On Feb 4, Qatar became the 1st state to ratify the UN Convention against Cybercrime. Albeit with some reservations, most notably it doesn't consider itself bound by the provisions of Art. 14, 15, 16. Simply put, it narrowed the scope from 11 to 8 crimes treaties.un.org/Pages/ViewDe...

A 1999 assessment by DoD OGC briefly mentions a draft treaty on information warfare that circulated on the Internet in 1995. Does anyone have any idea what it was or where on the Internet it could have been circulated? (Source: nsarchive.gwu.edu/document/214...)

Iran in the Cold War. A useful background read from To Run the World. open.substack.com/pub/profradc...

Russia declares UC Berkeley & the Russian American Science Association (RASA) undesirable organizations, making it illegal to participate in their activities & even to share information from them. It's the 4th U.S. higher ed organization banned by Russia (Bard College, Yale, GW)

While some cyber attacks from Iran might increase, keep in mind that many Iranian hackers face Internet shutdowns, instability caused by U.S./Israeli strikes, etc. So they won't be very active Note this from a recent F6 report on Persian ransomware www.f6.ru/blog/c77l-ra...

Russian gov't is drafting a major bill on AI One of the ideas is to categorize AI into 'sovereign models' that would have to be built entirely within RU & use only RU datasets and 'national models' that can use open source components & non-RU data www.kommersant.ru/doc/8463730

Scoop: Rubio has ordered US diplomats to fight data sovereignty initiatives worldwide www.reuters.com/sustainabili...

Weird cyber story from Russia: a Moscow resident Ruslan Satuchin faces criminal charges for allegedly contacting Conti under the pretense of the FSB & extorting money for protection. Now he's investigated for fraud No word of legal action against Conti www.rbc.ru/society/25/0...

US Treasury sanctions Russian exploit broker Operation Zero home.treasury.gov/news/press-r...

There are few things that Russian & Ukrainian security services agree on. But both detest Telegram basically for the same reason: it's being used by the adversary Russia considers blocking Telegram & Ukraine is not there yet RU rg.ru/2026/02/24/t... UA interfax.com.ua/news/general...

I'm looking for VeriSign iDefense's threat intelligence reports. Came across a couple PDFs available here and there. But maybe someone has an archive of those?

"The portal could also put Washington in the unfamiliar position of appearing to encourage citizens to flout local laws." U.S. efforts to help people in other countries circumvent Internet censorship (often enshrined in law) date back to 2009 or earlier www.reuters.com/world/us-pla...

A bit surprised to see this para on Killnet in the recent GTIG report. No doubt there are multiple attempts to target drone warfare. But these Killnet's attacks weren't verified. And Killnet is known for exaggerating their claims. So at least add a caveat cloud.google.com/blog/topics/...

Today's random find: in early Dec 2025, a month before the attack on Polish energy, Saxo Bank predicted a major blackout in Poland caused by a cyber attack. The prediction was way more dramatic than the real attack, but it was spot on about the fragility www.home.saxo/pl-pl/conten...

Singapore takes another step in the public attribution game linking UNC3886 to attacks on 4 telcos. The report includes a description w/ few technical details Incident response involved >100 defenders making it the largest such operation for Singapore www.csa.gov.sg/news-events/...

A 1989 KGB memo tells a story about how the Soviet intelligence agency encountered computer viruses, including in its own systems, & what it set out to do about it Check out my review of this document with additional context & needlessly obscure details fromcyberia.substack.com/p/how-the-kg...

A major regional bread factory in Vladimir oblast suffered a cyber attack that crippled all of its IT systems. Baking was not affected but logistics & other business operations are now done manually (as illustrated in the vid) causing bread shortages in some regional food stores

At last, 3 weeks into this, NYT kind of admits that there were kinetic strikes on Venezuelan energy infrastructure nytimes.com/2026/01/27/u... I take it as an acknowledgement of my humble contribution Still, it was not 1 but 2 substations, DM me if you need help with this

Apparently Russia is about to engage in a new extradition battle with the United States, this time over Denis Obrezko, an alleged hacker arrested in Nov in Thailand in a joint op w/ the FBI. He's now wanted in Russia under a criminal case that dates back to 2018 1/5

Venezuela confirms that the U.S. operation involved an attack on the National Electric System hitting 2 substations & causing power outages mppee.gob.ve?p=103279 But it wasn't 'cyber' A video posted by the Electric Energy Ministry shows physical damage t.me/minenergia_v...

Russia declares George Washington University an undesirable organization, making it illegal to participate in its activities. Previously Russia banned Yale in a similar way as well as few other U.S. and European higher ed organizations www.rbc.ru/politics/29/...

Blockbuster reporting by Maria Kolomychenko on the Aeroflot hack with new details on messy infosec, the impact of & recovery from what was the biggest cyber attack on Russia during the war thebell.io/istoriya-bol...

Russian Major General Alexey Kostenko (who teaches at the Military Academy of the General Staff) calls for better interagency cooperation in the field of military security

New report from Positive Technologies vivisects recent (2024-2025) APT31 attacks targeting Russian IT firms specifically government contractors and integrators ptsecurity.com/research/pt-...

Thanks to @cyberwarcon.bsky.social for an impressive event. Really enjoyed the talks & the chance to meet people much more obsessed with 'cyber' than I am I got 0 photos except for some slides. But as I was getting off metro I saw this. Quite symbolic in light of my talk on drones & hacking

@doublepulsar.com www.technologyreview.com/2025/11/10/1...

Some of @ridt.bsky.social's tweets are preserved as historical heritage in edited volume citations

new by me - a look at MIT’s cyberslop IOCs and TTPs included doublepulsar.com/cyberslop-me...

The most informed take from Russia so far on drone warfare (and by extension digital warfare) from former Chief of General Staff Yury Baluevskiy & Ruslan Pukhov of CAST TL;DR: drones are indeed revolutionizing & militaries will need to adapt globalaffairs.ru/articles/czi...

Russian authorities arrested 3 men in Astrakhan for creating 'the infamous Medusa virus' (probably Medusa stealer), acc. to the Ministry of Interior. In May they allegedly targeted an org in that region They are also linked to another unnamed malware t.me/IrinaVolk_MV...

NEW: The CEO of Memento Labs admits the spyware found by security researchers targeting Windows victims in Russia was his company's. He said that one of his customers used an outdated version of the spyware that's going to be decommissioned at the end of this year. techcrunch.com/2025/10/28/c...

New draft resolution (by Austria, El Salvador, Kazakhstan, Kiribati, Malta, & Mexico) urges NWS to publish policies "explicitly affirming and operationalizing that [C3] systems of nuclear weapons that integrate [AI] will remain subject to human control" digitallibrary.un.org/record/4091455

Speaking of Grokipedia, Russian authorities have long complained about Wikipedia's biases & promoted several sovereign alternatives incl. Ruwiki (ruwiki.ru) which was forked from Wikipedia & then 'properly' edited. It also uses AI by the way

Earlier research on the same threat actor that used Dante reported today by Kaspersky Dr. Web first found malware w/ the DANTEMARK label st.drweb.com/static/new-w... F6 called it Dante APT www.f6.ru/cybercrime-t... PT linked ForumTroll w/ a few other clusters global.ptsecurity.com/en/research/...

Kaspersky discovered Dante, spyware from Memento Labs (ex-HackingTeam), used by an APT (dubbed ForumTroll) in attacks targeting Russia & Belarus since 2022 securelist.com/forumtroll-a...

Taking metro in DC makes you think about mission-critical, AI-driven, battlefield-proven solutions to everyday problems

The UN Convention against Cybercrime was signed by 63 states & the EU. These include Russia, China, United Kingdom, 12 EU member states, Brazil, Australia, many from Africa, Latin America, South & Southeast Asia. No signatures from the United States, France, Germany, India

As I noted before (bsky.app/profile/shak...), MSS's emphasis on potentially destructive consequences of the attack on the National Time Service Center was likely a response to U.S. accusations regarding Volt Typhoon Now the Chinese MFA says this explicitly www.fmprc.gov.cn/mfa_eng/xw/f...

Singapore submitted draft resolution to the First Committee on establishing a successor to OEWG, Global Mechanism on developments in the field of ICTs in the context of international security and advancing responsible State behaviour in the use of ICTs digitallibrary.un.org/record/40909...

Some thoughts on Chinese accusations against the NSA There're two sources: — the MSS statement (a shorter, more political one) mp.weixin.qq.com/s/ZtKjlaIoMV... — the CNCERT/CC report (technical analysis) mp.weixin.qq.com/s/XPjT0BVOJP... These reports present the breach a bit differently 1/11

I've updated my list of TI reports on threat actors targeting Russia. It now features around 190 reports on 55 groups. Most actors are not reliably linked to a specific state, but among those that are the two top origins are China and Ukraine cyberguerre.notion.site/3ca6753fc47d...

Since it's still Cybersecurity Awareness Month, I think more people should be aware that the French call hackers 'pirates' (or 'pirates informatiques' to be more specific) and hacking 'piratage.' And I think it's beautiful!

I'm presenting at @cyberwarcon.bsky.social this year, November 19! Come for big names, stay for my obscure stories about cyber aspects of drone warfare. cyberwarcon.com/agenda-25

Putin recently said that Russia requested twice to join NATO (in 1954 & 2000). Actually that happened multiple times including when Russia was not in the best shape See here on Yeltsin's appeal in late 1991, days before the collapse of the Soviet Union www.washingtonpost.com/archive/poli...

Nothing makes you more aware of cyber security than the shortage of Asahi beer Happy Cybersecurity Awareness Month!

Over past couple of days Russian media claimed that Russian drone strike hit a scam call center in Dnipro. Here are my review of the coverage and quick analysis of whether Russia now considers scammers a legitimate military target (probably not) fromcyberia.substack.com/p/did-russia...

How is this real...

Kudos to Microsoft & Cloudflare for taking action against RaccoonO365 Here's the link to relevant legal files with a bunch of seized domains & other interesting details (via Health ISAC) noticeofpleadings.com/RaccoonO365/

APT or Another Phishing Training? Seqrite reported an attack on the Kazakhstani oil company KazMunayGas attributed to a new group NoisyBear www.seqrite.com/blog/operati... Yet the company later argued that this was a simulated attack orda.kz/planovoe-mer... This looks plausible: 1/2

defense.gov now redirects to war.gov, but the page won't load at the moment