpful given the geography of their border

Russia and China consider new steps to expand their digital cooperation including on software development and satellite Internet and declare adherence to cyber norms. In this post, I review the relevant sections of the recent joint statement from Beijing fromcyberia.substack.com/p/putin-and-...

Vasily Kashin argues that Russia cannot achieve its original "special military operation" goals (he doesn't think it's a failure) & should make peace under conditions discussed in Alaska—the first such acknowledgement from a prominent Russian expert globalaffairs.ru/articles/chu... 1/5

Last fall, hackers replaced a popular FPV firmware app on the developer's website with an infected version, acc. to Ukraine's National Security and Defense Council www.rnbo.gov.ua/files/2026/N... I wasn't able to find additional details, but see my analysis here t.me/cyberguerre/...

A 1996 forecast by U.S. military of what warfare would look like in 2025 30 years later, it's clear that new fancy battles didn't replace the old ones but expanded them. States fight over land, in cyberspace, using UAVs, space systems. Few lasers so far www.airandspaceforces.com/app/uploads/...

Exclusive: Fast16 malware has raised questions about what it was designed to do. Researchers at Symantec finally confirm it was subverting software used to simulate nuclear weapons explosions. Nuclear experts also tell me Iran was the likely target and explain how it impacted nuclear weapons tests

5 years ago the Russian gov't CERT, part of the FSB, published its 1st & so far the only specific threat intelligence report. The report omitted attribution, but these attacks were later linked to China-nexus groups by SentinelOne, Group-IB & Solar safe-surf.ru/specialists/...

Why no one talks about Data Diddling and Superzapping anymore? Have we solved these problems?

IT Army of Ukraine said it joins the ceasefire that was announced unilaterally by Zelensky starting May 6 in response to Putin's unilateral ceasefire on May 8-9 This is largely symbolic but still noteworthy as an example of cyber attacks halted as part of a quasi-agreement

Great scoop by Patrick Howell O'Neill on Sector16 hacker's plea deal www.bloomberg.com/news/article... Whatever they said, Sector16 isn't even remotely capable of causing a major blackout. See my recent post on their typical attack on critical infrastructure fromcyberia.substack.com/p/not-all-cy...

Two weeks ago, Sweden blamed pro-Russian hackers for a cyber attack on it heating plant last year. I was able to find an attack claimed by the hacktivist group Sector16 that closely matches the description fromcyberia.substack.com/p/not-all-cy... 1/3

Throwback to early NYT reporting on Russian hackers In 2007, Michael Schwirtz asked Russian LJ users for their opinions. One user said he didn't think hackers were a big problem & he was cited by Clifford Levy a week later This was a sentiment shared by some, but not all in Russia

I'm going to be in New York next week. Hit me up if you want to talk cyber stuff

I spent some time this week digging into Kaspersky's report on Lotus Wiper & its likely connection to the December attack on the Venezuelan oil company PDVSA. In this post, I explain my findings & speculate about U.S. involvement & potential implications fromcyberia.substack.com/p/pdvsa-was-...

Lotus Wiper was likely used to attack PDVSA One important thing that the Kaspersky report omits is that pdvsa[.]com is hardcoded into OhSyncNow.bat, a file that triggers the wiping operation (HT @benread.bsky.social). This is used to limit the attack to the specified domain 1/11

I think actors on this random slide from a presentation on LotL techniques are more or less representative of Russia's threat landscape: 1/3 Chinese espionage; 1/3 Ukrainian espionage; 1/3 Ukrainian destructive attacks Add on top some DPRK & U.S. espionage + cyber crime

Kaspersky discovered a new wiper uploaded from Venezuela in mid-December. The campaign likely targeted utilities and energy sector Evidence suggests it was months in the making There are no explicit links to previously reported incidents in Venezuela securelist.com/tr/lotus-wip...

Following the recent reports by U.S. & allied intel & law enforcement agencies attributing DNS hijacking via TP-Link routers to APT28 the Russian Foreign Ministry criticizes the United States for not talking to RU privately through the UN PoC Directory mid.ru/ru/foreign_p...

My take on the Grinex heist & their claim that they were hacked by Western intelligence losing 1B rubles ($13M) I examine several versions and the Western one doesn't look very plausible. So far we have limited info, so I'm just speculating in RU t.me/cyberguerre/...

While the backlash against internet restrictions in Russia is real, there is no evidence that the Kremlin plans to reconsider its policy. Quite the contrary, Russian authorities have already spent billions & are going to spend even more to tighten control www.bloomberg.com/news/article...

I've updated my list of APTs & politically motivated groups targeting Russia. It includes 67 actors & 250 reports spanning more than a decade With the total N of reports per group, it's now easy to see who's most talked about (not necessarily top threat) cyberguerre.notion.site/3ca6753fc47d...

Russia just banned Stanford by declaring it an undesirable organization Coincidentally, Stanford is the alma mater of Russia's chief negotiator with the United States Kirill Dmitriev www.rbc.ru/politics/10/...

Alex Gostev co-authored a book (under a pen name) covering the history of Kaspersky & some of GReAT's investigations. Nothing sensational, but a useful read especially for Russia where there's not a lot of non-technical infosec literature If interested, DM me—I have a copy in DC

WeChat was declared a model for Max a year ago when the Russian messenger was launched. But in practice it's now imperfectly modeled on Telegram which it's trying hard to replace

OSW also proposes to stop sharing counterterrorism intel w/ Russia like the U.S. did in 2024 Whoever wrote this should be ashamed of themselves For RU & U.S., the obvious lesson from the failures to prevent attacks on the Boston Marathon & Crocus is to preserve these contacts

This FBI alert is indicative of a broader trend. The rest of the world have for a long time felt uneasy about their dependence on U.S. tech (hence you get data localization, digital sovereignty, etc.). Now America is also realizing its vulnerability www.ic3.gov/PSA/2026/PSA...

This was a great discussion, make sure to sign up to future events if you are interested in cyber conflict & policy

Polish gov't think tank OSW proposes that the West conduct more offensive cyber operations against Russia to weaken its gov't system & mess with its security services Along with dozens other recommendations to exploit Russia's "weak points" www.osw.waw.pl/pl/publikacj...

Tufts University & Fletcher School are now banned in Russia www.forbes.ru/education/55...

DDoS-Guard confirms to Kommersant that the Handala's leak site used its DDoS protection "for some time" but this is not a link to Russia www.kommersant.ru/doc/8551841 What's not said is that they should have the original IP. So the U.S. can potentially try to request it from Russia

True. Every state presents itself as a victim of cyber attacks, not an attacker. To get a full picture you need reports from all sides If you're curious who's targeting Russia, see my list cyberguerre.notion.site/3ca6753fc47d... (Also Eagle Werewolf is likely linked to Ukraine, not America)

NYT's description of Handala's link to Russia is inaccurate. WHOIS shows an IP of DDoS-Guard (Russia's Cloudflare alternative) that can mask the real IP, i.e. the server could be elsewhere Like Cloudflare, DDoS-Guard is often abused by threat actors www.nytimes.com/2026/03/27/u...

Future of assault troops seen by some Russian military scholars

Found it at UC San Diego, anyone from there?

I'm searching for this short paper, but wasn't able to find it neither online nor in the libraries. If anyone has a scan I'd greatly appreciate it! cisac.fsi.stanford.edu/publications...

Kaspersky confirms Coruna link to Operation Triangulation securelist.com/coruna-frame...

Can't disagree with this more. The surge of cyber attacks in Ukraine & Russia during the war was definitely driven by political & war-related motivations. This is clear from commercial security research & my own close observations over the years www.ft.com/content/4e88... 1/2

Russian cyber police detains a suspected LeakBase creator & admin Ministry of Interior's statement & media reports don't mention the LeakBase takedown in early March by Europol, EU LEAs & FBI Still, maybe Russia was tipped off by the West? tass.ru/proisshestvi...

Russia has for the 1st time officially declared its commitment to maintaining human control over nuclear weapon use While AI is not explicitly mentioned, this is Russia's response to recent AI/nuclear debates & it aligns with the 2024 Biden-Xi statement docs-library.unoda.org/Treaty_on_th...

At RSAC Conference —> Google’s threat intelligence arm officially launched its anticipated disruptive cyber unit on Monday, which comes as the Trump admin seeks to create a more offensive, proactive US culture against hackers. www.nextgov.com/cybersecurit...

A 1997/1998 forecast of warfare in the information age. To the authors some attacks seemed 'farfetched,' but most are routine today apps.dtic.mil/sti/tr/pdf/A...