#Russia
All CosmicBytez Labs articles tagged #Russia, across news, security advisories, how-to guides, and projects.
- News
Moscow Police Detain Suspected DataSuckers Hackers Linked to Breaches in Ukraine and Russia
Russian police detained three suspected DataSuckers hackers after breaches of Dodo Pizza, Tez Tour, and Ukraine's ATB Market.
- News
YMCO Leader Pleads Guilty to Running 15,000-Mule Laundering Network for Cybercriminals
Oleg Korniev, 42, admitted leading YMCO, a ring of 15,000+ U.S. money mules that laundered over $10 million stolen by hackers since 2007.
- News
Yandex Confirms Service Outage as Drone Strikes Disable Three Data Centers
Drone strikes on three Yandex data centers cut Russian cloud connectivity to roughly 30%, knocking out storage, payments, and dozens of services.
- News
Belarusian Cyber Partisans Admit to 2023 Breach of Russian Healthcare Network
The hacktivist group confirmed a Russian researcher's report that it held admin-level access inside Moscow's Department of Health network for months in 2023.
- News
Russian APT Star Blizzard Uses 'RedFlick' Infection Chain in Recent Attacks
FSB-linked Star Blizzard shifted to a 'RedFlick' infection chain, hitting 100+ Ukraine-linked orgs since January to deploy the CosmicPulse backdoor.
- News
Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net
FSB-linked Star Blizzard dropped ClickFix for a one-click 'RedFlick' chain, expanding phishing beyond Ukraine to deploy its CosmicPulse backdoor.
- News
No Evidence of Successful Foreign Meddling in 2024 Election, Spy Agencies Found
A classified U.S. intelligence assessment found no evidence Russia, China, or Iran altered the 2024 election's outcome, despite active influence campaigns.
- News
Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
Kaspersky details NightEagle, Hacking Cat, and Toy Ghouls — three distinct clusters hitting Russian organizations with backdoors, ransomware, and wipers.
- News
Hackers Claim Breach of Russian Election Systems Days Before Parliamentary Vote
An anonymous group calling itself CikLeak claims it breached Russia's Central Election Commission days before the State Duma vote.
- News
NightEagle and Toy Ghouls Join Hacking Cat in Hitting Russian Firms
Kaspersky tracks three distinct clusters — NightEagle, Hacking Cat, and Toy Ghouls — hitting Russian enterprises with backdoors, ransomware, wipers.
- News
Zelensky Appoints Former Police Chief to Lead Ukraine's Cyber Coordination Center
Ihor Klymenko, Ukraine's former police chief and interior minister, will lead the National Cybersecurity Coordination Center under Zelensky.
- News
Pro-Ukraine Hacking Cat Group Deploying New Malware Against Russian Targets
Kaspersky says pro-Ukraine hacktivist group Hacking Cat has moved from defacements to a RAT, ransomware, and a data-destroying wiper.
- News
Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users
"Twitch Enhanced Viewer | JeetBot" forwarded OAuth tokens in cleartext to a Russian bot service's proxy, exposing roughly 31,000 users.
- News
Hackers Abused Claude to Extract Secrets From 1.8 Million Android Apps
Anthropic disrupted a ShinyHunters affiliate that used Claude to scan 1.8M Android APKs for hardcoded secrets, plus Russia- and China-linked hacking ops.
- News
Russian Hackers Breached Polish Energy Plant via Private APN in World-First DER Cyberattack
ELECTRUM/Sandworm compromised a Polish heat-and-power plant serving 50,000 residents through a private cellular APN, marking the first recorded...
- News
Head Mare Hacktivists Breach TrueConf to Trojanize Client Installers with PhantomCore Backdoors
The Head Mare hacktivist group exploited two unpatched TrueConf server vulnerabilities to replace legitimate client installers with malicious versions...
- News
Hotel Wi-Fi Attacks Use Custom Malware to Breach Microsoft 365 Accounts
Russia-linked APT29 subgroup Storm-2945 is hijacking hotel and conference centre Wi-Fi captive portals to steal Microsoft 365 tokens from travelling...
- News
Russian Hackers Exploit Exchange OWA Zero-Day for Long-Term Mailbox Access
The Russian state-sponsored group Laundry Bear (Void Blizzard) is exploiting a zero-day vulnerability in Microsoft Exchange Outlook Web Access to deliver...
- News
Russian Hackers Exploit Zimbra Zero-Day Against US, Ukraine Targets
State-sponsored threat group 'Laundry Bear' is weaponizing a Zimbra zero-day using half-click phishing emails that trigger exploitation simply by opening...
- News
Russian APT 'Laundry Bear' Exploited Zimbra Zero-Day with Half-Click Email Attack
Russia-backed Laundry Bear (Void Blizzard/TA488) exploited CVE-2025-66376 — a stored XSS flaw in Zimbra's Classic UI — to compromise US, Ukrainian, and...
- News
In Other News: Dolphin X AI Malware, Car Anti-Theft Hack, 432 Linux Kernel CVEs
This week's security roundup covers an AI-prioritizing infostealer targeting developer machines, a hardcoded Bluetooth key in 2.2 million car anti-theft...
- News
Russian Laundry Bear Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
A Russian state-sponsored espionage group spent months silently reading Western mailboxes through a zero-click XSS flaw in Zimbra's webmail client —...
- News
Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs
A solo Russian-speaking threat actor known as "bandcampro" outsourced their entire C2 operation to Google's Gemini CLI — writing zero code themselves...
- News
Hackers Abuse ViPNet Software to Target Russian Government Agencies
An advanced threat actor is exploiting the ViPNet private networking suite's update mechanism via DLL sideloading to compromise Russian government,...
- News
UAC-0145 Uses ClickFix CAPTCHAs to Deliver Malware to Ukrainian Devices
Russian state-sponsored threat actor UAC-0145 is deploying ClickFix-style fake CAPTCHA prompts to trick Ukrainian targets into self-installing...
- News
Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker — Lawyers Say Wrong Man
Armenia has held a Russian tourist named Aleksandr Ermakov in detention since June 28 after a U.S. extradition request for a REvil ransomware suspect...
- News
Google Gemini CLI Jailbroken and Used as a Hacking Agent to Run a Malware Botnet
Trend Micro researchers discovered a Russian-speaking threat actor named 'bandcampro' who jailbroke Google's open-source Gemini CLI to operate an...
- News
US Charges Three Russians for Operating Bulletproof Hosting Behind $62M Ransomware Campaign
Federal prosecutors unsealed a 2024 indictment against three Russian nationals who ran Medialand LLC and ML.Cloud LLC — bulletproof hosting services used...
- News
Hackers Hijack Russian Journalist Sobchak's Telegram Channels via Email Breach, Claim 350 GB Stolen
Hacker group Black Mirror compromised Ksenia Sobchak's email account and used it to seize two of her Telegram channels with 1.5 million combined...
- News
UK Charges Five Suspects Linked to Russian Coms Call Spoofing Platform
The UK National Crime Agency has charged five suspects following an investigation into Russian Coms, a major criminal caller ID spoofing platform...
- News
Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer
Kaspersky has identified a previously undocumented APT group — Armored Likho (aka Eagle Werewolf) — deploying an AI-assisted Python infostealer called...
- News
Gamaredon Expands Ukraine Attacks with New Malware and Cloud Abuse
Russian FSB-linked APT group Gamaredon has mounted 35 distinct spear-phishing campaigns against Ukrainian targets in 2025, deploying an expanded malware...
- News
Iran, Russia, and China Target Water Systems for Sabotage
Nation-state attackers from Iran, Russia, and China are breaching water utility systems through weak passwords, exposed PLCs, and poor network...
- News
U.S. Offers $10 Million for Russian Hackers Targeting WhatsApp and Signal Users
The U.S. Department of State is offering up to $10 million through its Rewards for Justice program for information identifying members of UNC5792 and...
- News
FBI: Russian Hackers Now Target Signal Backup Recovery Keys
The FBI and CISA warn that a Russian-linked phishing campaign targeting Signal users has evolved to steal Backup Recovery Keys, giving attackers full...
- News
Ukraine Says Russian Intelligence Used Fake Support Texts to Steal Messaging Credentials
Ukraine's SSU and the FBI have exposed a sustained Russian intelligence campaign using fake support SMS messages to steal Signal, WhatsApp, and Telegram...
- News
Ukraine and FBI Expose Russian Intelligence Campaign Stealing Signal Credentials via Fake SMS
The SSU and FBI jointly disclosed a sustained Russian intelligence operation targeting messaging credentials of government officials, military personnel,...
- News
Russia Used Social Engineering to Breach Prominent Messaging Accounts, Ukraine Says
Ukraine's SBU and the FBI have jointly exposed a long-running Russian intelligence operation using fake tech-support workers to steal messaging app...
- News
Russian APT Deploys 'StockStay' Backdoor Against Ukrainian Targets
Turla, a prolific Russian state-sponsored threat actor, has deployed a previously undocumented backdoor dubbed 'StockStay' in espionage operations...
- News
Russian APT Gamaredon Upgrades Its Arsenal, Requiring New Defenses
ESET research reveals FSB-sponsored Gamaredon has significantly upgraded its C2 infrastructure obfuscation and malware delivery capabilities, running 35...
- News
FortiBleed: 5-Stage Attack Chain Behind 110 Million Credential Heist on FortiGate Firewalls
Deep analysis of the FortiBleed operation reveals a sophisticated five-stage credential harvesting pipeline — custom Golang sniffers, Telegram-based...
- News
FortiBleed: Russian IAB Harvested 110 Million Credentials from 430,000 FortiGate Firewalls
A financially motivated Russian-speaking initial access broker behind the FortiBleed campaign has been systematically harvesting credentials from over...
- News
Russian Initial Access Broker Behind FortiBleed Campaign
A Russian-speaking initial access broker has compromised 86,644 verified credentials from over 430,000 internet-facing Fortinet FortiGate devices across...
- News
Police Cleans Nearly 15,000 SocGholish-Infected Sites Tied to Evil Corp
International law enforcement cleaned nearly 15,000 malware-infected WordPress websites and took down more than 100 servers linked to the SocGholish...
- News
Cyberattack on Russian Tech Firm Astral Disrupts Business and Government Services for a Week
A sustained cyberattack against Russian enterprise software provider Astral has disrupted business and government services across Russia for over a week,...
- News
Russian Spies Aggressively Targeting Western Technology as Sanctions Bite
Western intelligence officials warn that Moscow's espionage apparatus is deploying cyber spies, hackers, and recruited middlemen to steal dual-use...
- News
Dutch Raid Fails to Dent Russian Bulletproof Host THE.Hosting
Dutch law enforcement seized 800 servers and arrested two operators of THE.Hosting but left the provider's core IP address space intact — and the...
- News
UK Cyberspying Chief Calls AI 'an Unstoppable Force' and Warns About Russia
UK signals-intel chief warns AI is reshaping threats as an unstoppable force while Russia escalates hostile gray-zone activity below open conflict.
- News
Europe Dismantles VPN Service Used by Cybercriminals to Hide Ransomware Attacks
European law enforcement has taken down First VPN, a privacy service that had been openly advertised on Russian-language cybercrime forums as a tool for...
- News
Police Seize 'First VPN' Service Used in Ransomware and Data Theft Attacks
International law enforcement has dismantled 'First VPN,' a criminal VPN service marketed on Russian-speaking cybercrime forums and used to facilitate...
- News
Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access
Russia's Turla APT has transformed its long-running Kazuar backdoor into a modular peer-to-peer botnet architecture engineered for stealth and deep...
- News
Russian Hackers Turn Kazuar Backdoor into Modular P2P Botnet
Secret Blizzard, a Russian state-sponsored threat group, has evolved its long-running Kazuar backdoor into a sophisticated modular peer-to-peer botnet...
- News
''FrostyNeighbor'' APT Carefully Targets Govt Orgs in Poland, Ukraine
A Belarusian nation-state threat group dubbed FrostyNeighbor is conducting a precise espionage campaign against government organizations in Poland and...
- News
Incomplete Windows Patch Opens Door to Zero-Click Attacks
A Microsoft Windows vulnerability originally patched in a prior Patch Tuesday was incompletely remediated, leaving a residual attack surface that...
- News
PhantomCore Exploits TrueConf Vulnerabilities to Breach
Pro-Ukrainian hacktivist group PhantomCore has been attributed to a sustained campaign targeting TrueConf video conferencing servers across Russia since...
- News
Ukraine Confirms APT28 Campaign Targeting Prosecutors and Anti-Corruption Agencies
Ukraine's CERT-UA has confirmed a suspected APT28 espionage campaign targeting Ukrainian prosecutors and anti-corruption agencies, exploiting Roundcube...
- News
Cybercriminals Target Accountants to Drain Russian Firms'
Cybercriminals are stealing millions from Russian companies by compromising accountants' computers and disguising fraudulent transfers as routine salary...
- News
Russia's Forest Blizzard Harvests Logins via SOHO Router
Russia's APT28 (Forest Blizzard) is conducting a malwareless espionage campaign by modifying a single DNS setting in vulnerable SOHO routers to silently...
- News
APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine
Russian state-sponsored threat actor APT28 (Forest Blizzard / Pawn Storm) has launched a targeted spear-phishing campaign deploying a newly documented...
- News
Medusa Ransomware Exploits Zero-Days to Deploy Ransomware
Microsoft has raised the alarm over Medusa ransomware's unprecedented operational speed, with the group now exploiting zero-day vulnerabilities before...
- News
German Authorities Identify REvil and GandCrab Ransomware
Germany's Federal Police have publicly named two Russian nationals as the leaders of the GandCrab and REvil ransomware operations, linking them to at...
- News
Medusa Ransomware Group Exploits Zero-Days to Strike Within
Microsoft warns that Medusa ransomware operators are exploiting zero-day vulnerabilities approximately one week before public disclosure, enabling the...
- News
Germany Doxes "UNKN," Head of RU Ransomware Gangs REvil
German authorities have publicly identified the elusive "UNKN," the operator behind the GandCrab and REvil ransomware groups, as 31-year-old Russian...
- News
Bearlyfy Hits Russian Firms with Custom GenieLocker
Pro-Ukrainian hacktivist group Bearlyfy has conducted over 70 cyberattacks against Russian companies since January 2025, recently deploying a custom...
- News
TA446 Deploys DarkSword iOS Exploit Kit in Targeted
Proofpoint has attributed a targeted email campaign to Russian state-sponsored threat actor TA446, which is leveraging the recently disclosed DarkSword...
- News
Pro-Ukraine Hacker Group Bearlyfy Targets Russian Companies
The pro-Ukrainian hacktivist group Bearlyfy has conducted over 70 cyberattacks against Russian businesses in the past year and is escalating operations...
- News
Russia Detains Alleged Admin of LeakBase Cybercrime Forum
Russian authorities have detained a suspected administrator of LeakBase, a major stolen-data marketplace with over 147,000 subscribers, just weeks after...
- News
LeakBase Admin Arrested in Russia Over Massive Stolen
Russian law enforcement has arrested the alleged administrator of LeakBase — a credential marketplace operating since 2021 with 142,000 members and...
- News
Manager of Botnet Used in Ransomware Attacks Gets 2 Years
Ilya Angelov, co-leader of the TA551/Mario Kart cybercrime group, was sentenced to two years in prison for operating a phishing botnet that sent 700,000...
- News
Russian Hacker Who Helped Yanluowang Ransomware Gang Gets
Aleksei Volkov, a Russian initial access broker who sold unauthorized access to U.S. companies for the Yanluowang ransomware group, has been sentenced to...
- News
FBI Warns Russian Intelligence Targeting Signal and WhatsApp in Mass Phishing Campaign
FBI and CISA alert warns Russian state actors have compromised thousands of messaging accounts belonging to US government officials, military personnel,...
- News
Phobos Ransomware Admin Pleads Guilty — 1,000+ Victims
Evgenii Ptitsyn, 43, a Russian national who administered the Phobos ransomware-as-a-service operation, pleaded guilty to wire fraud conspiracy in the U.S....
- News
AI-Armed Amateur Hacker Compromises 600+ FortiGate
Amazon's threat intelligence team has documented how a Russian-speaking, financially motivated actor used multiple commercial generative AI tools to...
- News
Diesel Vortex: Russian Cybercrime Ring Steals 1,649
A Russian-linked phishing operation dubbed Diesel Vortex has stolen over 1,649 credentials from major freight and logistics companies across the US and...
- News
APT28 Operation MacroMaze: Russia-Linked Hackers Hit
Russia-linked APT28 targeted government, diplomatic, and defense-adjacent entities across Western and Central Europe from September 2025 to January 2026...
- News
U.S. Treasury Sanctions Russian Zero-Day Broker Operation
The U.S. Treasury sanctioned Russian zero-day exploit broker Operation Zero, its founder Sergey Zelenyuk, and affiliated entities after an FBI...
- News
Pro-Russian Hacktivists Launch Sustained Cyber Campaign
NoName057(16) and allied hacktivist groups are conducting DDoS attacks against Milan-Cortina 2026 Olympic infrastructure, Italian government sites, and...
- News
APT28 Weaponizes Microsoft Office Zero-Day in 3 Days
Russia-linked APT28 (Fancy Bear) weaponized Microsoft Office CVE-2026-21509 within days of disclosure, deploying espionage implants against Ukrainian...
- News
Russian APT 'ChainReaver' Hijacks 50 GitHub Accounts and Mirrors
A Russian state-sponsored APT group dubbed ChainReaver-L compromised trusted file-sharing mirrors and 50 long-established GitHub accounts to distribute...
- News
All Four Major Nation-State Adversaries Now Weaponizing
Google reports that APT groups from China, Russia, Iran, and North Korea are all actively using Gemini AI for cyber operations including target...
- News
Russian-Linked CANFAIL Malware Targets Ukrainian Defense
Google Threat Intelligence Group attributes a previously undocumented JavaScript malware called CANFAIL to a Russian-linked threat actor targeting...
- News
Ex-L3Harris Executive Pleads Guilty to Selling Eight
Peter Williams, former GM of L3Harris's cyber subsidiary Trenchant, admits to selling eight zero-day exploit kits to a Russian broker for $1.3M in...
- Security
WinRAR Path Traversal Flaw CVE-2025-8088 Actively Exploited
Critical path traversal vulnerability in WinRAR enables ransomware and credential theft as Russian and Chinese threat actors weaponize phishing campaigns...