Russia has blocked access to the Roblox platform citing the distribution of LGBT "propaganda" as the reason. This action is a government-imposed restriction rather than a direct cybersecurity threat or vulnerability affecting the Roblox platform or its users. There is no indication of exploitation, malware, or technical compromise involved. The event reflects geopolitical and regulatory censorship impacting access to online services. European organizations are indirectly affected mainly through potential disruptions in user access and content availability. No technical vulnerabilities or exploits have been reported in connection with this event. The block may influence companies relying on Roblox for marketing, education, or community engagement within Russia. The situation underscores the importance of monitoring geopolitical risks and regulatory environments. Defenders should focus on understanding regional access restrictions and preparing for potential service disruptions. This is not a cybersecurity threat in the traditional sense but a political and regulatory action affecting service availability.
A campaign targeting Russian corporate entities, particularly HR, payroll, and administrative departments, has been uncovered. The attack uses realistic decoy documents themed around employee bonuses and financial policies. The malware ecosystem involves a malicious LNK file leading to an implant dubbed DUPERUNNER, which then loads the AdaptixC2 Beacon to connect to the threat actor's infrastructure. The infection chain begins with a spear-phishing ZIP archive containing PDF-themed LNK files. The DUPERUNNER implant, programmed in C++, performs various functions including downloading and opening decoy PDFs, process enumeration, and shellcode injection. The final stage involves the AdaptixC2 Beacon, which communicates with the command-and-control server. The campaign, tracked as UNG0902, uses multiple malicious infrastructures and is believed to be targeting employees of various organizations.
The Bloody Wolf threat actor group has expanded its use of a Java-based NetSupport Remote Access Trojan (RAT) targeting entities in Kyrgyzstan and Uzbekistan. This campaign leverages the NetSupport RAT, a legitimate remote administration tool often abused by attackers for espionage and data exfiltration. Although no specific affected software versions or exploits are detailed, the high severity rating indicates significant risk. The attacks focus on Central Asian countries but could have implications for European organizations with ties to the region or using similar RAT infrastructure. The threat involves remote access capabilities that can compromise confidentiality, integrity, and availability of targeted systems without requiring user interaction once deployed. Defenders should prioritize detection of NetSupport RAT activity, implement strict Java application controls, and monitor network traffic for suspicious remote administration connections. Given the geopolitical context and the nature of the RAT, Eastern European countries with strategic interests in Central Asia may be at increased risk. The threat is assessed as high severity due to the potential for extensive espionage and operational disruption, ease of RAT deployment, and broad impact on targeted organizations.
Kaspersky researchers uncovered new malicious operations by the Tomiris threat actor targeting foreign ministries, intergovernmental organizations, and government entities. The attacks, which began in early 2025, show a shift in tactics with increased use of implants leveraging public services like Telegram and Discord as command-and-control servers. The group employs various programming languages including Go, Rust, C/C#/C++, and Python to develop reverse shell tools. Some infections lead to the deployment of open-source post-exploitation frameworks such as Havoc and AdaptixC2. The campaign primarily focuses on Russian-speaking users and entities, with additional targets in Central Asian countries.
APT31, a Chinese cyber espionage group, is actively targeting the Russian IT sector, especially government contractors, using advanced malware and stealthy tactics. They leverage cloud services for command and control, deploy new malware families like AufTime, COFFProxy, VtChatter, YaLeak, CloudyLoader, and OneDriveDoor, and use prepared scripts for lateral movement. Their operations are timed to exploit organizational workflows, such as holidays, enabling prolonged undetected presence. The group employs multiple persistence, credential access, and data exfiltration techniques, evolving their toolkit while retaining older tools to maintain stealth. Although primarily focused on Russia, the sophistication and targeting of government contractors pose risks to European organizations with similar profiles. Mitigation requires tailored detection of cloud-based C2, monitoring lateral movement scripts, and enhanced credential security. Countries with significant IT sectors supporting government contracts and geopolitical interest in Russia-China dynamics are most at risk. The threat is assessed as high severity due to its espionage nature, stealth, and potential for long-term data compromise without requiring user interaction or known exploits in the wild.
A hacking group named NetMedved has been conducting phishing attacks against Russian organizations since October 2025. The campaign uses malicious LNK files disguised as business documents to deliver NetSupport RAT malware. The attackers employ various techniques including PowerShell scripts, finger protocol, and anti-analysis checks. They utilize multiple domains for payload delivery and command and control. The group's infrastructure overlaps with previous campaigns from 2024, suggesting an evolution of tactics rather than a new actor. NetMedved's operations involve social engineering, custom obfuscation, and abuse of legitimate tools to evade detection and maintain persistence on compromised systems.
A Russian government organization was targeted by the Cavalry Werewolf hacker group, aiming to collect confidential information and network data. The attack began with phishing emails containing malware disguised as documents. The group utilized various tools including backdoors, trojans, and modified legitimate programs. They employed open-source software, reverse-shell backdoors, and Telegram API for control. The attackers focused on information gathering, network configuration, and establishing persistence in compromised systems. Their tactics included using Windows built-in tools, modifying the registry, and exploiting public directories for malware deployment. The group's sophisticated approach and diverse toolset highlight the evolving threat landscape for government institutions.
The Silent Lynx APT group has been conducting espionage campaigns targeting diplomatic entities and critical infrastructure in Central Asia, Russia, and China. Two major campaigns were identified: one focused on Russia-Azerbaijan relations and another on China-Central Asia relations. The group used various malware tools including PowerShell scripts, .NET implants, and C++ reverse shells. They leveraged spear-phishing emails with malicious attachments and GitHub-hosted payloads. Key targets included government think-tanks, diplomats, and entities in mining, transport and communication industries. The campaigns coincided with important summits and meetings between the targeted countries. Attribution was based on similarities in tactics, tools, and victimology to previous Silent Lynx operations.
The Meduza Stealer is a malware strain linked to data theft activities. Recently, Russian authorities arrested developers associated with this malware following a government-targeted cyberattack. Although the malware itself is not newly discovered and no active exploits are currently reported, the arrests indicate ongoing law enforcement actions against cybercriminal infrastructure. The threat primarily involves information theft, potentially compromising confidentiality of targeted systems. There is no detailed technical information about the malware's infection vectors or capabilities in the provided data. European organizations could be indirectly impacted if the malware or its variants are used against entities within Europe or if geopolitical tensions escalate cyber operations. Mitigation should focus on robust endpoint protection, network monitoring for data exfiltration, and collaboration with law enforcement for threat intelligence sharing. Countries with higher exposure to Russian cyber activities or significant governmental and critical infrastructure sectors are more likely to be affected. Given the medium severity and lack of active exploitation, the threat is assessed as medium severity overall.
The APT group Cloud Atlas has launched a new wave of cyberattacks targeting Russia's defense industry. They are using stolen document templates from previously infected organizations to create malicious Microsoft Office files. The group cleans metadata from these documents to avoid revealing compromised entities. They move between targeted companies using compromised email accounts (BEC attacks). The attacks focus on defense industry enterprises, with malicious documents disguised as invitations, anti-corruption checks, mobilization documents, employee records, and financial statements. Cloud Atlas uses Google Sheets API for data exfiltration and employs the PowerShower backdoor. The group's infrastructure has migrated to new servers and domains, indicating ongoing campaign development.
LeetAgent is a malware tool used by the ForumTroll APT group, which exploited a zero-day Chrome vulnerability to infect Russian organizations. The same tools were also used to distribute Dante, a sophisticated commercial spyware developed by Memento Labs (formerly HackingTeam). Dante features modular encrypted components and self-destructs if inactive. The attacks targeted media, government, educational, and financial sectors primarily in Russia and Belarus. No known exploits are currently active in the wild beyond these campaigns. Detection has been achieved through advanced XDR solutions, and threat intelligence is available via Kaspersky’s APT data service. European organizations face risks mainly if targeted by similar threat actors or if they share infrastructure or partnerships with affected regions. Mitigation requires patching browsers, monitoring for indicators of compromise, and employing advanced detection tools. Given the malware’s sophistication, modularity, and use of zero-days, the threat severity is assessed as high.
This report discusses a technique to tunnel WireGuard VPN traffic over HTTPS using Wstunnel to bypass network restrictions that block VPN protocols including WireGuard. The method leverages HTTPS, which is less frequently blocked, to encapsulate WireGuard packets, enabling VPN connectivity in restrictive environments. While not a vulnerability or exploit, this technique can be used by threat actors to evade detection or censorship. There are no known exploits in the wild associated with this method, and it primarily represents a network evasion tactic rather than a direct security threat. European organizations may face challenges if their network monitoring or filtering relies on blocking VPN protocols, as this tunneling approach can circumvent such controls. Mitigation requires advanced network inspection capabilities and policy adjustments to detect tunneled VPN traffic over HTTPS. Countries with high VPN usage and strict network controls, such as Russia and Belarus, or those with advanced cybersecurity monitoring, like Germany and France, are more likely to be impacted. Given the medium severity assigned and the nature of the technique, the overall threat level is medium, reflecting moderate risk due to potential evasion of network defenses without direct exploitation of vulnerabilities.
A spear-phishing campaign targeting the Russian Automobile-Commerce industry using a malicious.NET implant has been uncovered by Seqrite Labs Research Team and is now being investigated by the FBI.
Forescout honeypot caught hacktivist activity targeting a decoy water treatment plant in Sept.2025. A Russian-aligned group, TwoNet, claimed responsibility for the attack. The group logged into the human-machine interface (HMI) for: defacement, process disruption, manipulation, and evasion.
ClayRat is an Android spyware campaign primarily targeting Russian users by masquerading as popular apps distributed through Telegram channels and phishing sites. It exfiltrates SMS, call logs, notifications, device info, takes photos, and sends SMS messages. The malware spreads aggressively by sending malicious links to victims' contacts, leveraging Android's default SMS handler role to bypass permission prompts. Over 600 samples and 50 droppers have been observed in three months, with continuous obfuscation improvements. The campaign uses impersonation, community distribution, UX deception, and self-propagation via SMS forwarding. While currently focused on Russia, the techniques and propagation methods pose risks to European organizations with Android users. No known exploits are publicly reported, and the campaign requires user interaction to install and propagate. Suggested severity is medium due to its impact on confidentiality and propagation capabilities but limited to targeted regions and requiring user action.
New "Cavalry Werewolf" Attack Hits Russian Agencies with FoalShell and StallionRAT
Source: https://thehackernews.com/2025/10/new-cavalry-werewolf-attack-hits.html
Cavalry Werewolf, a malicious actor group, targeted Russian state agencies and enterprises in the energy, mining, and manufacturing sectors from May to August 2025. The attackers used targeted phishing emails, posing as Kyrgyz government officials, to gain initial access. They employed custom malware, including FoalShell reverse shells and StallionRAT, controlled via Telegram. The group impersonated or compromised real email accounts from Kyrgyz agencies. Their arsenal includes various versions of FoalShell (Go, C++, C#) and StallionRAT (Go, PowerShell, Python). The attackers executed commands for system reconnaissance, file uploads, and SOCKS5 proxying. Evidence suggests potential expansion to targets in Tajikistan and Middle Eastern countries.
A new multi-stage ClickFix campaign, attributed to the Russia-linked APT group COLDRIVER, has been discovered targeting Russian civil society members. The campaign employs social engineering techniques to trick users into executing malicious commands, leading to the deployment of two new malware families: BAITSWITCH (a downloader) and SIMPLEFIX (a PowerShell-based backdoor). The attack chain involves a fake Cloudflare Turnstile checkbox, persistence establishment, and data exfiltration. COLDRIVER's tactics include using server-side checks, obfuscation techniques, and targeting specific file types for intelligence collection. The group's focus on NGOs, human rights defenders, and Russian exiles aligns with their known victimology.
A Technical Analysis on How a Chinese Company is Exporting The Great Firewall to Autocratic Regimes
Source: https://interseclab.org/wp-content/uploads/2025/09/The-Internet-Coup_September2025.pdf
