@doublepulsar.com www.technologyreview.com/2025/11/10/1...

Some of @ridt.bsky.social's tweets are preserved as historical heritage in edited volume citations

new by me - a look at MIT’s cyberslop IOCs and TTPs included doublepulsar.com/cyberslop-me...

The most informed take from Russia so far on drone warfare (and by extension digital warfare) from former Chief of General Staff Yury Baluevskiy & Ruslan Pukhov of CAST TL;DR: drones are indeed revolutionizing & militaries will need to adapt globalaffairs.ru/articles/czi...

Russian authorities arrested 3 men in Astrakhan for creating 'the infamous Medusa virus' (probably Medusa stealer), acc. to the Ministry of Interior. In May they allegedly targeted an org in that region They are also linked to another unnamed malware t.me/IrinaVolk_MV...

NEW: The CEO of Memento Labs admits the spyware found by security researchers targeting Windows victims in Russia was his company's. He said that one of his customers used an outdated version of the spyware that's going to be decommissioned at the end of this year. techcrunch.com/2025/10/28/c...

New draft resolution (by Austria, El Salvador, Kazakhstan, Kiribati, Malta, & Mexico) urges NWS to publish policies "explicitly affirming and operationalizing that [C3] systems of nuclear weapons that integrate [AI] will remain subject to human control" digitallibrary.un.org/record/4091455

Speaking of Grokipedia, Russian authorities have long complained about Wikipedia's biases & promoted several sovereign alternatives incl. Ruwiki (ruwiki.ru) which was forked from Wikipedia & then 'properly' edited. It also uses AI by the way

Earlier research on the same threat actor that used Dante reported today by Kaspersky Dr. Web first found malware w/ the DANTEMARK label st.drweb.com/static/new-w... F6 called it Dante APT www.f6.ru/cybercrime-t... PT linked ForumTroll w/ a few other clusters global.ptsecurity.com/en/research/...

Kaspersky discovered Dante, spyware from Memento Labs (ex-HackingTeam), used by an APT (dubbed ForumTroll) in attacks targeting Russia & Belarus since 2022 securelist.com/forumtroll-a...

Taking metro in DC makes you think about mission-critical, AI-driven, battlefield-proven solutions to everyday problems

The UN Convention against Cybercrime was signed by 63 states & the EU. These include Russia, China, United Kingdom, 12 EU member states, Brazil, Australia, many from Africa, Latin America, South & Southeast Asia. No signatures from the United States, France, Germany, India

As I noted before (bsky.app/profile/shak...), MSS's emphasis on potentially destructive consequences of the attack on the National Time Service Center was likely a response to U.S. accusations regarding Volt Typhoon Now the Chinese MFA says this explicitly www.fmprc.gov.cn/mfa_eng/xw/f...

Singapore submitted draft resolution to the First Committee on establishing a successor to OEWG, Global Mechanism on developments in the field of ICTs in the context of international security and advancing responsible State behaviour in the use of ICTs digitallibrary.un.org/record/40909...

Some thoughts on Chinese accusations against the NSA There're two sources: — the MSS statement (a shorter, more political one) mp.weixin.qq.com/s/ZtKjlaIoMV... — the CNCERT/CC report (technical analysis) mp.weixin.qq.com/s/XPjT0BVOJP... These reports present the breach a bit differently 1/11

I've updated my list of TI reports on threat actors targeting Russia. It now features around 190 reports on 55 groups. Most actors are not reliably linked to a specific state, but among those that are the two top origins are China and Ukraine cyberguerre.notion.site/3ca6753fc47d...

Since it's still Cybersecurity Awareness Month, I think more people should be aware that the French call hackers 'pirates' (or 'pirates informatiques' to be more specific) and hacking 'piratage.' And I think it's beautiful!

I'm presenting at @cyberwarcon.bsky.social this year, November 19! Come for big names, stay for my obscure stories about cyber aspects of drone warfare. cyberwarcon.com/agenda-25

Putin recently said that Russia requested twice to join NATO (in 1954 & 2000). Actually that happened multiple times including when Russia was not in the best shape See here on Yeltsin's appeal in late 1991, days before the collapse of the Soviet Union www.washingtonpost.com/archive/poli...

Nothing makes you more aware of cyber security than the shortage of Asahi beer Happy Cybersecurity Awareness Month!

Over past couple of days Russian media claimed that Russian drone strike hit a scam call center in Dnipro. Here are my review of the coverage and quick analysis of whether Russia now considers scammers a legitimate military target (probably not) fromcyberia.substack.com/p/did-russia...

How is this real...

Kudos to Microsoft & Cloudflare for taking action against RaccoonO365 Here's the link to relevant legal files with a bunch of seized domains & other interesting details (via Health ISAC) noticeofpleadings.com/RaccoonO365/

APT or Another Phishing Training? Seqrite reported an attack on the Kazakhstani oil company KazMunayGas attributed to a new group NoisyBear www.seqrite.com/blog/operati... Yet the company later argued that this was a simulated attack orda.kz/planovoe-mer... This looks plausible: 1/2

defense.gov now redirects to war.gov, but the page won't load at the moment

Y'all are missing out on the BRICS+ Fashion Summit

Since May Russia regularly shuts down mobile Internet to counter the drone threat Shutdowns disrupt taxis, food delivery, ATMs, remote work & upset ppl Now the gov't wants to create white list of services that would be available even during shutdowns www.interfax.ru/russia/1040184

My take (in Russian) on this week's cyber attack against Aeroflot. The key idea is pretty simple: to solve the problem of cyber war, information security measures alone are not enough; it needs to be adressed politically, too, through conflict resolution www.forbes.ru/mneniya/5430...

Trump says he "ordered two Nuclear Submarines to be positioned in the appropriate regions" in response to ex-President Medvedev's provocative statements (probably his recent tweet) This reminded me of the 2020 report by Alexi Drew & @heatherwilly.bsky.social www.kcl.ac.uk/csss/assets/...

A major cyber incident in Russia: two groups, Cyber Partisans & Silent Crow, took credit for a cyber attack on Aeroflot, claiming they destroyed its internal IT systems. Aeroflot didn't acknowledge the attack but canceled nearly 100 flights & delayed some more due to an 'outage'

A cyber attack disrupted the operation of a Russian network of volunteer-run service centers that jailbreak commercial DJI drones making them fit for warfighting. Although no one took credit for this hack it looks like a highly targeted sabotage operation fromcyberia.substack.com/p/hackers-di...

Can a cyber operation have an impact on drone warfare? Probably yes, but in a not-so-obvious way. In a new post, I review a reported disruption of a network of service centers that weaponize commercial DJI drones with a customized firmware. open.substack.com/pub/fromcybe...

QiAnXin reports on a new APT, NightEagle, active since 2023 & targeting Chinese tech & gov't orgs. QAX claims that the attackers exploited an unknown Exchange vuln "Considering the target and interests of the attack, we think the group is from a country in North America" github.com/RedDrip7/Nig...

Professionals in most countries borrowed the term APT from the U.S. But France uses the acronym MOA instead, which stands for 'mode opératoire d'attaque.' This term emphasizes the unique set of TTPs of the attacker rather than its skills or persistence cyber.gouv.fr/le-cyberdico

NoName057(16) is selective with its "love" intel471.com/blog/nato-su... PS: They targeted the Netherlands again yesterday, mainly because of the NATO summit www.telegraaf.nl/binnenland/p...

Update on the REvil case: Bessonov, Golovachuk, Muromskiy, Korotayev plead guilty & were sentenced to time served (Not for ransomware attacks but for carding) The court also decided to confiscate 2 Benzes & $1.2 mil from Bessonov, a BMW from Korotayev tass.ru/proisshestvi...

Reupping my piece on Cyber Espionage Among Friends following @meghara.bsky.social NYT story on Chinese cyber operations targeting Russia I dig into Russian reports about Chinese APTs & vice versa & provide context on why there's no political backlash fromcyberia.substack.com/p/cyber-espi...

Cyber threat intelligence has evolved primarily as a private domain driven by cyber security vendors and researchers. Is this about to change? My reflections on several recent publications about whether threat intelligence is becoming 'nationalized' fromcyberia.substack.com/p/nationaliz...

Today is the 15th anniversary of the discovery of Stuxnet by Belarusian firm VirusBlokAda It was only 2 weeks later that they disclosed it publicly, specifically the LNK zero-day vulnerability (CVE-2010-2568) EN web.archive.org/web/20100717... RU web.archive.org/web/20100717...

When Russia declares an author a 'foreign agent' their books can still be sold but their status must be indicated on the cover (books by Alexander Arkhangelsky on Russian poetry & by Nikolay Epple on nations dealing with their difficult past)

In the past few months Russia has been routinely switching off mobile Internet for entire regions to counter drone strikes Now Ukraine considers doing the same thing — a working group has been set up in Rada reportedly at the initiative of the military nv.ua/ukraine/poli...

State Duma has just passed a bill on the national messaging app (smth like a Russian version of WeChat) www.interfax.ru/russia/1030583 Acc. to this bill the gov't is supposed to pick a company to develop this app. But the decision has already been made to use Max, a new app from VK

China's public attribution is evolving. A report by CVERC & 360 on Taiwanese APTs is quite unique. For the 1st time it combines in a single document: — technical analysis — political accusation against Taiwan, DPP, U.S. — arrest warrant — military threat www.cverc.org.cn/head/zhaiyao...

Old infosec books often describe "logic bombs," but we rarely see those mentioned in contemporary reports. Kaspersky discovered that Belarusian Cyber Partisans' wiper was programmed to activate on specific dates & was likely used against Grodno Azot ics-cert.kaspersky.com/publications...

Russia has just declared undesirable the Association for Slavic, East European, and Eurasian Studies (ASEEES) Simply put it's now illegal for Russian scholars to participate in ASEEES's activities such as conferences or publications

Russian defense scholars have been worried for years that high-precision weapons including UAVs could be used (by the U.S.) to target strategic nuclear forces. E.g. this paragraph in a 2021 article by researchers of the academies of General Staff & RVSN elibrary.ru/item.asp?id=...

Ilya Gorbunov, former head of Prigozhin's Patriot media holding (aka 'troll farm'), sentenced to 10 years on extortion and drug trafficking charges www.rbc.ru/politics/30/...

It's quite unusual for any country to mention UN cyber norms outside of a UN meeting. Yesterday not one but two governments did so, the Czech Republic in its accusation & China in its rebuttal. Not that it made any difference CZ mzv.gov.cz/jnp/en/issue... CN cz.china-embassy.gov.cn/cze/xwdt/202...

NEW: More than a decade ago, Kaspersky discovered a mysterious "elite" hacking group it called Careto (aka “The Mask”), which then vanished and only resurfaced last year. We can now reveal that the researchers who investigated it were confident that the Spanish government was behind it.