Region: russia-cis
11 entries covering the russia-cis region, latest activity first.
- NightEagle (APT-Q-95) pivots to Russian targets, tunnels RDP through Microsoft's own legitimate dev-tunnels service, and attempts DCSync against Active Directory
- GTG-27005: Anthropic discloses a freelance Russia-based team that used Claude Code to engineer an autonomous FPV kamikaze-drone-swarm targeting stack with no human veto over target selection or detonation
- GenieLocker; a Windows and ESXi ransomware built to leave no ransom note on disk, gated behind a hashed command-line secret so it will not run in a sandbox
- OctLurk and SilkLurk, sibling plugin backdoors whose loaders key their payload decryption to the victim machine itself, deployed against Central Asian and Syrian government bodies
- CERT-UA: Sandworm subcluster UAC-0145 pairs ClickFix fake-CAPTCHA with Ethereum-smart-contract C2 resolution and a Signal-delivered Android backdoor
- Kaspersky: the HelloNet campaign blinds user-mode security tools by hooking raw AFD IOCTLs, persisting via DLL-sideload into a secure-network product's own auto-updater
- Armored Likho: new APT hits government and electric-power targets with an AI-generated loader and the Python 'BusySnake' stealer
- Citizen Lab: Cellebrite UFED used by Russian authorities three months after the vendor's Russia pull-out
- Year-old WinRAR flaw (CVE-2025-8088) still fuels Ukraine intrusions, GIFTEDCROOK via UAC-0226 and an Earth Dahu chain
- Sekoia consolidates Gamaredon tooling under GammaPhish / GammaWorm, details an NTFS-ADS USB+network worm
- Lithuania's Centre of Registers loses ~600,000 state-register records to abused institutional credentials; foreign-state actor suspected