Russian Hackers Archives

AppWizard

November 25, 2025

CISA alert draws attention to spyware’s targeting of messaging apps

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about the increasing threat of spyware targeting messaging applications, particularly on Android devices like Samsung. Cybercriminals are using social engineering techniques, including sending harmless-looking image files via WhatsApp, to install malicious software. Russian hackers have been reported to compromise Signal accounts. The alert highlights a focus on high-value individuals, including government officials and civil society members in the U.S., Middle East, and Europe. CISA has a history of issuing such alerts and provides cybersecurity guidance, including a "must-patch" list for federal agencies. Users are advised to be vigilant and follow mobile security guidelines, as threat groups are also using malicious QR codes and zero-click exploits to compromise devices.

Winsage

November 4, 2025

Russian hackers abuse Hyper-V to hide malware in Linux VMs

The Russian hacker group Curly COMrades has been using Microsoft Hyper-V to bypass endpoint detection and response (EDR) solutions by creating a concealed Alpine Linux-based virtual machine for running malware. They have deployed proprietary tools, CurlyShell and CurlCat, within this virtual environment to maintain operational stealth and secure communication. Active since mid-2024, the group targets government and judicial entities in Georgia and energy companies in Moldova. In early July, they gained remote access to two machines, activated Hyper-V, and disabled its management interface to deploy a minimalistic virtual machine that hosted their malware. This tactic allowed them to evade traditional host-based EDR detections. The virtual machine was configured to use the Default Switch network adapter, making malicious traffic appear to originate from the legitimate host's IP address. CurlyShell executes commands and maintains persistence, while CurlCat facilitates covert traffic tunneling. The group also utilized PowerShell scripts for persistence and pivoting to remote systems, including injecting Kerberos tickets into LSASS and creating local accounts via Group Policy. Bitdefender advises organizations to monitor for abnormal Hyper-V activation, LSASS access, and suspicious PowerShell scripts.

Winsage

November 4, 2025

Russian Hackers Abuse Hyper-V to Hide Malware and Evade Endpoint Detection

A Russian-linked hacking group, Curly COMrades, is using Microsoft’s Hyper-V to conceal malware within compromised Windows systems. They install a small Alpine Linux virtual machine (VM) to run custom malware, evading endpoint detection and response (EDR) software since July. The group exploits Hyper-V's native features, enabling it on victim systems while disabling management clients to avoid detection. The VM, named “WSL,” hosts two C++ tools: ‘CurlyShell,’ a reverse shell, and ‘CurlCat,’ a reverse proxy, both designed to maintain persistence and obfuscate their activities. The VM occupies only 120MB of disk space and uses Hyper-V’s Default Switch for network traffic, making malicious communication appear to originate from the legitimate host. Additionally, Curly COMrades employs malicious PowerShell scripts for persistence and lateral movement, including creating local user accounts and using a modified TicketInjector for authentication across networks.

Winsage

October 23, 2025

Russian hackers replace malware with new tools, Windows updates cause login issues, campaign targets high-profile servers

Mark your calendars for this Friday's Super Cyber Friday, featuring the session titled "Hacking the Death of EDR." Russian state-sponsored hacking group Coldriver has introduced three new malware strains: NOROBOT, YESROBOT, and MAYBEROBOT, following the exposure of their previous tool, LostKeys. The new malware is designed to evade detection and extract sensitive data from high-value targets. Microsoft has acknowledged that Windows updates released since August 29th are causing login failures on systems with duplicate Security Identifiers (SIDs), leading to authentication failures. Microsoft recommends rebuilding affected systems or contacting support for a temporary fix. Kaspersky researchers have identified a likely Chinese-speaking threat actor behind the “PassiveNeuron” campaign, targeting government, financial, and industrial servers across Asia, Africa, and Latin America since 2024, using custom implants and Cobalt Strike. CISA has added high-severity vulnerabilities in Oracle E-Business Suite, Microsoft Windows SMB Client, Kentico Xperience CMS, and Apple JavaScriptCore to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by November 10th. Researchers from France's CEA and Soitec have unveiled a new chip architecture called Fully Depleted Silicon-on-Insulator, designed to defend against laser fault injection attacks on automotive microcontrollers. During Pwn2Own Ireland 2025, researchers exploited 34 zero-days across various devices, earning a total of 2,500 in rewards, with Team DDOS chaining eight zero-days to compromise a QNAP router and NAS. Koi Security researchers discovered a new self-propagating malware named GlassWorm, which has infected approximately 36,000 developer systems by exploiting Visual Studio Code extensions, pilfering credentials, and installing remote access tools. PolarEdge is a botnet malware targeting Cisco, ASUS, QNAP, and Synology routers, first detected in February, which installs a TLS-based backdoor to fingerprint hosts and execute tasks while employing anti-analysis techniques.

AppWizard

August 23, 2025

Google Meet Struggles in Russia Amid Push for State-Controlled Max Messaging App

On August 22, Russian officials expressed concerns about potential restrictions on Google Meet, fearing that it could monitor Russian citizens and share sensitive information with Western intelligence. Andrey Svintsov highlighted the need for limitations on tracking applications. Users in Russia reported disruptions with Google Meet, but Roskomnadzor stated that no restrictions had been implemented. The increased use of Google Meet followed a government ban on voice and video calls in apps like Telegram and WhatsApp, while authorities promoted the Kremlin-backed messenger Max, set to be preinstalled on new smartphones from September 1. Max, launched by VKontakte in March 2025, aims to replace foreign messaging apps and is associated with extensive surveillance capabilities. A blacklist of targeted platforms is being developed following President Putin's pledge to restrict foreign digital services. Additionally, pro-Russian hackers executed a cyberattack on a hydropower plant in Poland's Pomeranian Voivodeship, marking the second attack on the facility in recent months.

TrendTechie

August 16, 2025

Labubu-охота на криптопользователей, опасные торренты с фильмами и другие события кибербезопасности

- A user lost 140 ETH (approximately ,500) on August 15 due to crypto address "poisoning," resulting in a total loss of over .6 million from similar incidents within a week. - Labubu fans in Russia fell victim to a cryptocurrency theft scheme involving a counterfeit marketplace that prompted users to connect their crypto wallets. - The Efimer Trojan malware, distributed through compromised WordPress sites and torrents, has been identified as a method for stealing cryptocurrency by replacing wallet addresses in the clipboard. - Pro-Russian hackers gained control of a dam in Norway, opening discharge valves and allowing over 7.2 million liters of water to pass through before being stopped. - A cybersecurity researcher discovered a vulnerability in a car dealer's online portal that allowed remote access to customer data and vehicle control. - Tajikistan reportedly lost over million due to illegal mining activities. - BtcTurk suspended withdrawals amid suspicious transactions totaling million. - Hackers extracted million in Bitcoin from the Odin.fun platform, and KYC data leaks have led to increased attacks on crypto investors.

Tech Optimizer

August 1, 2025

Microsoft says Russian hackers are planting fake antivirus software in embassy attacks

Recent findings from Microsoft Threat Intelligence indicate that Russian state hackers are targeting foreign embassies in Moscow using a sophisticated malware called ApolloShadow, which disguises itself as Kaspersky antivirus software. This malware installs a TLS root certificate, allowing hackers to impersonate trusted websites accessed by compromised systems within the embassies. The attacks are categorized as adversary-in-the-middle (AiTM) attacks, enabling hackers to intercept and manipulate communications. The group behind these attacks, known as Secret Blizzard, has a history of targeting Ukrainian military technology and has now expanded its operations to conduct cyber espionage within Russia. Diplomats using local ISPs or telecommunications services in Russia are considered likely targets for these activities, which may utilize Russia's domestic intercept systems like the System for Operative Investigative Activities (SORM).

Winsage

May 22, 2025

US and Europe crack down on hacking tool used by cybercriminals worldwide

US and European authorities have seized computer systems used by hackers to access a sophisticated hacking tool called Lumma, which has been involved in high-profile cybercrimes, including ransomware attacks and bank thefts. Microsoft took offline approximately 2,300 web domains linked to this activity. Around 394,000 computers worldwide running Windows software were found to be infected by Lumma, targeting various institutions, including airlines, universities, banks, and hospitals, resulting in credit card losses of .5 million in 2023. The primary developer of Lumma is based in Russia, where he markets the tool on platforms like Telegram, charging between [openai_gpt model="gpt-4o-mini" prompt="Summarize the content and extract only the fact described in the text bellow. The summary shall NOT include a title, introduction and conclusion. Text: US and European authorities have taken significant steps to dismantle a sophisticated hacking tool that has been instrumental in a series of high-profile cybercrimes, including ransomware attacks and bank thefts. On Wednesday, the US Justice Department announced the seizure of the computer systems utilized by hackers to access the tool, known as Lumma. Concurrently, Microsoft executed a court order to take offline approximately 2,300 web domains associated with this cybercriminal activity. Impact on Cybercrime This coordinated effort represents a substantial setback for a global hacking enterprise that has proliferated over the past two months. Microsoft reported discovering around 394,000 computers worldwide running Windows software infected by Lumma. The tool has been leveraged to target a range of institutions, from airlines and universities to banks and hospitals, with several Fortune 500 companies also falling victim. Brett Leatherman, the FBI’s deputy assistant director for cyber operations, revealed that Lumma-related attacks resulted in credit card losses totaling .5 million in 2023 alone. However, the crackdown faces challenges, particularly due to the involvement of Russian sovereignty. Analysts from Microsoft have identified the primary developer of Lumma as being based in Russia, where he markets various access levels to the tool on platforms like Telegram and other Russian-language forums, charging between 0 and ,000. The US has previously charged numerous Russian hackers with serious cyber offenses against American entities, yet only a fraction of these individuals have been brought to trial in the US. Russian diplomats have consistently opposed the extradition of accused cybercriminals, complicating efforts to hold them accountable. When asked whether the FBI believes Lumma’s lead developer is currently in Russia, Leatherman refrained from providing specific details, stating, “Regardless of where these individuals sit, even if we can’t charge them with criminal conduct, our victim-centric approach is really focused on targeting that underlying ecosystem … because it brings relief to victims.” The law enforcement operation was a collaborative effort involving Europol, several American and European tech firms, and a Japanese organization. This strategy underscores a growing trend in combating cybercrime, leveraging the extensive reach of software companies within the global economy. Leatherman emphasized the broader implications of this investigation, stating, “This is part of a greater law enforcement investigation into the group [behind Lumma], and we hope that this will also fracture trust within the ecosystem itself.”" max_tokens="3500" temperature="0.3" top_p="1.0" best_of="1" presence_penalty="0.1" frequency_penalty="frequency_penalty"] and ,000. The law enforcement operation involved Europol and several tech firms and aims to disrupt the ecosystem supporting cybercrime.

AppWizard

March 28, 2025

Was the Signal Chat Illegal?

Some Democrats are claiming that the unintentional inclusion of a journalist in a Trump administration group chat about a military operation in Yemen may be criminal, with legal experts suggesting it could breach the Espionage Act. The chat took place on Signal and involved high-ranking national security officials, including Defense Secretary Pete Hegseth, who reportedly shared details about imminent military strikes. The Department of Defense prohibits sharing non-public information through messaging apps, and the Pentagon later warned of vulnerabilities in Signal that could be exploited by Russian hackers. House Speaker Mike Johnson called the use of Signal a "mistake," while several Democrats, including Sen. Elizabeth Warren and Rep. Jim Himes, expressed outrage and called for accountability. Legal experts stated that the chat likely violated the Espionage Act due to potential gross negligence in handling sensitive information. Despite the serious implications, there is skepticism about any prosecution occurring against those involved. The use of Signal raises concerns regarding compliance with federal open-records laws, as messages can be automatically deleted.

AppWizard

March 27, 2025

What Is Signal, the App Used by Trump Staff, and Is It Safe?

The Trump administration is under scrutiny for officials using the messaging app Signal for discussions about sensitive military operations, revealed in an article by Jeffrey Goldberg on March 24. Secretary of Defense Pete Hegseth and others discussed military actions in Yemen via Signal, despite prior warnings from the U.S. government against using such applications for official communications. Democratic lawmakers, including Senator Chuck Schumer, are calling for an investigation into potential national security breaches. Signal, launched in 2014, emphasizes privacy through end-to-end encryption and has gained popularity among activists. However, its use in government contexts is contentious, with previous reprimands for non-compliance with federal record preservation requirements. Concerns have been raised about sharing sensitive information on Signal, although intelligence officials stated that no classified information was exchanged in the Trump officials' conversations. The Pentagon has warned military personnel about using Signal due to risks from Russian hackers, and experts suggest that government-specific communication tools would provide a higher level of security.