Loading story…
Russian cybersecurity firm F6 says a previously undocumented espionage group it calls SiribClone has targeted Russian military personnel since at least summer 2025, using fake romantic interest and humanitarian-assistance pretexts on Telegram, messaging apps, and dating sites to collect battlefield-relevant intelligence. The operation sought personal data, correspondence, contacts, geolocation, device information, and access to victims’ Telegram accounts, with activity concentrated on servicemen in border regions and combat zones.
Researchers identified two malware families tied to the campaign: SafeLoveStealer for Android, spread through deceptive links and APK files such as Safeintim.apk, and SiribGrabber for Windows, delivered through .LNK files disguised as military-themed documents and later through an "Immortal Regiment" themed website serving malicious archives. F6 also found phishing infrastructure designed to steal Telegram sessionString tokens and an internal operator platform called Kontur used to store hijacked Telegram sessions, review intercepted messages, and track victim details; the company did not attribute the activity to a known threat actor or country.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
F6 reported that the previously undocumented espionage group SiribClone has targeted Russian military personnel since at least summer 2025 using social-engineering lures on Telegram and other platforms.
F6 publicly reported on the SiribClone operation, describing romance and humanitarian-assistance lures targeting Russian soldiers, the SafeLoveStealer Android spyware, the SiribGrabber desktop malware, Telegram credential theft infrastructure, and the internal 'Kontur' platform used to manage stolen Telegram sessions.
In May 2026, F6 observed a new SiribClone campaign using an 'Immortal Regiment' themed website to entice victims to download archives that deployed an updated SiribGrabber malware variant.
F6 observed attacks during January and February 2026 in which SiribClone used messengers and dating sites to phish Russian military personnel and deliver Android spyware and Windows malware.
According to F6, SiribClone began testing its malware tooling in December 2025 ahead of later observed attacks against Russian servicemen.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Threat Intelligence Group reported that suspected Russian operation **UNC5812** used a hybrid espionage-and-influence campaign to target potential Ukrainian military recruits through a Telegram persona and a website branded **"Civil Defense."** Promoted posts in legitimate Ukrainian-language Telegram channels lured users to actor-controlled infrastructure that pushed anti-mobilization narratives, solicited videos alleging abuse by Ukrainian recruitment centers, and amplified messaging aligned with broader pro-Russian influence networks. The operation also delivered malware to both Windows and Android users. Windows victims were led through a multi-stage infection chain involving **Pronsis Loader**—a JPHP-based malware family also documented by Trustwave as distinct from D3F@ck Loader—before deployment of **PURESTEALER**, while Android users were tricked into disabling **Google Play Protect** and granting permissions needed for **CRAXSRAT**; researchers also identified a decoy mapping application tracked as **SUNSPINNER**. Google said it added related files and infrastructure to **Safe Browsing**, relied on Play Protect protections, and shared findings with Ukrainian authorities, who blocked national resolution of the Civil Defense site.
Aug 14, 2026
Ukraine’s Security Service (**SBU**) said, in coordination with the **FBI**, it uncovered a long-running Russian campaign that used social engineering to compromise messaging accounts belonging to government officials, military personnel, politicians, activists, journalists, and other high-value targets in Ukraine, Europe, and the United States. According to Ukrainian and U.S. authorities, the attackers impersonated messaging-platform support teams in text and in-app messages, often contacting victims in the morning, and tricked them into handing over credentials and other sensitive account data to gain access to military, political, economic, and personal communications. The **FBI** and **CISA** separately warned that Russian intelligence-linked operators are specifically phishing **Signal Backup Recovery Keys**, allowing them to restore backups, read private and group message history, and take over accounts without breaking Signal’s encryption. The updated advisory said the broader operation has already compromised thousands of accounts worldwide and is tracked publicly as **`UNC5792`** and **`UNC4221`**, with links to multiple Russian intelligence services, including **FSB**-associated personnel and Russian military services. U.S. and allied agencies in the Netherlands, Germany, and France urged users to distrust messages claiming to be from Signal support, never share verification codes, PINs, or Recovery Keys, and review linked devices for unauthorized access.
Jul 29, 2026
Researchers and industry defenders linked the Iranian threat cluster tracked as **TA453**, **ITG18**, **Charming Kitten**, and **Phosphorus** to sustained espionage operations targeting people of intelligence interest, including Middle East policy experts, senior academics, journalists, and individuals aligned with Iran’s Reformist movement. Proofpoint said the actor used **Operation SpoofedScholars**, in which operators posed as UK academics, built trust through extended email exchanges, and then sent “registration” links to credential-harvesting pages hosted on a compromised **SOAS** website to steal email credentials across multiple identity providers. IBM Security X-Force reported the same broader cluster also deployed a custom Android surveillance backdoor, **LittleLooter**, disguised as `WhatsApp.apk`, and successfully compromised roughly 20 victims between August 2020 and May 2021, exfiltrating about **120 GB** of data with **Telegram** content prominently represented. The malware supported audio and video recording, message and contact theft, call and location collection, browser-history access, and remote file and connectivity management, while investigators also found repeated operational security failures, including open servers and exposed victim archives; Microsoft separately highlighted legal and technical steps to protect customers from nation-state hacking tied to Iranian operators.
Aug 15, 2026