Loading story…
Researchers have identified REST Media, a newly launched online outlet, as a Russian disinformation operation linked to the Rybar group and targeting Moldova's upcoming elections. Technical evidence shows REST Media shares infrastructure and workflows with Rybar, and its content, distributed mainly via TikTok, X, and Telegram, amplifies anti-EU and anti-government narratives. Moldovan authorities have responded with raids and detentions, while experts warn of the evolving, technology-driven nature of these hybrid threats.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian state-backed cyber operations have intensified against Western democracies, with the United Kingdom and Moldova reporting significant hostile activities attributed to Kremlin-linked actors. In the UK, the former head of MI5, Baroness Manningham-Buller, publicly stated that the scale and nature of Russian cyberattacks, intelligence operations, and physical sabotage suggest the country may already be engaged in a form of warfare with Russia. She highlighted the extensive use of cyberattacks, intelligence collection, and physical attacks, referencing recent campaigns attributed to APT28, a group linked to Russia's GRU, which targeted Microsoft login credentials and passwords as part of espionage efforts. The UK's National Cyber Security Centre (NCSC) has issued warnings about these campaigns, noting that Russian hacking groups have focused on governments, technology firms, and logistics suppliers supporting Ukraine. These operations are not isolated, as Russian state-backed cyberattacks have targeted Western organizations for years, often in coordination with ransomware gangs and cybercriminals believed to have ties to Moscow's intelligence services. In Moldova, Deputy Prime Minister Doina Nistor accused Russia of orchestrating a cyberattack on the Central Electoral Commission ahead of parliamentary elections, describing it as part of a broader hybrid campaign to destabilize the country's democracy. The attack exploited a vulnerability that has since been secured, but officials warn that Moldova is being used as a testbed for Russian hybrid warfare tactics, including DDoS attacks via hijacked routers, AI-driven disinformation, and efforts to radicalize youth and orchestrate unrest. Moldovan authorities report that the scale of Russian interference now far exceeds previous years, with increased funding for vote-buying, more sophisticated disinformation campaigns, and greater resources dedicated to destabilizing the electoral process. These hybrid operations are seen as a warning for other Western democracies, with officials cautioning that successful tactics in Moldova could soon be deployed in upcoming elections across Europe and the United States. The overarching goal of these Russian operations is to manipulate public opinion, undermine trust in democratic institutions, and destabilize governments. Both the UK and Moldova have responded by strengthening cybersecurity measures and raising public awareness, but the persistent and evolving nature of Russian hybrid threats continues to pose a significant challenge to national security and democratic integrity across the West.
Jun 29, 2026
Researchers reported that the suspected Russia-aligned **Doppelgänger** influence operation ran a coordinated propaganda campaign against German audiences from at least late 2023, using a large network of coordinated X accounts, impersonated media brands, and custom-built websites to push anti-government and anti-Ukraine narratives. The messaging focused on politically sensitive issues including strikes, immigration, inflation, and elections, with the activity assessed as part of a broader effort to shape public opinion in Germany. The operation relied on multi-stage redirection infrastructure and evasive technical measures, including Base64-obfuscated JavaScript, tracking identifiers, rotating first-stage and second-stage domains, geofencing on destination sites, and infrastructure linked to **Keitaro** traffic distribution systems. SentinelLABS and ClearSky said the campaign’s tactics and infrastructure overlap with findings previously reported by the German Ministry of Foreign Affairs, *Der Spiegel*, Recorded Future, and Meta, underscoring a persistent influence effort tied to upcoming European, municipal, state, and federal elections in Germany.
Jun 29, 2026
A Russia-aligned influence operation known as **Operation Overload**—also tracked as **Matryoshka** and **Storm-1679**—has used fake news sites, bogus fact-checking resources, AI-generated audio, and impersonation of trusted media brands to shape narratives around the US presidential election. Researchers said the campaign has heavily targeted journalists, fact-checkers, and researchers with deceptive verification requests designed to draw false claims into mainstream reporting, while coordinated inauthentic social media activity amplified the same narratives directly to the public. The operation has sought to undermine trust in the election process, inflame fears of political violence, and exploit polarizing issues to deepen social divisions. Reported themes included fabricated scandal narratives aimed at **Vice President Kamala Harris**, attacks portraying Ukrainians and the **LGBTQIA+** community negatively, and messaging intended to weaken support for Ukraine; the campaign had also previously attempted similar interference around the French elections and the Paris Olympics and was expected to intensify as the US vote approached.
Jun 29, 2026