Loading story…
U.S. prosecutors unsealed an indictment accusing a Russian intelligence-linked RIS Network of directing surveillance, assassination, and sabotage operations across Europe and the United States. The alleged network recruited operatives to target Russian dissidents, offered payments for attacks on NATO-related electrical infrastructure in countries supporting Ukraine, and was linked to an attempted June 2024 arson attack on a Prague bus depot and a planned September 2024 attack in Lithuania. Five defendants—including former Russian intelligence colonel Yuri Khrameev, FSB officer Kirill Khrameev, and logistics coordinator Oemis Romagoza Durruthy—remain at large on U.S. terrorism-financing charges.
Separately, reporting indicates Russia-linked actors have approached participants in “The Com,” a largely Western online ecosystem containing violence-for-hire and cybercriminal subcommunities, to recruit young people as disposable agents for sabotage missions. Recruitment reportedly occurs through online platforms including Telegram and forms part of a broader hybrid campaign intended to weaken European backing for Ukraine; at least two UK attacks have reportedly been tied to Russia-linked actors. The reporting found no indication that Russian intelligence has recruited the distinct Hacker Com segment, despite activity in overlapping online spaces.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Andrés Alfonso de la Hoz de la Cruz, identified by Novinky.cz as the Prague arson attacker, reportedly pleaded guilty and was sentenced to eight years in prison for the attack.
Oemis Romagoza Durruthy allegedly continued logistical coordination for a separate attack in Lithuania on behalf of the RIS Network.
The alleged RIS Network was linked to an attempted arson at a Prague public-transport bus depot. Czech authorities arrested the alleged attacker, while logistics coordinator Oemis Romagoza Durruthy allegedly sent more than $1,000 in cryptocurrency and booked hotels for the operation.
Russia-linked actors reportedly contacted elements of The Com and sought to recruit teenagers as disposable agents for sabotage operations, amid a wave of European attacks linked to Russian recruitment activity. The reporting associated at least two attacks in the United Kingdom with Russia-linked actors, while stating there was no indication that Russian intelligence had approached the separate Hacker Com segment.
A newly unsealed U.S. federal indictment charged five alleged members of the Russian intelligence-linked RIS Network with conspiracy to finance terrorism. It alleged the network directed sabotage, surveillance, assassination, and murder-for-hire activity in Europe and the United States, including targeting infrastructure in countries supporting Ukraine.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcetruesec.com
Open sourceoccrp.org
Open sourceinews.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ukrainian government, military, banking, and energy targets were repeatedly disrupted by cyber operations tied to Russia and the war around Ukraine. Reports describe attacks on a Ukrainian power station, outages affecting the websites of Ukraine’s defense ministry and major banks, and broader disruptive activity against the country’s financial sector. The UK government later said technical analysis by the National Cyber Security Centre assessed that Russia’s **GRU** was almost certainly involved in the February 2022 distributed denial-of-service attacks on Ukrainian banking targets, framing the incidents as part of continued Russian aggression. The campaign also expanded beyond Ukraine through both state-linked and pro-Russian actors. **Killnet**, a Russia-aligned hacktivist group, claimed retaliatory **DDoS** attacks on Lithuanian government and business websites after restrictions affecting transit to Kaliningrad, while other reporting said Russian-backed actors continued destructive operations against Ukraine, including **wiper malware** and attempted power-grid attacks. At the same time, pro-Ukrainian hackers mounted hack-and-leak operations against Russian institutions, underscoring how the conflict evolved into a broader regional cyber confrontation affecting governments, critical infrastructure, and financial services.
Jun 29, 2026
The United Kingdom and European Union imposed their first joint cyber sanctions package against Russian state operators, proxy hackers, and influence actors, formally attributing an attempted attack on Poland’s energy grid to Russia’s FSB **Centre 16**. Officials said the failed operation could have cut electricity to as many as **500,000 people** during winter, and linked the same Russian cyber ecosystem to intrusions targeting water treatment facilities, government networks, defense organizations, and other critical infrastructure across Europe. The EU also publicly identified the FSB’s **16th Centre** as controlling several threat groups, including **Turla**, and cited a failed attack on Poland’s critical infrastructure. The sanctions cover **24 individuals and entities**, including GRU leaders **Vyacheslav Stafeyev**, **Ivan Senin**, and **Ivan Kasyanenko**, as well as **IMPULS**, which Western officials said helped GRU Unit 29155 recruit hackers and cyber specialists. The package also targets operators tied to **Lumma Stealer**, which UK authorities said has been used to harvest stolen credentials for espionage and affected at least **2,100 UK victims** in six months, and **10 people linked to Rybar LLC**, accused of supporting pro-Kremlin disinformation and election interference in Moldova and Armenia. France separately announced additional sanctions, released a technical report on Centre 16 activity, and said it would summon the Russian ambassador over ongoing cyber espionage and sabotage.
Jul 29, 2026
Western governments, investigators, and private-sector researchers have linked **Russia’s GRU**, including **Unit 26165** and other associated officers, to a broad campaign of cyber intrusions, destructive malware operations, and close-access hacking against political, diplomatic, and critical targets. Public reporting tied Unit 26165—also known as **Fancy Bear**—to the 2018 attempted compromise of the **OPCW** in The Hague, where Dutch authorities disrupted four Russian operatives allegedly equipped to target the organization’s Wi‑Fi network, and to earlier operations against anti-doping bodies and the device of **Yulia Skripal** using **`X-Agent`** malware. CrowdStrike previously attributed the intrusion into the **Democratic National Committee** to Russian actors associated with the same broader threat cluster. U.S., UK, and independent disclosures have expanded that picture by naming individual GRU officers and units allegedly involved in attacks on **Ukrainian critical infrastructure**, **France’s Macron campaign**, the **2018 Winter Olympics**, **NotPetya** victims, and reconnaissance that supported missile strikes on **Mariupol**, including the theatre attack. In 2020, the FBI publicized charges against six GRU officers for destructive malware and international cyberattacks, while Bellingcat used leaked Russian vehicle registration data to connect several indicted hackers to known GRU addresses tied to **Unit 74455** and related military intelligence infrastructure. The UK later imposed sanctions on multiple GRU units and 18 officers, describing the activity as part of a long-running Russian cyber and hybrid campaign against Ukraine, the UK, and other countries.
Aug 15, 2026