Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Russia. Show all posts
Security Alarms
Cyber Attacks Delta Russia Security Alarms

Cyberattack Paralyzes Russia's Delta Security Systems

 

A massive cyberattack was launched against Delta, a leading Russian smart alarm system supplier for residential, commercial, and automotive use, on 26 January 2026, causing widespread operational disruptions across the country. The attack crippled Delta’s information technology systems, bringing down websites, telephony, and critical services for tens of thousands of subscribers. Delta labeled the incident a “large-scale external attack” designed to bring operations to a standstill, with no signs of customer data compromise identified at the time.

 End users were immediately affected as car alarms failed to turn off, preventing unlocking and engine start functions in many cases. Home and commercial building alarm systems defaulted to emergency modes that could not be overridden by users, while range-based services like vehicle start functions malfunctioned, sometimes causing engines to shut down during use. Information from Telegram groups like Baza and other news sources, such as Kommersant, shed light on these operational issues, highlighting the weaknesses of IoT security devices connected to the internet. 

Delta’s marketing director, Valery Ushkov, addressed the situation through a video message, stating that the company’s infrastructure was not capable of withstanding the “well-coordinated” global attack. The prolonged recovery effort was necessary due to continued threats following the attack, forcing updates to be posted through VKontakte instead of the company’s own channels. Although Delta claimed that most services would be restored soon with professional help, disruptions continued into 27 January, eroding trust in the company’s cybersecurity efforts. 

Unverified claims emerged on a Telegram channel allegedly linked to the hackers in which they shared one of ten alleged data dumps taken from Delta's systems. Though authenticity remains unconfirmed, fears grew over the mobile app's storage of payment and tracking data, compatible with most vehicles. No hacking group has claimed responsibility, leaving speculation about DDoS, ransomware, or wipers unresolved.

The breach is part of a wave of IT issues in Russia, which included the travel booking service being down that day, although the two incidents are not related, according to officials. It illustrates vulnerabilities in IoT-based security at a time of geopolitical strain and as Delta blamed a “hostile foreign state.” The incident sparks renewed demands for more robust safeguards in critical infrastructure to mitigate real-world physical safety risks from cyber incidents.
Read more »
Social Engineering
AI Cyber Attacks Data Microsoft phishing Russia Scams Social Engineering

2FA Fail: Hackers Exploit Microsoft 365 to Launch Code Phishing Attacks


Two-factor authentication (2FA) has been one of the most secure ways to protect online accounts. It requires a secondary code besides a password. However, in recent times, 2FA has not been a reliable method anymore, as hackers have started exploiting it easily. 

Experts advise users to use passkeys instead of 2FA these days, as they are more secure and less prone to hack attempts. Recent reports have shown that 2FA as a security method is undermined. 

Russian-linked state sponsored threat actors are now abusing flaws in Microsoft’s 365. Experts from Proofpoint have noticed a surge in Microsoft 365 account takeover cyberattacks, threat actors are exploiting authentication code phishing to compromise Microsoft’s device authorization flow.

They are also launching advanced phishing campaigns that escape 2FA and hack sensitive accounts. 

About the attack

The recent series of cyberattacks use device code phishing where hackers lure victims into giving their authentication codes on fake websites that look real. When the code is entered, hackers gain entry to the victim's Microsoft 365 account, escaping the safety of 2FA. 

The campaigns started in early 2025. In the beginning, hackers relied primarily on code phishing. By March, they increased their tactics to exploit Oauth authentication workflows, which are largely used for signing into apps and services. The development shows how fast threat actors adapt when security experts find their tricks.

Who is the victim? 

The attacks are particularly targeted against high-value sectors that include:

Universities and research institutes 

Defense contractors

Energy providers

Government agencies 

Telecommunication companies 

By targeting these sectors, hackers increase the impact of their attacks for purposes such as disruption, espionage, and financial motives. 

The impact 

The surge in 2FA code attacks exposes a major gap, no security measure is foolproof. While 2FA is still far stronger than relying on passwords alone, it can be undermined if users are deceived into handing over their codes. This is not a failure of the technology itself, but of human trust and awareness.  

A single compromised account can expose sensitive emails, documents, and internal systems. Users are at risk of losing their personal data, financial information, and even identity in these cases.

How to Stay Safe

Verify URLs carefully. Never enter authentication codes on unfamiliar or suspicious websites.  

Use phishing-resistant authentication. Hardware security keys (like YubiKeys) or biometric logins are harder to trick.  

Enable conditional access policies. Organizations can restrict logins based on location, device, or risk level.  

Monitor OAuth activity. Be cautious of unexpected consent requests from apps or services.  

Educate users. Awareness training is often the most effective defense against social engineering.  


Read more »
Russia
Amazon AWS Cloud Security Credential Theft Cyber Attacks GRU Russia

Amazon Says It Has Disrupted GRU-Linked Cyber Operations Targeting Cloud Customers

 



Amazon has announced that its threat intelligence division has intervened in ongoing cyber operations attributed to hackers associated with Russia’s foreign military intelligence service, the GRU. The activity targeted organizations using Amazon’s cloud infrastructure, with attackers attempting to gain unauthorized access to customer-managed systems.

The company reported that the malicious campaign dates back to 2021 and largely concentrated on Western critical infrastructure. Within this scope, energy-related organizations were among the most frequently targeted sectors, indicating a strategic focus on high-impact industries.

Amazon’s investigation shows that the attackers initially relied on exploiting security weaknesses to break into networks. Over multiple years, they used a combination of newly discovered flaws and already known vulnerabilities in enterprise technologies, including security appliances, collaboration software, and data protection platforms. These weaknesses served as their primary entry points.

As the campaign progressed, the attackers adjusted their approach. By 2025, Amazon observed a reduced reliance on vulnerability exploitation. Instead, the group increasingly targeted customer network edge devices that were incorrectly configured. These included enterprise routers, VPN gateways, network management systems, collaboration tools, and cloud-based project management platforms.

Devices with exposed administrative interfaces or weak security controls became easy targets. By exploiting configuration errors rather than software flaws, the attackers achieved the same long-term goals: maintaining persistent access to critical networks and collecting login credentials for later use.

Amazon noted that this shift reflects a change in operational focus rather than intent. While misconfiguration abuse has been observed since at least 2022, the sustained emphasis on this tactic in 2025 suggests the attackers deliberately scaled back efforts to exploit zero-day and known vulnerabilities. Despite this evolution, their core objectives remained unchanged: credential theft and quiet movement within victim environments using minimal resources and low visibility.

Based on overlapping infrastructure and targeting similarities with previously identified threat groups, Amazon assessed with high confidence that the activity is linked to GRU-associated hackers. The company believes one subgroup, previously identified by external researchers, may be responsible for actions taken after initial compromise as part of a broader, multi-unit campaign.

Although Amazon did not directly observe how data was extracted, forensic evidence suggests passive network monitoring techniques were used. Indicators included delays between initial device compromise and credential usage, as well as unauthorized reuse of legitimate organizational credentials.

The compromised systems were customer-controlled network appliances running on Amazon EC2 instances. Amazon emphasized that no vulnerabilities in AWS services themselves were exploited during these attacks.

Once the activity was detected, Amazon moved to secure affected instances, alerted impacted customers, and shared intelligence with relevant vendors and industry partners. The company stated that coordinated action helped disrupt the attackers’ operations and limit further exposure.

Amazon also released a list of internet addresses linked to the activity but cautioned organizations against blocking them without proper analysis, as they belong to legitimate systems that had been hijacked.

To mitigate similar threats, Amazon recommended immediate steps such as auditing network device configurations, monitoring for credential replay, and closely tracking access to administrative portals. For AWS users, additional measures include isolating management interfaces, tightening security group rules, and enabling monitoring tools like CloudTrail, GuardDuty, and VPC Flow Logs.

Read more »
USA
Bulletproof hosting Cyber Crime media land Ransomware Russia USA

Governments sanction Russian “bulletproof” host for aiding ransomware networks

 



Authorities in the United States, the United Kingdom, and Australia have jointly imposed sanctions on a Russian bulletproof hosting provider accused of giving safe and long-term technical support to ransomware operators and other criminal groups. Officials say the newly sanctioned entities have played a central role in keeping several high-impact cybercrime operations online.

A bulletproof hosting service is a type of internet infrastructure provider that knowingly allows harmful activity on its servers. These companies rent out digital space and refuse to take down malicious websites, even when they receive complaints from victims or requests from law enforcement. Such services help threat actors conduct phishing campaigns, distribute malware, run command and control systems for their attacks, and host illegal content without fear of quick removal. This resistance to oversight makes it harder for investigators to disrupt cybercriminal networks.


Media Land and its linked companies named as key targets

The United States Treasury’s Office of Foreign Assets Control announced that Media Land, a Russia-based provider, has been added to the sanctions list along with three related firms: Media Land Technology, Data Center Kirishi, and ML Cloud. According to officials, Media Land’s infrastructure has been connected to well-known ransomware groups. It has also been tied to distributed denial-of-service attacks that targeted American companies, including systems categorized as critical infrastructure such as parts of the telecommunications sector.


Officials name individuals connected to the operation

Sanctions also extend to three people associated with Media Land. Aleksandr Volosovik has been identified as someone who promoted the company’s services on underground cybercriminal forums under the username Yalishanda. Another individual, Kirill Zatolokin, is accused of handling customer payments. A third person, Yulia Pankova, is said to have assisted with legal matters and financial management. The United Kingdom additionally stated that Volosovik has interacted with multiple cybercrime groups in the past.


Other companies involved in supporting the infrastructure

The sanctions package further includes Aeza Group LLC, another bulletproof hosting operator that had already been sanctioned earlier this year. Authorities say Aeza attempted to continue operating by using a UK-based company named Hypercore Ltd as a front. Additional entities in Serbia and Uzbekistan that provided technical assistance to the network have also been designated.


Government agencies issue defensive guidance

Along with the sanctions, cybersecurity agencies across the Five Eyes alliance released technical recommendations to help defenders identify and block activity linked to bulletproof hosting services. They suggest creating high-confidence lists of harmful internet resources based on verified threat intelligence, performing continuous monitoring of network traffic, and applying filtering rules at network boundaries while examining how those rules might affect legitimate users. The guidance also encourages service providers to maintain stronger onboarding checks for new customers since criminal operators often hide behind temporary email accounts or phone numbers.


Implications of the sanctions

All assets connected to the named individuals and companies within the United States, the United Kingdom, and Australia will now be frozen. Any organisation or person that continues to conduct transactions with them may face secondary sanctions or other enforcement actions. This step builds on earlier actions taken in February, when the three nations sanctioned ZServers, another Russian hosting operation, while Dutch authorities seized more than one hundred of its servers.

The coordinated announcement signals a growing international effort to dismantle the online infrastructure that ransomware groups depend on. It also reinforces the need for organisations to maintain strong cybersecurity practices, rely on reputable service providers, and monitor threat intelligence to reduce exposure to criminal activity.

Read more »
Russia
aviation Cyber Security European Commission GPS Jamming GPS Spoofing Russia

Russia’s Widespread GPS Jamming Raises Concerns for Air and Sea Safety

 


A recent incident involving the European Commission President’s aircraft has drawn attention to a growing risk in international travel: deliberate interference with satellite navigation systems. The plane, flying into Plovdiv, Bulgaria, temporarily lost its GPS signal due to electronic jamming but landed without issue. Bulgarian authorities later said the disruption was not unusual, describing such interference as a side effect of the ongoing war in Ukraine.

This case is not isolated. Aviation and maritime authorities across Europe have reported an increasing number of GPS disruptions since Russia’s invasion of Ukraine in 2022. Analysts estimate there have been dozens of such events in recent years, affecting flights, shipping routes, and even small private aircraft. Nordic and Baltic nations, in particular, have issued repeated warnings about interference originating near Russian borders.


How GPS jamming works

Satellite navigation relies on faint signals transmitted from orbit. Devices such as aircraft systems, cars, ships, and even smartphones calculate their exact location by comparing timing signals from multiple satellites. These signals, however, are fragile.

Jamming overwhelms the receiver with stronger radio noise, making it impossible to lock onto satellites. Spoofing takes it further by transmitting fake signals that mimic satellites, tricking receivers into reporting false positions. Both techniques have long been used in military operations. For instance, jamming can block incoming drones or missiles, while spoofing can disguise troop or aircraft movements. Experts say such technology has been used not only in Ukraine but also in other conflicts, such as alleged Israeli operations against Iranian air defenses.


Rising incidents across Europe

Countries bordering Russia report sharp increases in interference. Latvia’s communications authority documented more than 800 cases of satellite disruption in 2024, compared with only a few dozen two years earlier. Finland’s national airline even suspended flights to the Estonian city of Tartu after two aircraft struggled to land due to lost GPS guidance. Similarly, Britain’s defense secretary experienced jamming while flying near Russian territory.

The interference is not limited to aviation. Sweden has received reports of ships in the Baltic Sea losing signal, prompting officials to advise sailors to fall back on radar and landmarks. In one case, two German tourists accidentally crossed into Russian airspace in a light aircraft and had to be escorted back. Such episodes underline how civilian safety is affected by what many governments see as deliberate Russian tactics.


Risks and responses

Experts emphasize that aircraft and ships are equipped with backup systems, including radio beacons and inertial navigation, meaning total reliance on satellites is unnecessary. Yet the danger lies in moments of confusion or equipment failure, when loss of GPS could tip a situation into crisis.

Authorities are responding by restricting drone flights near interference hotspots, training crews to operate without GPS, and pressing international organizations to address the issue. While Russia dismisses complaints as political, analysts warn that disruptions serve a dual purpose: defending Russian airspace while sowing uncertainty among its neighbors.

As incidents multiply, the concern is that one miscalculation could lead to a major accident, particularly at sea, where heavy reliance on GPS has become the norm.


Read more »
Technology
MAX messaging app Online Privacy Russia Technology

Russia’s New MAX Messaging App Sparks Spying Fears

 

From first September, Russia’s new state-backed messaging app MAX will come pre-installed on every smartphone and tablet sold in the country, igniting strong concerns over data privacy and state monitoring. Built by VK, the company behind Mail.ru and VKnote, the platform launched in March 2025 and has already drawn 18 million users, according to Interfax. Much like China’s WeChat, MAX blends private messaging with access to official government services.

Concerns Over Security 

Independent analyses commissioned by Forbes reveal that MAX includes aggressive tracking functions, weak security protections, and no end-to-end encryption, a combination that could leave conversations exposed to real-time monitoring. Researchers argue this places Russian users at greater risk than those relying on WhatsApp or Telegram. 

Digital rights advocates at Roskomsvoboda acknowledged that MAX requests fewer device permissions than its rivals, but warned that all communications are routed through state-controlled servers, making surveillance far easier. 

“MAX has enormous surveillance potential, as every piece of data within it can be accessed instantly by intelligence agencies,” said Ilya Perevalov, technical expert at Roskomsvoboda and RKS Global. 

He also cautioned that integrating payment systems could heighten risks of data breaches and fraud. 

WhatsApp Faces Crackdown 

At present, WhatsApp remains the most widely used messaging service in Russia, but its days may be numbered. Authorities have confirmed plans to block the app, and by mid-August, restrictions were already applied to voice calls on both Telegram and WhatsApp, citing counterterrorism concerns. The push comes alongside new laws punishing online searches for “extremist content” and imposing harsher penalties on VPN use, reducing citizens’ ability to bypass government restrictions. 

Privacy Under Pressure

Officials insist MAX collects less personal information than foreign competitors. Yet analysts argue the real issue is not the number of permissions but the direct pipeline of data to state agencies. With WhatsApp on the verge of a ban and VPN access under growing pressure, Russian users may soon be left with MAX as their only reliable option, a development critics warn could tighten government control over digital freedoms and reshape the country’s online communications landscape.
Read more »
WhatsApp
Russia Social Media Technology Telegram WhatsApp

Russia launches messenger app "Max" that could replace WhatsApp

Russia launches messenger app "Max" that could replace WhatsApp

Russia is planning to make a “national messenger” as an alternative to social media apps like WhatsApp and Telegram. Max, a messenger app released earlier this year by the tech giant VK and supported by state media campaigns, seems to be the basis of this service. 

WhatsApp may face a ban in Russia as the Kremlin seeks to exert greater control over the online sphere. This blog explains about Max and what is likely to happen in Russia with the new changes.

About Max

The app was launched in March 2025. It has features similar to those of WhatsApp and Telegram. Max supports business accounts while also trying to become more than just a messaging app. "Friends, hello! I recently downloaded the Max app. And you know what, I was just amazed," said Russian influencer and singer Instasamka in a promotional video. 

Max is promoted as a digital “super app”- a single platform for government and commercial services. The Russian bank has already started using a digital banking platform for customers to book via the travel wing of e-commerce giant Ozon.

Other national apps

Russia’s portal for public services, “Gosuslugi,” will be launched in 2026 with added access to the Central Bank’s Fast Payment System. “Several Asian countries have national or quasi-official messengers: China’s WeChat, Japan’s Line, South Korea’s KakaoTalk, Vietnam’s Zalo, and India’s Sandes,” according to the BBC.

Russian media has termed the app as “the Russian WeChat,” hinting at the Chinese state-backed application that is known as a tool of social control. Max is yet to prove its potential. According to VK, a million people have registered already. Both VK and Telegram have monthly Russian users of around 100 million, according to MediaScope. The app has mixed reviews. It currently has a 4.2 rating on the App Store and 2.4 on Google Play.

According to BBC, “Max is owned by a firm called “Communication Platform,” located in the same Moscow business center as VK. Russian business paper Vedomosti has reported that the two companies are affiliated. VK is ultimately controlled by state energy giant Gazprom.”

Read more »
Ukraine
Cyber Attacks Drone Hacking Russia Ukraine

Ukrainian Hackers Claim Major Cyberattack on Russian Drone Manufacturer



In an unsettling development in the ongoing cyber conflict linked to the Russia-Ukraine war, Ukrainian-aligned hacking groups have claimed responsibility for a large-scale cyberattack targeting a major Russian drone manufacturing company.

The targeted firm, identified as Gaskar Group, is believed to play a key role in supplying unmanned aerial vehicles (UAVs) to Russian forces. Two pro-Ukrainian hacker collectives, the BO Team and the Ukrainian Cyber Alliance, reportedly carried out the operation in collaboration with Ukraine’s military intelligence service.

The BO Team, a group known for supporting Ukraine through cyber operations, shared news of the breach on a Telegram channel on July 14. According to their statement, the team successfully gained full access to the internal network, servers, and data systems of the drone company. This breach reportedly allowed them to obtain sensitive technical details about existing and upcoming UAV models.

Following the infiltration, the hackers claimed they deleted a massive volume of data approximately 47 terabytes, which included 10 terabytes of backup files. They also say they disabled the company’s operational and support systems, potentially disrupting production and delaying the deployment of drones to the battlefield.

Ukrainian media sources have reported that Ukraine’s military intelligence has acknowledged the incident. In addition, some of the stolen data has allegedly been made public by the Ukrainian Cyber Alliance. These developments suggest that the cyberattack may have had a tangible impact on Russia’s drone supply chain.

While drone warfare has existed for years, the ongoing conflict has brought about a new level of reliance on smaller, low-cost drones for surveillance, attacks, and tactical missions. Both Ukraine and Russia have used these devices extensively on the frontlines, with drones proving to be a powerful asset in modern combat.

A March 2024 investigation by Reuters highlighted how drone use in Ukraine has grown to an unprecedented scale. First-person view (FPV) drones — often modified from commercial models have become especially important due to their low cost and versatility in hostile zones, where traditional aircraft are often vulnerable to air defense systems.

In June, drones were central to a Ukrainian strike known as "Operation Spiderweb," which reportedly resulted in major damage to Russian air assets.

In response to the latest incident, Gaskar Group has denied that the cyberattack caused serious damage. However, if the claims made by the hacking groups are proven true, the breach could significantly affect Russia’s ability to supply drones in the short term.

As cyber warfare continues to play a larger role in the ongoing conflict, incidents like these reflect how digital attacks are becoming just as critical as physical operations in today’s battles. 

Read more »
Subscribe to: Comments (Atom)