Most interesting to me is that the cooperation between Gamaredon and Turlais distinct from the Gamaredon cooperation with Invisimole. They are really solidifying themselves as an initial access team within the FSB. www.welivesecurity.com/en/eset-rese...

APT or Another Phishing Training? Seqrite reported an attack on the Kazakhstani oil company KazMunayGas attributed to a new group NoisyBear www.seqrite.com/blog/operati... Yet the company later argued that this was a simulated attack orda.kz/planovoe-mer... This looks plausible: 1/2

Russia is considering forbidding dissemination of information on how cyber attacks are conducted. Could be a big problem for CTI practitioners or incident responders sharing TTPs, because those include that kind of information. www.kommersant.ru/doc/7991253

Most notable thing in this (apart from new publicly available info on Energetic Bear), is the assertion that Static Tundra is a subgroup of Energetic Bear. Been happening a lot with GRU groups, now FSB 16th Centre. blog.talosintelligence.com/static-tundra/

And there goes the rest of my day.

Not a fan, just tastes like a hop bomb.

First Japanese wheat beer.

SORM in action. Next, someone will tell me the guys cop boxes outside of embassy gates in Moscow who just want to take a look at your passport aren't taking note. Even when you're just going to the basement bar for cheap Moosehead on a Friday evening. www.microsoft.com/en-us/securi...

A major cyber incident in Russia: two groups, Cyber Partisans & Silent Crow, took credit for a cyber attack on Aeroflot, claiming they destroyed its internal IT systems. Aeroflot didn't acknowledge the attack but canceled nearly 100 flights & delayed some more due to an 'outage'

What is interesting is that it looks like more disruption to flights was caused in this attack than by the multiple airlines breached by Scattered Spider.

while you’re at it, just go ahead and burn this collection on SVR cyber operations. who cares. not like it helps SVR’s CI analyses. fuck do I know. (Pg 16)

Regionality has become a recurring theme in reporting on Russian cyber.

Decoding Secrets Through Symbols: How Military Insignia Revealed Russia’s Hidden SIGINT Network by @checkfirst.network ↘️ checkfirst.network/decoding-sec...

some other highlights: - this cluster tried to re-establish relationships after we disabled their accounts by creating new, similarly named accounts. very persistent! - if you thought their device linking phase was over, think again! susp apt29 groups looove this & want to make it seem more legit

If there were any American or French lords of war currently imprisoned in Russia, it would make for sweet poetry to get them in a prisoner swap for Russian basketball player Daniil Kasatkin, who was just jailed in Paris on charges of aiding a ransomware conspiracy. meduza.io/en/news/2025...

Probably the best thing from Innis and Gunn I have had.

Reupping my piece on Cyber Espionage Among Friends following @meghara.bsky.social NYT story on Chinese cyber operations targeting Russia I dig into Russian reports about Chinese APTs & vice versa & provide context on why there's no political backlash fromcyberia.substack.com/p/cyber-espi...

🚨NEW REPORT: exposing clever new hacking tactic. 🇷🇺Russian state-backed hackers used an App-Specific Password attack against prominent Russia expert @keirgiles.bsky.social It's like they knew what we all expect from 🇷🇺...and then did the opposite 1/ By us @citizenlab.ca & Google's GTIG

Keir Giles has been targeted *again* by allegedly Russian hackers — this time using a clever new trick intended to bypass 2-factor authentication. Over the years I’ve written about Giles an unusual amount, and I have an idea about why. First, the coverage: www.reuters.com/technology/s...

The SVR doing something novel with app specific passwords, and having the patience to go back and forth enough times to pull it off through an email conversation.

Abkhazian wine tonight.

To avoid “turning even the smallest incidents into scandals and points of conflict,” NATO is now limiting public disclosures of its activities and aid to Ukraine. Sharing less information is supposed to counter Russian disinformation. www.themoscowtimes.com/2025/06/17/t...

Thousands of Telegram IP addresses, and maintenance of its servers, are controlled by a Russian network engineer -- whose other companies have collaborated with the FSB, Russian defense companies, and other Russian govt agencies. occrp.org/en/investiga... via @occrp.org

Russian disinfo group Matryoshka has stopped posting on BlueSky and moved to TikTok I believe TikTok's huge success in Romania and its lack of any meaningful moderation has convinced the group it's a more fertile and efficient way of swaying the public opinion x.com/antibot4nava...

A solid APA, just not my favourite style.

Number 3 is best of the bunch so far.

Number 2 from the haul. So far they're ok. Nothing outstanding, but a very welcome change from what the resort has.

Starting to work through the local brewery's offerings.

It's a great article, though I do not necessarily agree with the role.of the IT Army. While by no means discounting their efforts, they are to me, comparable to NoName057(16), KillNet, etc - a minor annoyance with limited lasting impact.

Finally some time off.

New Darwin Awards 2025 nominee: A Russian space academy cadet created a tool to access classified data on the Russian MOD network and was selling it for only $100 on Russia's biggest classified ads portal He was arrested by the FSB last week t.me/voenpravoru/...

I wrote some details on LOSTKEYS: malware which we directly attribute to COLDRIVER. They don't deploy it often, but we have seen it a few times and want to make people aware of it. cloud.google.com/blog/topics/...

Georgian is never in the same place in the LCBOs. Gotten it in German, French, New Arrivals and Vintage section. It's like they want you to skip over it and get the more familiar wines.

Back in Ottawa today for the first time in years.

Just in time with #Canada's upcoming election, a new #ZOiS_Report on an underresearched group is out: Its (Soviet) Russian community. The Kremlin views it as a resource that could be leveraged. But what does the research by Félix Krawatzek & Hakob Matevosyan for #MoveMeRu say? Key findings & link🧵⤵️

This reads similarly to the Kamacite activity that was reported targeting Dutch LNG terminals in 2022, focusing on pre-positioning. therecord.media/dutch-mivd-r...

Missed these immensely since my days in Estonia.

Tonight's wine. Would of bought for the label alone if it wasn't Georgian.

Very glad to see Gamaredon Group get some more coverage, especially in a non-technical manner that highlights the annoying nature of their campaigns and the persistence they display. But once again, Gamaredon is in the news, and no Invisimole mentions. www.wired.com/story/gamare...

This perfectly describes even the English degrees (in early 2010s) despite being almost entirely separated from the rest of the school. Most of my classmates knew what was going on, when we got Выпускник МГИМО mugs on orientation day. Some classmates fully bought in, staying in Russia.

I've updated my list of APT groups targeting Russia. It's based on private sector reports on cyber attacks that target Russian organizations. The collection now features around 130 reports covering activities of 49 APTs cyberguerre.notion.site/3ca6753fc47d...

We’re happy to join Bluesky! As the Finnish Centre specializing on Russian, Eurasian, and Eastern European studies at the University of Helsinki @helsinki.fi, we’ll be sharing our latest research. Stay tuned also for study opportunities and upcoming events, like the annual Aleksanteri Conference!

Russia's intelligence services have spent time and resources to develop Signal-specific tradecraft because it is best-in-class for secure communications. It is Signal's lack of vulnerability that makes the app the high priority target that it is.

Trellix anlaysis of the leaked BlackBasta chats suggests the gang's leader might have received "state protection" and was helped escape arrest in Armenia via a "green corridor" 👀 www.trellix.com/blogs/resear...

Interesting findings from this 👇 new Bank of Finland paper: Western sanctions "have had no serious influence on Russia's ability to produce military goods in quantity" -- though "they may have had an impact on the types and modernity of what has been produced." publications.bof.fi/bitstream/ha...

Big day for Chinese threat intel MSS outs 4 alleged members of Taiwan's Information, Communications & Electronic Force Command, links them to cyber attacks QiAnXin & Antiy release 2 separate reports on Taiwan-linked APT-Q-20/APT-C-01/GreenSpot/PoisonVine 🧵w/ links & details

It took a trade war to do, but I will be very happy to try some new beers from around Canada. Hopefully LCBO placement issues don't impact their availability... www.cbc.ca/news/politic...

Really reminded of Kamacite by this report. But what is more interesting to me is the increased reporting of initial access teams across GRU, FSB and SVR, a lot of which was suggested before the war. msft.it/6046UWWdQ

I'm just going to leave this here: "At the end of the day, Canada is many things. But above all else, we’re a bunch of grudge holding motherfuckers." www.thebeaverton.com/2025/02/edit...