Russian authorities escalated restrictions on WhatsApp and Telegram, using network-level controls to disrupt access and steer users toward the Kremlin-promoted MAX messaging app. WhatsApp said Russia attempted to fully block the service, warning that isolating more than 100 million users from “private and secure communication” would reduce safety. Reporting indicated Roskomnadzor removed whatsapp.com and web.whatsapp.com from Russia’s National Domain Name System, effectively breaking domestic DNS resolution so the service becomes largely reachable only via VPNs or non-domestic resolvers; digital rights monitors also reported other major services being removed from the national domain registry.
Telegram also faced deliberate degradation: Roskomnadzor confirmed it “slowed down” the app, citing noncompliance with Russian law, amid widespread user-reported disruptions across multiple regions. State media reported Moscow courts opened multiple cases against Telegram in early 2026 for allegedly failing to remove content authorities label “extremist” or pornographic, with reported fines exceeding $820,000. Kremlin spokesperson Dmitry Peskov publicly tied restoration of access to compliance with Russian legislation, while Telegram founder Pavel Durov characterized the measures as authoritarian and aimed at forcing adoption of MAX, which he described as built for surveillance and censorship; Russia has a history of attempting to block Telegram, including a 2018 ban later lifted in 2020.

Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
12 events from the most recent confirmed update back to the earliest known activity.
Alongside WhatsApp, multiple major services including YouTube, Facebook, Instagram, Tor, BBC, Deutsche Welle, and The Moscow Times were reportedly removed from Russia's national domain registry, signaling a broader escalation in internet censorship.
WhatsApp said Russia moved beyond earlier throttling and tried to fully block the platform, with the Kremlin again citing noncompliance with Russian law and urging users to switch to MAX.
Roskomnadzor removed whatsapp.com and web.whatsapp.com from Russia's National Domain Name System, making the service largely accessible only through VPNs or external DNS resolvers.
Telegram founder Pavel Durov condemned the restrictions as authoritarian and said they were intended to drive users toward a state-controlled messaging alternative designed for surveillance and censorship.
After widespread user disruptions, Roskomnadzor confirmed it intentionally slowed Telegram, citing alleged violations of Russian law and content-removal requirements.
Since the start of 2026, a Moscow court opened seven cases against Telegram over alleged refusal to remove content labeled extremist or pornographic, with reported fines exceeding $820,000.
Authorities reportedly escalated pressure on WhatsApp by trying to prevent new user registrations in Russia.
A rule took effect requiring people entering Russia with foreign SIM cards to undergo a 24-hour mobile internet blackout, expanding the country's communications controls.
The government-backed MAX messaging app, developed by VK, became mandatory on devices sold in Russia, reinforcing the Kremlin's push toward a state-backed communications platform.
Russian authorities started progressively restricting WhatsApp by throttling voice and video calling functionality, marking an early stage of the later blockade effort.
Russia began broader internet disruption measures, including regional mobile internet shutdowns, as part of tightening control over communications.
Russia designated Meta an "extremist" organization and banned it in the country, a status later cited by the Kremlin to justify restrictions on WhatsApp.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
nrc.nl
Open sourcemeyka.com
Open sourcescworld.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.