Loading story…
The U.S. Treasury imposed sweeping sanctions on Russia over malicious cyber activity, including measures against six Russian technology-sector entities accused of supporting the FSB, GRU, and SVR. Treasury said the action responded to a broader pattern of Russian operations, citing the SolarWinds compromise, NotPetya, Olympic Destroyer, election interference, attacks on Ukraine and Georgia, and support for criminal groups such as Evil Corp. The sanctions block property and interests in property of designated entities under U.S. jurisdiction and broadly prohibit U.S. persons from transacting with those parties, alongside new restrictions on certain Russian sovereign debt activity.
Separate reporting highlighted questionable security practices in the FSB’s own online communications system, which required visitors to download a Windows executable to submit encrypted messages. Researchers found the per-download program was flagged by about 20 antivirus engines and exhibited behaviors such as self-deletion, log erasure, dynamic builds, and use of GOST cryptography, though independent analysis said it did not appear to be outright malware. KrebsOnSecurity also found the FSB site relied on HTTP rather than HTTPS, and testing showed the tool contacted an IP address assigned to the FSB before enabling access to a contact form, underscoring operational concerns around Russian state security technology.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
On April 15, 2021, the U.S. Department of the Treasury announced sanctions under a new Executive Order targeting harmful activities by the Russian government, including malicious cyber operations. Treasury said the FSB cultivates and co-opts criminal hackers such as Evil Corp to enable ransomware attacks and phishing campaigns.
The FSB recently launched a Tor-accessible website that allows users to make contact without downloading the disputed Windows executable. This provided an alternative to the software-based secure contact workflow described in the reporting.
KrebsOnSecurity installed the FSB software in an isolated environment and observed it connecting to an IP address assigned to the FSB before enabling access to a secure contact form. Krebs then used the form to ask the FSB about the antivirus detections but received no reply.
Lance James of Unit221B analyzed the FSB software and concluded it did not appear to exhibit outright trojan behavior, though it used one-time executables, self-deletion, GOST cryptography, and log-erasing routines that could resemble ransomware-like behavior to antivirus engines. He also created a benign GOST-based test program that was flagged by multiple antivirus products, supporting the possibility of false positives.
Vladislav "BadB" Horohorin published a blog post warning that the FSB's required "random number generation" client for secure website communications was flagged as malicious by about 20 antivirus and security products. His post prompted further scrutiny of the software's behavior and detections on VirusTotal.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 26 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
krebsonsecurity.com
Open sourcehome.treasury.gov
Open sourcehome.treasury.gov
Open sourcewashingtonpost.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities unsealed indictments against three **FSB** officers and one **TsNIIKhM** employee over long-running Russian state-sponsored cyber campaigns that penetrated energy-sector organizations and, in one case, deployed **TRITON** malware against a foreign oil refinery’s safety systems, forcing a shutdown. A joint **CISA**, **FBI**, and **DOE** advisory said the operations spanned 2011 to 2018 and included the **Havex** malware campaign, remote access to energy networks, theft of enterprise and ICS-related data, and activity consistent with operational preparation against critical infrastructure. Separate reporting and industry analysis tied related Russian-linked activity to **Energetic Bear**/**Dragonfly**/**TEMP.Isotope**, a cluster associated with intrusions into U.S. state and local government networks and earlier compromises of electric utilities and other critical infrastructure. Officials said some election-support IT systems were accessed in limited cases, but there was no evidence that vote tabulation systems, voting machines, or election data integrity were affected; defenders were urged to strengthen **IT/ICS segmentation**, apply patches, enforce **MFA**, restrict remote access, and follow established industrial control system guidance such as **NIST SP 800-82**.
Aug 15, 2026
U.S. officials stepped up warnings and coordination with industry over potential Russian cyberattacks tied to the Ukraine crisis, urging organizations to report signs of reconnaissance, exploitation testing, malware development, and compromises involving industrial control systems. The FBI, CISA, DHS, NSA, Treasury, Energy Department, and allied partners increased intelligence sharing and defensive preparations as officials cited the risk that destructive activity already hitting Ukrainian entities could spill over to U.S. and foreign companies with operations in Ukraine, particularly across **energy, healthcare, finance, and other critical infrastructure** sectors. The concern was grounded in a documented history of Russian operations against operational technology and the energy sector. Prior U.S. government reporting detailed campaigns targeting critical infrastructure, while Treasury sanctioned a Russian state research institution linked to the **Triton/Trisis** malware used against Schneider Electric safety systems. The Justice Department later charged four Russian government-linked individuals over the **Triton/Trisis** and **Dragonfly/Havex** campaigns, alleging long-running efforts to compromise **SCADA** and industrial control environments at hundreds of organizations in roughly 135 countries to enable future disruption or physical damage.
Aug 15, 2026
The UK National Cyber Security Centre, FBI, NSA, and CISA warned that Russia’s Foreign Intelligence Service (**SVR**), also tracked as **APT29** and **Nobelium**, is running a broad cyber-espionage campaign that combines mass exploitation of known vulnerabilities with targeted intrusions against governments, diplomats, think tanks, technology firms, financial institutions, and cloud environments. Officials said the group scans the internet for unpatched systems and exploits long-known perimeter flaws including `CVE-2019-19781`, `CVE-2019-11510`, `CVE-2018-13379`, and `CVE-2020-5902`, then uses compromised accounts to move deeper into victim networks and, in some cases, into connected supply chains. The campaign builds on tradecraft previously tied to the **SolarWinds Orion** compromise and later phishing and cloud-focused operations attributed to the SVR. U.S. and allied advisories said the service has shifted toward stealthier methods such as password spraying, abuse of mailbox and cloud permissions, temporary email infrastructure, and reduced reliance on custom malware, though earlier operations also used tools such as **SUNBURST**, **TEARDROP**, **Cobalt Strike Beacon**, and **WELLMESS**. Microsoft separately reported that Nobelium targeted thousands of accounts across hundreds of organizations in a focused espionage effort, while defenders were urged to prioritize patching internet-facing systems, enforce multi-factor authentication, audit identity and mailbox permissions, and investigate signs of lateral movement and account abuse.
Aug 15, 2026