All news with #russia nexus tag

🛡️ Fresh research suggests alarm over AI-generated malware may be overstated. Anthropic reported that Russia-linked Midnight Blizzard used Claude to rebuild malware when detections occurred, creating an autonomous loop to evade security. ReversingLabs found multiple rebuilt variants that shared identical behavior, enabling detection via telemetry and behavior-based hunting. Experts say AI speeds refactoring but does not change core malicious actions.

📝 The U.K. has imposed sanctions on Cryptomus (aka Certa Payments, Xeltox, Heleket) for processing cryptocurrency payments that benefit Russian state-linked actors and help cybercrime. The measures freeze Cryptomus assets in U.K. banks and bar British firms from dealing with it; related platforms VexPay, TokenSpot and Tsunami Payments are also targeted. Sanctions follow prior Canadian fines and long-running investigations that linked the service to ransomware, darknet markets and other illicit activity.

🛡️ TrendAI attributes a previously undocumented .NET infostealer and RAT named ASHVEIN (aka TelemetryBrowser) to the Russia-aligned actor UAC-0099, used in operations targeting Ukrainian government personnel. The malware combines credential theft from Chrome and Firefox, GDI-based screenshots, file collection, PowerShell remote shells, system fingerprinting, and encrypted C2 communications, with delivery via DLL sideloading, VHD containers, and .NET droppers. UAC-0099 has evolved from PowerShell- and Go-based tools to C# and .NET-protected binaries and has expanded targeting to logistics and civilian infrastructure.

🛡️ Microsoft says Russian-linked actor Star Blizzard has used fake event invitations and replying email threads to trick targets into running a Windows backdoor installer. Campaigns since January have targeted organizations tied to Ukraine, mainly in the U.S. and U.K., using hacked WordPress and cPanel accounts and a technique called RedFlick to install the CosmicPulse backdoor via scheduled tasks.

🛡️ Since January 2026, Microsoft observed Russian state-affiliated actor Star Blizzard refine large-scale phishing, use compromised-site accounts, and adopt a novel malware delivery technique called RedFlick. RedFlick leverages scheduled tasks to deploy the actor’s Python backdoor CosmicPulse, reducing required user interaction to a single response and improving evasion. Microsoft details observed TTPs, IOCs, mitigations, and detection guidance to help organizations defend against this evolving threat.

🛡️ Arctic Wolf Labs and Blackpoint Cyber reported an active ClickFix campaign compromising Ukrainian business websites to serve bogus Cloudflare verification pages that trick victims into executing an MSI installer. The MSI chain delivers a newly observed information stealer called Psychedelic, which harvests browser credentials, tokens, and crypto-wallet data, sets persistence, and contacts a C2 for follow-on tasks. Researchers also linked the ClickFix chain to other payloads including RemotePanel and BoundSiphon, highlighting modular remote-access and data-theft capabilities and evidence pointing to likely Russian-speaking operators.

🛡️ ESET researchers discovered a VBScript used by Russia-aligned UAC-0099 that embeds a decoy comment requesting guidance on building a nuclear weapon to trip LLM-based code scanners and halt analysis before malicious payloads are reached. The technique, named GuardBreaker, exploits prompt-injection weaknesses by placing adversarial content in plain sight within comments, without affecting runtime behavior, and was used to deliver the MATCHBOIL loader. The finding highlights attackers adapting to AI-assisted defenses and the need for layered validation and human oversight.

🔍 The U.S. Department of Justice has charged Searzhudin Tamirlanovich Aktulaev, extradited from Cyprus on August 28, for operating roughly 255 fake accounts on a freelance platform to distribute malware-laced Excel attachments to about 80,000 users in 2016–2017. The indictment, unsealed after his August 31 appearance in San Francisco, alleges use of TVRAT and DarkVNC to gain remote control, steal data, and facilitate fraud. Aktulaev denies the charges; the DoJ notes allegations are unproven until conviction.

🛡️ A U.S. federal grand jury indicted Russian national Searzhudin Aktulaev for a phishing campaign that infected thousands of freelancers with TVRAT and DarkVNC malware. Extradited from Cyprus, Aktulaev allegedly used hundreds of fake accounts between 2016 and 2017 to send malicious Excel attachments that deployed remote-access malware to roughly 80,000 targets. The malware exfiltrated credentials and PII to command-and-control servers, many hosted in the U.S., and half of victims were in the United States.

📄 The leaked Bauman records describe a structured force-generation mechanism across General Staff components, including the GRU and Department No. 4, linked to units such as Military Unit 74455 (Sandworm). The material reframes Russian cyber capability as an institutional system—showing a pathway from university recruitment to military cyber roles—and clarifies that reported assignments are unit placements, not proof of individual operations.

🛡️ Google Threat Intelligence Group (GTIG) reports three suspected Russian cyber espionage clusters—UNC6293, UNC7005, and UNC5976—targeting academia, aerospace and defense, governments, and think tanks across Europe and the US. These groups abuse legitimate authentication flows, including app passwords, OAuth prompts, and device linking, and use persistent, adaptive phishing with sophisticated social engineering. UNC7005 employs website templates, fingerprinting, analysis-evasion scripts, and malicious JavaScript to record audio/video or deliver further compromise.

🔒 Ukraine's CERT-UA warns that Russian-linked Sandworm actors are using fake CAPTCHA prompts on compromised sites to trick users into pasting and executing PowerShell commands on their PCs. The campaign, attributed to UAC-0145, began surging in June and has compromised at least ten websites, deploying a reconnaissance tool called ScoutCurl. These "ClickFix" attacks coerce victims to run legitimate tools like PowerShell, making them effective and dangerous.

🔍 A Russian-speaking actor called "bandcampro" leveraged Google's open-source Gemini CLI as an AI hacking agent and to run a small botnet targeting at least eight systems in a dental clinic. Over 200 sessions between May and April, the AI executed migration, troubleshooting, and operational improvements, storing credentials and following a built-in C2 playbook. Trend Micro found the setup tiny and unsophisticated, with Python HTTP and PowerShell agents and persistence via scheduled tasks, WMI, and registry changes.

🔒 A multinational cybersecurity advisory warns that Russian government-sponsored actors are exploiting poorly configured routers and legacy protocols to steal device configurations and credentials. Attackers scan for devices using SNMPv1/v2, default community strings, and vulnerable Cisco features like Smart Install, then exfiltrate config files to attacker-controlled servers. Agencies recommend migrating to SNMPv3, disabling legacy protocols and Cisco Smart Install, enforcing strong passwords and MFA, blocking SNMP at firewalls, updating software, and retiring EOL devices.

🛡️ The EU and the UK issued coordinated sanctions targeting Russian individuals, entities, and intelligence units accused of orchestrating cyberattacks across Europe. Designations include GRU and FSB-linked officers, cybercriminals, and private firms alleged to recruit hackers and run malware operations. Officials cite sustained campaigns against government and critical infrastructure since 2010 and recent disruptive attempts in Poland. The measures follow broader EU proposals to strengthen cybersecurity and precede additional sanctions on foreign companies tied to attacks.

🔒 Cyber agencies from 12 countries warn that Russian FSB Centre 16 (aka Berserk Bear/Static Tundra) is scanning the internet for routers using default or weak SNMP credentials and occasionally exploiting known CVEs in Cisco devices. Sectors such as communications, defence, energy, finance, government and healthcare are urged to adopt SNMPv3, patch affected systems and disable vulnerable features like Smart Install when patching is not possible. The advisory links Centre 16’s tactics to broader disruptive campaigns and coincides with UK/EU attribution of late 2025 attacks on Poland’s energy grid to the group.

🔒 Cybersecurity agencies from the US and eight partner nations issued a joint advisory warning that Russian state-linked hackers (FSB Centre 16) are exploiting poorly configured routers and default SNMP credentials to breach critical infrastructure networks. The advisory attributes scanning and exfiltration activity to groups tracked as Berserk Bear and others, and highlights exploitation of Cisco Smart Install (CVE-2018-0171). Agencies urged mitigation steps including upgrading to SNMPv3, disabling Cisco Smart Install, enforcing strong passwords, blocking TFTP/SNMP at the perimeter, and updating firmware to protect energy, communications, healthcare, finance, and government sectors.

🛡️ Spain's National Police arrested a man suspected of active roles in the pro‑Russian hacktivist groups CyberArmy of Russia Reborn and Z‑Pentest. Authorities say he provided logistical and operational support to a CARR-linked Ukrainian hacker and attempted to facilitate the hacker’s escape to Russia. Investigators seized computers and cryptocurrency devices during a March 2026 raid and froze wallets tied to stolen data sales. The suspect is under investigation for alleged links to terrorist group membership, glorification of terrorism, and computer damage.

🔔 The U.S. Department of State is offering up to $10 million through its Rewards for Justice program for information identifying members of UNC5792 and UNC4221, two groups tied to Russian intelligence and military services. The bounty follows FBI and CISA updates that these groups conducted phishing campaigns targeting Signal and WhatsApp users, including attempts to steal Signal Backup Recovery Keys by impersonating support agents. Targets included U.S. and NATO officials, journalists, NGOs, and researchers.

🛡️ Four years into Russia’s invasion of Ukraine, the pro‑Russia influence ecosystem has shifted from wartime tools back toward a global strategic asset. GTIG observes expansion of covert information operations, revived hacktivism, and increasing use of generative AI across planning and content creation. The ecosystem blends state, state‑aligned, and independent actors, targeting the West, Russia’s near abroad, the Middle East, Africa, and domestic audiences while exploiting media mimicry, cyber‑enabled IO, and direct dissemination.