Apparently Russia is about to engage in a new extradition battle with the United States, this time over Denis Obrezko, an alleged hacker arrested in Nov in Thailand in a joint op w/ the FBI. He's now wanted in Russia under a criminal case that dates back to 2018 1/5

Venezuela confirms that the U.S. operation involved an attack on the National Electric System hitting 2 substations & causing power outages mppee.gob.ve?p=103279 But it wasn't 'cyber' A video posted by the Electric Energy Ministry shows physical damage t.me/minenergia_v...

Russia declares George Washington University an undesirable organization, making it illegal to participate in its activities. Previously Russia banned Yale in a similar way as well as few other U.S. and European higher ed organizations www.rbc.ru/politics/29/...

Blockbuster reporting by Maria Kolomychenko on the Aeroflot hack with new details on messy infosec, the impact of & recovery from what was the biggest cyber attack on Russia during the war thebell.io/istoriya-bol...

Russian Major General Alexey Kostenko (who teaches at the Military Academy of the General Staff) calls for better interagency cooperation in the field of military security

New report from Positive Technologies vivisects recent (2024-2025) APT31 attacks targeting Russian IT firms specifically government contractors and integrators ptsecurity.com/research/pt-...

Thanks to @cyberwarcon.bsky.social for an impressive event. Really enjoyed the talks & the chance to meet people much more obsessed with 'cyber' than I am I got 0 photos except for some slides. But as I was getting off metro I saw this. Quite symbolic in light of my talk on drones & hacking

@doublepulsar.com www.technologyreview.com/2025/11/10/1...

Some of @ridt.bsky.social's tweets are preserved as historical heritage in edited volume citations

new by me - a look at MIT’s cyberslop IOCs and TTPs included doublepulsar.com/cyberslop-me...

The most informed take from Russia so far on drone warfare (and by extension digital warfare) from former Chief of General Staff Yury Baluevskiy & Ruslan Pukhov of CAST TL;DR: drones are indeed revolutionizing & militaries will need to adapt globalaffairs.ru/articles/czi...

Russian authorities arrested 3 men in Astrakhan for creating 'the infamous Medusa virus' (probably Medusa stealer), acc. to the Ministry of Interior. In May they allegedly targeted an org in that region They are also linked to another unnamed malware t.me/IrinaVolk_MV...

NEW: The CEO of Memento Labs admits the spyware found by security researchers targeting Windows victims in Russia was his company's. He said that one of his customers used an outdated version of the spyware that's going to be decommissioned at the end of this year. techcrunch.com/2025/10/28/c...

New draft resolution (by Austria, El Salvador, Kazakhstan, Kiribati, Malta, & Mexico) urges NWS to publish policies "explicitly affirming and operationalizing that [C3] systems of nuclear weapons that integrate [AI] will remain subject to human control" digitallibrary.un.org/record/4091455

Speaking of Grokipedia, Russian authorities have long complained about Wikipedia's biases & promoted several sovereign alternatives incl. Ruwiki (ruwiki.ru) which was forked from Wikipedia & then 'properly' edited. It also uses AI by the way

Earlier research on the same threat actor that used Dante reported today by Kaspersky Dr. Web first found malware w/ the DANTEMARK label st.drweb.com/static/new-w... F6 called it Dante APT www.f6.ru/cybercrime-t... PT linked ForumTroll w/ a few other clusters global.ptsecurity.com/en/research/...

Kaspersky discovered Dante, spyware from Memento Labs (ex-HackingTeam), used by an APT (dubbed ForumTroll) in attacks targeting Russia & Belarus since 2022 securelist.com/forumtroll-a...

Taking metro in DC makes you think about mission-critical, AI-driven, battlefield-proven solutions to everyday problems

The UN Convention against Cybercrime was signed by 63 states & the EU. These include Russia, China, United Kingdom, 12 EU member states, Brazil, Australia, many from Africa, Latin America, South & Southeast Asia. No signatures from the United States, France, Germany, India

As I noted before (bsky.app/profile/shak...), MSS's emphasis on potentially destructive consequences of the attack on the National Time Service Center was likely a response to U.S. accusations regarding Volt Typhoon Now the Chinese MFA says this explicitly www.fmprc.gov.cn/mfa_eng/xw/f...

Singapore submitted draft resolution to the First Committee on establishing a successor to OEWG, Global Mechanism on developments in the field of ICTs in the context of international security and advancing responsible State behaviour in the use of ICTs digitallibrary.un.org/record/40909...

Some thoughts on Chinese accusations against the NSA There're two sources: — the MSS statement (a shorter, more political one) mp.weixin.qq.com/s/ZtKjlaIoMV... — the CNCERT/CC report (technical analysis) mp.weixin.qq.com/s/XPjT0BVOJP... These reports present the breach a bit differently 1/11

I've updated my list of TI reports on threat actors targeting Russia. It now features around 190 reports on 55 groups. Most actors are not reliably linked to a specific state, but among those that are the two top origins are China and Ukraine cyberguerre.notion.site/3ca6753fc47d...

Since it's still Cybersecurity Awareness Month, I think more people should be aware that the French call hackers 'pirates' (or 'pirates informatiques' to be more specific) and hacking 'piratage.' And I think it's beautiful!

I'm presenting at @cyberwarcon.bsky.social this year, November 19! Come for big names, stay for my obscure stories about cyber aspects of drone warfare. cyberwarcon.com/agenda-25

Putin recently said that Russia requested twice to join NATO (in 1954 & 2000). Actually that happened multiple times including when Russia was not in the best shape See here on Yeltsin's appeal in late 1991, days before the collapse of the Soviet Union www.washingtonpost.com/archive/poli...

Nothing makes you more aware of cyber security than the shortage of Asahi beer Happy Cybersecurity Awareness Month!

Over past couple of days Russian media claimed that Russian drone strike hit a scam call center in Dnipro. Here are my review of the coverage and quick analysis of whether Russia now considers scammers a legitimate military target (probably not) fromcyberia.substack.com/p/did-russia...

How is this real...

Kudos to Microsoft & Cloudflare for taking action against RaccoonO365 Here's the link to relevant legal files with a bunch of seized domains & other interesting details (via Health ISAC) noticeofpleadings.com/RaccoonO365/

APT or Another Phishing Training? Seqrite reported an attack on the Kazakhstani oil company KazMunayGas attributed to a new group NoisyBear www.seqrite.com/blog/operati... Yet the company later argued that this was a simulated attack orda.kz/planovoe-mer... This looks plausible: 1/2

defense.gov now redirects to war.gov, but the page won't load at the moment

Y'all are missing out on the BRICS+ Fashion Summit

Since May Russia regularly shuts down mobile Internet to counter the drone threat Shutdowns disrupt taxis, food delivery, ATMs, remote work & upset ppl Now the gov't wants to create white list of services that would be available even during shutdowns www.interfax.ru/russia/1040184

My take (in Russian) on this week's cyber attack against Aeroflot. The key idea is pretty simple: to solve the problem of cyber war, information security measures alone are not enough; it needs to be adressed politically, too, through conflict resolution www.forbes.ru/mneniya/5430...

Trump says he "ordered two Nuclear Submarines to be positioned in the appropriate regions" in response to ex-President Medvedev's provocative statements (probably his recent tweet) This reminded me of the 2020 report by Alexi Drew & @heatherwilly.bsky.social www.kcl.ac.uk/csss/assets/...

A major cyber incident in Russia: two groups, Cyber Partisans & Silent Crow, took credit for a cyber attack on Aeroflot, claiming they destroyed its internal IT systems. Aeroflot didn't acknowledge the attack but canceled nearly 100 flights & delayed some more due to an 'outage'

A cyber attack disrupted the operation of a Russian network of volunteer-run service centers that jailbreak commercial DJI drones making them fit for warfighting. Although no one took credit for this hack it looks like a highly targeted sabotage operation fromcyberia.substack.com/p/hackers-di...

Can a cyber operation have an impact on drone warfare? Probably yes, but in a not-so-obvious way. In a new post, I review a reported disruption of a network of service centers that weaponize commercial DJI drones with a customized firmware. open.substack.com/pub/fromcybe...

QiAnXin reports on a new APT, NightEagle, active since 2023 & targeting Chinese tech & gov't orgs. QAX claims that the attackers exploited an unknown Exchange vuln "Considering the target and interests of the attack, we think the group is from a country in North America" github.com/RedDrip7/Nig...

Professionals in most countries borrowed the term APT from the U.S. But France uses the acronym MOA instead, which stands for 'mode opératoire d'attaque.' This term emphasizes the unique set of TTPs of the attacker rather than its skills or persistence cyber.gouv.fr/le-cyberdico

NoName057(16) is selective with its "love" intel471.com/blog/nato-su... PS: They targeted the Netherlands again yesterday, mainly because of the NATO summit www.telegraaf.nl/binnenland/p...

Update on the REvil case: Bessonov, Golovachuk, Muromskiy, Korotayev plead guilty & were sentenced to time served (Not for ransomware attacks but for carding) The court also decided to confiscate 2 Benzes & $1.2 mil from Bessonov, a BMW from Korotayev tass.ru/proisshestvi...

Reupping my piece on Cyber Espionage Among Friends following @meghara.bsky.social NYT story on Chinese cyber operations targeting Russia I dig into Russian reports about Chinese APTs & vice versa & provide context on why there's no political backlash fromcyberia.substack.com/p/cyber-espi...

Cyber threat intelligence has evolved primarily as a private domain driven by cyber security vendors and researchers. Is this about to change? My reflections on several recent publications about whether threat intelligence is becoming 'nationalized' fromcyberia.substack.com/p/nationaliz...

Today is the 15th anniversary of the discovery of Stuxnet by Belarusian firm VirusBlokAda It was only 2 weeks later that they disclosed it publicly, specifically the LNK zero-day vulnerability (CVE-2010-2568) EN web.archive.org/web/20100717... RU web.archive.org/web/20100717...

When Russia declares an author a 'foreign agent' their books can still be sold but their status must be indicated on the cover (books by Alexander Arkhangelsky on Russian poetry & by Nikolay Epple on nations dealing with their difficult past)

In the past few months Russia has been routinely switching off mobile Internet for entire regions to counter drone strikes Now Ukraine considers doing the same thing — a working group has been set up in Rada reportedly at the initiative of the military nv.ua/ukraine/poli...

State Duma has just passed a bill on the national messaging app (smth like a Russian version of WeChat) www.interfax.ru/russia/1030583 Acc. to this bill the gov't is supposed to pick a company to develop this app. But the decision has already been made to use Max, a new app from VK