It's unusual for former FSB employees to be arrested outside of Russia (and extradited) these days. But what's also unusual about Denis Obrezko -- charged with the "Laundry Bear" hack of computers in the U.S. and Europe-- is how careless he appeared to have been online. www.rferl.org/a/russia-hac...

The French govt on the FSB 16th Centre and Turla. Regionality is a big thing with an SPB-based unit being linked to French targeting, so a similar approach to the GRU. The expansion of monolithic Russian groups continues. www.cert.ssi.gouv.fr/uploads/CERT...

Hackers leaked what they say are Ksenia Sobchak's private DMs. They ostensibly show the journalist & media mogul clearing an apology with a Putin ally, excusing an interview that angered the Kremlin, & demanding reports on how her channels covered a drone attack on Moscow. meduza.io/en/feature/2...

The state-criminal relationships in RU are murky waters. And despite the JLR case having the potential to make the 9D chess takes about Colonial Pipeline look like child’s play, this article does an incredible job of unearthing major new details while still not overextending itself

Russia's Foreign Intel Service accuses the EU of pressuring Armenia to sever ties with the Russian Orthodox Church as a condition of EU integration. Moscow claims the Europeans are fabricating kompromat against local ROC clergy to prompt "large-scale persecution." rtvi.com/news/vneshny...

The FSB said the cyber operation was orchestrated by Western intelligence agencies and major tech companies to secretly hack and spy on the smartphones of high-ranking Russian officials.

Mostly just surprised Canada was even named.

First of all, the winery is great. But the best part is buried at the end of the article - they are importing saperavi grapes. www.niagarathisweek.com/business/nia...

A secret department at the military training center of Bauman Moscow State Technical University is training hackers and saboteurs for the GRU, according to a new investigation. meduza.io/en/feature/2...

Heading to Buffalo on June 6th to talk trends in Russian cyber.

Very familiar taste, as close as you can get to a liquified version of the paczki I grew up eating.

Two weeks to go until FS ISAC FinCyber in Toronto, where I'll be presenting on trends in Russian cyber after 4 years of war. Excited to talk about things like GRU regionality, the Presidential Administration, initial access and operational tempo.

Years ago, we've published an investigation into one core member of REvil, together with @maxzierer.bsky.social and @kaibiermann.bsky.social Now, german authorities put out a Wanted poster for Mr. Shchukin www.bka.de/DE/IhreSiche... Here's our reporting from back then www.zeit.de/digital/inte...

Grand Cayman airport Wendy's is not where I expected to find Georgian.

Future of assault troops seen by some Russian military scholars

Can't disagree with this more. The surge of cyber attacks in Ukraine & Russia during the war was definitely driven by political & war-related motivations. This is clear from commercial security research & my own close observations over the years www.ft.com/content/4e88... 1/2

Caymans for the week.

Wouldn't it be crazy if tools like Yandex Translate existed?

Maybe it is too optimistic, but we can pretend Kazakhstan is at least in part using cyber to advance it's restoration efforts for the Aral Sea. timesca.com/kazakhstan-u...

Putin removed General Pavel Konovalchik from the Security Council, another victim in the purge of Shoigu cronies. Konovalchik may have overseen Russia’s information troops, including the threat group known as Fancy Bear. istories.media/news/2026/03...

Tonight's beer.

1/ Anti Lukashenko-regime hackers Belarusian Cyber Partisans melden: ‘CYBERATTACK ON Khimvolokno 💥 We're striking the computer network of Belarusian Khimvolokno, Russia's largest supplier of nylon threads used to make helmet linings and body armor for the Russian army’.

Weird cyber story from Russia: a Moscow resident Ruslan Satuchin faces criminal charges for allegedly contacting Conti under the pretense of the FSB & extorting money for protection. Now he's investigated for fraud No word of legal action against Conti www.rbc.ru/society/25/0...

Wanted: foreign mercenaries, oops, military recruits seeking a path to citizenship...

The Wagner network recruits economically vulnerable Europeans for acts of violence and sabotage on NATO soil. GRU and FSB run the operations; Wagner supplies the channels and recruiters who "speak the language" of the marginalised. Many attacks have been thwarted. www.ft.com/content/dbd1...

Today, INPACT reveals the takeover of the Wagner Group's influence arm – Africa Politology – by the SVR, Russia's foreign intelligence service.

“Pancake,” “Lenin,” and an FSB hacker: Meet the fresh faces at Putin’s new directorate “for strategic partnership and cooperation” Despite a nominal rebranding, the Kremlin’s efforts to peddle Russian soft power abroad look set to remain unchanged.

In case you're interested in #Doppelgänger and are following disinfo, here's a piece about a hacktivist who managed to siphon out hundreds of gigabytes of internal data (zipped!) Article at Der Spiegel, Gift Link www.spiegel.de/politik/hack...

Kommersant cites BI.ZONE CTI that 37% of cyber attacks on Russian organizations in 2025 were conducted for espionage, up from 21% in 2024. 45% of the threat groups attacking Russia and CIS are espionage groups. Kommersant.ru/doc/8420782

Someone putting pen to paper GRU regionality, something I've been researching for the past few years. Based on imagery they include, we use similar methodologies to break down the VIO by regions and links to monoliths, and reach similar conclusions.

Researchers said they observed a hacking group attempting to lure senior Russian military officers to download malware using a variety of phishing emails therecord.media/cyber-spies-...

First day of vacation beer at the Canadian Warplane Heritage Museum.

Germany seems more willing to call out Russia - today the government is accusing Russia of a large scale cyber attack on air traffic security and for disinformation campaign during the federal elections earlier this year:

Blockbuster reporting by Maria Kolomychenko on the Aeroflot hack with new details on messy infosec, the impact of & recovery from what was the biggest cyber attack on Russia during the war thebell.io/istoriya-bol...

Another day another Belarusian picked up by the Poles for spying and “sabotage”

The UK has updated their GRU cyber profiles today. I love the breakdown of Fancy Bear into at least 3 distinct teams. It helps the research I've been doing into subgroups and regionalization within the GRU, trying to break down monoliths into a military district based understanding of GRU cyber ops.

It strikes me that people make fun of American politicians or influencers who post AI nonsense. But when Russia, China or Iran does the same thing, people act like they're sophisticated threat actors capable of shaping global opinion at will.

Always fun to see the reason one of your instructors got the job at MGIMO.

Off bright and early to DC for Cyberwarcon.

Oh ok so it wasn’t a GRU operator (necessarily) — it was a guy working as part of the recently identified threat group that pissed off Dutch intelligence

The indefatigable Steven Fisher, formerly of Citibank Russia and Citibank Ukraine, has assembled this collection of remembrances from former expats in Russia. There is so much here, so many memories of a Russia vanished. I reminisced about riding the rails ( scottgehlbach.net/posts/4055-r...).

FT report: Russia’s Rubikon unit is upending Ukraine’s drone advantage — locating & killing operators deep behind the lines, training other Russian teams, & seizing control of Ukraine's decisive "electromagnetic spectrum." Ukrainian pilots now face relentless pressure, must adapt tactics to survive.

It is apparently very hard to use Yandex to search "what countries extradite to the US?" theins.ru/news/286794

Tonight's bottle of Georgian.

Don’t let anyone tell you that the Russians never arrest cybercriminals. Criminals who cause harm to Russians are regularly arrested, and as this instance shows, often dealt with harshly. See my timeline for a modest sampling of other arrests of hackers, fraudsters, and other Russian cybercriminals.

I think super important to track what they're saying about what they fear, what they think war looks like, & what they think adversaries will do, as well as what they themselves hope to do & what they actually do. Also crucial to track the disconnects between these & whether & when they narrow. 7/7

Most interesting to me is that the cooperation between Gamaredon and Turlais distinct from the Gamaredon cooperation with Invisimole. They are really solidifying themselves as an initial access team within the FSB. www.welivesecurity.com/en/eset-rese...

APT or Another Phishing Training? Seqrite reported an attack on the Kazakhstani oil company KazMunayGas attributed to a new group NoisyBear www.seqrite.com/blog/operati... Yet the company later argued that this was a simulated attack orda.kz/planovoe-mer... This looks plausible: 1/2