Do Son Symantec exposed China's Jewelbug APT in an unprecedented 5-month intrusion on a Russian IT provider. The group used Yandex Cloud for data exfiltration and Graph API for stealthy C2 via custom malware.
russia
The Cavalry Werewolf APT is using FoalShell reverse shells and StallionRAT backdoors, controlled via Telegram, to target Russian state agencies and energy/mining firms.
Russia-linked APT COLDRIVER is using a new multi-stage malware campaign (BAITSWITCH/SIMPLEFIX) with a ClickFix lure to target journalists and activists for espionage.
Researchers have uncovered a Russian-linked disinformation campaign targeting Moldova’s upcoming elections, attempting to undermine its pro-EU trajectory.
A new APT28 campaign targets Ukraine's military with a blend of steganography, open-source tools, and legitimate cloud services for covert C2.
A new report reveals Noisy Bear, an APT group targeting Kazakhstan’s oil and gas sector with spear-phishing and multi-stage malware, mimicking internal communications.
A new CNA report reveals how private Russian cybersecurity firms, including Kaspersky and Positive Technologies, are deeply entwined with the Kremlin's cyber operations.
A new regulation in Russia will require all smartphones and tablets sold in the country to come pre-installed with MAX, a state-backed messaging app.
After an 18-year presence, Sony has officially completed its withdrawal from the Russian market, ceasing all local operations and customer support.
Bitdefender Labs uncovers "Curly COMrades," a Russian-aligned cyber-espionage group using a new backdoor, MucorAgent, to target government and energy sectors.
Microsoft reveals Russian state actor Secret Blizzard is targeting foreign embassies in Moscow with ISP-level AiTM attacks, deploying ApolloShadow malware to spy on diplomats.
Kaspersky exposes a stealthy cyberespionage campaign targeting Russian IT firms and global businesses, using DLL hijacking, social media C2, and obfuscation to deploy Cobalt Strike.
IBM X-Force warns that Russian-aligned Hive0156 is intensifying spear-phishing campaigns against Ukrainian government and military, delivering Remcos RAT via LNK/PowerShell files.
Operation Eastwood, a massive international effort led by Europol, has significantly disrupted the pro-Russian cybercrime group NoName057(16), known for DDoS attacks.
Socket researchers uncovered widespread "protestware" in 28+ npm packages, silently disabling mouse interactions and playing the Ukrainian anthem for Russian-language users.
The Rainbow Hyena threat cluster is unleashing PhantomRemote, a new backdoor, in phishing attacks against Russia's healthcare and IT sectors, leveraging compromised emails.
FortiGuard Labs exposes NordDragonScan, a new infostealer using weaponized HTA scripts in Ukrainian-themed phishing. It performs recon, steals browser profiles, and exfiltrates documents.
Pro-Russian hacktivists intensify 2025 digital assaults on Ukraine, NATO, and Western critical infrastructure, using DDoS, defacements, and targeting ICS.
OFAC sanctioned Russia's Aeza Group, a bulletproof hosting provider, and its executives for enabling ransomware, infostealers (Meduza, Lumma), and darknet drug trafficking operations globally.
Russia has begun systematically blocking Cloudflare, throttling internet connections to 16KB after the initial download, impacting vast numbers of websites and other major hosting providers.
XDSpy, a covert cyber-espionage group, is back with a sophisticated campaign targeting governments, leveraging an obscure Windows LNK file parsing flaw and new XDigo malware
Librarian Ghouls APT launches a new cyber-espionage and cryptojacking campaign targeting Russia and CIS, using legitimate tools for stealth.