Normal view

Received today — 13 December 2025

Kim Jong-un admits North Korean troops clearing landmines for Russia

13 December 2025 at 00:17

Leader praises his soldiers for turning ‘danger zone into a safe one’ during ceremony in Pyongyang welcoming them back from Ukraine war

North Korea sent troops to clear mines in Russia’s Kursk region earlier this year, leader Kim Jong-un said in a speech carried on Saturday by state media, a rare acknowledgement by Pyongyang of the deadly tasks assigned to its deployed soldiers.

According to South Korean and western intelligence agencies, North Korea has sent thousands of troops to support Russia’s nearly four-year invasion of Ukraine.

Continue reading...

© Photograph: KCNA VIA KNS/AFP/Getty Images

© Photograph: KCNA VIA KNS/AFP/Getty Images

© Photograph: KCNA VIA KNS/AFP/Getty Images

Received yesterday — 12 December 2025

EU to freeze €210bn in Russian assets indefinitely

12 December 2025 at 15:18

The decision is a significant step towards using the cash to aid Ukraine’s defence – but Moscow is threatening to retaliate

The EU has agreed to indefinitely freeze Russia’s sovereign assets in the bloc, as Moscow stepped up its threats to retaliate against Euroclear, the keeper of most of the Kremlin’s immobilised money.

The decision by the EU to use emergency powers to immobilise €210bn (£185bn) of Russia’s central bank’s assets marks a significant step towards using the cash to aid Ukraine’s defence.

Continue reading...

© Photograph: Sergei Ilnitsky/EPA

© Photograph: Sergei Ilnitsky/EPA

© Photograph: Sergei Ilnitsky/EPA

The week around the world in 20 pictures

12 December 2025 at 14:35

Russian airstrikes on Kyiv, floods in Indonesia, the IDF in Gaza and the Nutcracker in Nairobi: the past seven days as captured by the world’s leading photojournalists

Continue reading...

© Photograph: Eyad Baba/AFP/Getty Images

© Photograph: Eyad Baba/AFP/Getty Images

© Photograph: Eyad Baba/AFP/Getty Images

Ukrainians sue US chip firms for powering Russian drones, missiles

12 December 2025 at 14:49

Dozens of Ukrainian civilians filed a series of lawsuits in Texas this week, accusing some of the biggest US chip firms of negligently failing to track chips that evaded export curbs. Those chips were ultimately used to power Russian and Iranian weapon systems, causing wrongful deaths last year.

Their complaints alleged that for years, Texas Instruments (TI), AMD, and Intel have ignored public reporting, government warnings, and shareholder pressure to do more to track final destinations of chips and shut down shady distribution channels diverting chips to sanctioned actors in Russia and Iran.

Putting profits over human lives, tech firms continued using “high-risk” channels, Ukrainian civilians’ legal team alleged in a press statement, without ever strengthening controls.

Read full article

Comments

© NurPhoto / Contributor | NurPhoto

The importance of Europe in curbing Russia’s might | Letters

12 December 2025 at 12:58

Europe must realise its superior economic and military potential has to be mobilised, writes Bill Jones, while Robin Wilson addresses Belgium’s resistance to seizing Russian assets

I wholly support the plea to Europe by Timothy Garton Ash (Only Europe can save Ukraine from Putin and Trump – but will it?, 6 December). One aspect he did not mention was the strategic nuclear balance. Since the late 1940s, responsibility for deterrence has always lain with the Pentagon and has succeeded in keeping the peace, though at times a very fragile version of it.

The recent US statement on defence makes it clear that Europe is no longer seen as a priority by the Trump administration, the danger now being that doubt is crucially being raised as to the credibility of Nato’s deterrent. Without certainty of a reaction in kind, Russia, under its ambitious and risk-taking president, might be tempted to chance its arm in what almost looks like a ceding of Europe by the US into a Russian “sphere of influence”.

Continue reading...

© Photograph: Adrian Dennis/EPA

© Photograph: Adrian Dennis/EPA

© Photograph: Adrian Dennis/EPA

Donald Trump is pursuing regime change – in Europe | Jonathan Freedland

12 December 2025 at 12:36

The US made it clear this week that it plans to help the parties of the European far right gain power. Keir Starmer and his fellow leaders have to face this new reality

When are we going to get the message? I joked a few months back that, when it comes to Donald Trump, Europe needs to learn from Sex and the City’s Miranda Hobbes and realise that “He’s just not that into you”. After this past week, it’s clear that understates the problem. Trump’s America is not merely indifferent to Europe – it’s positively hostile to it. That has enormous implications for the continent and for Britain, which too many of our leaders still refuse to face.

The depth of US hostility was revealed most explicitly in the new US national security strategy, or NSS, a 29-page document that serves as a formal statement of the foreign policy of the second Trump administration. There is much there to lament, starting with the sceptical quote marks that appear around the sole reference to “climate change”, but the most striking passages are those that take aim at Europe.

Jonathan Freedland is a Guardian columnist

Do you have an opinion on the issues raised in this article? If you would like to submit a response of up to 300 words by email to be considered for publication in our letters section, please click here.

Continue reading...

© Photograph: Andrew Caballero-Reynolds/AFP/Getty Images

© Photograph: Andrew Caballero-Reynolds/AFP/Getty Images

© Photograph: Andrew Caballero-Reynolds/AFP/Getty Images

Russian ambassador summoned to Berlin over claims Kremlin is seeking to destabilise Germany – Europe live

12 December 2025 at 07:54

Foreign ministry says there has been ‘significant increase in Russian hybrid activities’ and government will decide on further diplomatic measures later

Russia’s central bank said it was suing the Belgium-based Euroclear financial group, which holds Moscow’s frozen international reserves, as the EU moves closer to using the funds to support Ukraine, AFP reported.

The bank said it was filing “a lawsuit against Euroclear in the Moscow Arbitration Court” due to what it called “the illegal actions” of the institution.

Continue reading...

© Photograph: dts News Agency Germany/Shutterstock

© Photograph: dts News Agency Germany/Shutterstock

© Photograph: dts News Agency Germany/Shutterstock

Received before yesterday

US wants Ukraine to withdraw from Donbas and create ‘free economic zone’, says Zelenskyy

11 December 2025 at 15:20

Ukrainian president says plan would not be fair without guarantees that Russia would not simply take over zone

The US wants Ukraine to withdraw its troops from the Donbas region, and Washington would then create a “free economic zone” in the parts Kyiv currently controls, Volodymyr Zelenskyy has said.

Previously, the US had suggested Kyiv should hand over the parts of Donbas it still controlled to Russia, but the Ukrainian president said on Thursday that Washington had now suggested a compromise version in which Ukrainian troops would withdraw, but Russian troops would not advance into the territory.

Continue reading...

© Photograph: Wiktor Szymanowicz/Future Publishing/Getty Images

© Photograph: Wiktor Szymanowicz/Future Publishing/Getty Images

© Photograph: Wiktor Szymanowicz/Future Publishing/Getty Images

‘She was very, very thin’: witness tells of Ukrainian journalist’s final days in Russian prison

Soldier’s account corroborates reports Viktoriia Roshchyna was taken to prison deep inside Russia, where it is believed she died

Details of the last days in captivity of the Ukrainian journalist Viktoriia Roshchyna, who died last year, have emerged with the witness account of a soldier who was with her when she was transported to a prison deep inside Russia.

Roshchyna was seized while reporting from behind enemy lines in occupied Ukraine in the summer of 2022, one of an estimated 16,000 civilians detained by Russia since the beginning of the full-scale invasion.

Continue reading...

© Photograph: Global Images Ukraine/Getty Images

© Photograph: Global Images Ukraine/Getty Images

© Photograph: Global Images Ukraine/Getty Images

Trump says he ‘discussed Ukraine in pretty strong words’ with European leaders – Europe live

11 December 2025 at 03:39

US president says Europeans pushing for meeting as ‘Coalition of Willing’ due to hold call about war

In other news, we will also hear from Nobel peace prize winner María Corina Machado later today, as she arrived in Oslo overnight after a truly incredible trip from Venezuela.

The Wall Street Journal reported on the details of the operation to get her out of the country and over to Norway, describing how she “slipped through 10 military checkpoints to reach a fishing boat bound for Curaçao and a private jet headed to Norway,” where she met members of her family for the first time in almost two years.

Continue reading...

© Photograph: Xinhua/Shutterstock

© Photograph: Xinhua/Shutterstock

© Photograph: Xinhua/Shutterstock

‘It’s not going to be some miraculous recovery’: film charts healing of Ukrainian children rescued from Russia

11 December 2025 at 00:00

Director of After the Rain, set in animal therapy retreat, says she aimed to portray ‘children as children, not as a statistic’

Sasha Mezhevoy was five years old when she, her older brother and sister were sent to an orphanage in Moscow. They were told they were going to be adopted by a Russian family. But they were not orphans. They were Ukrainian children who had been forcibly removed from their father.

Sasha grew up in Mariupol, the port city that endured more than 80 days of bombardment in one of the bloodiest and most destructive chapters of the early months of Russia’s full-scale invasion.

Continue reading...

© Photograph: Denis Sinyakov

© Photograph: Denis Sinyakov

© Photograph: Denis Sinyakov

US House passes bill to bolster Europe’s defence, in apparent rebuke to Trump’s foreign policy strategy

10 December 2025 at 20:48

The 2026 National Defense Authorization Act (NDAA) carries $8bn more than the funding Trump requested in May

The US House has approved a sweeping defence bill that bolsters Europe’s security, in what appears to be sharp rebuke to Donald Trump’s mounting threats to downgrade Washington’s ties to traditional allies and Nato.

The bipartisan vote came just days after the publication of a White House national security strategy that said Europe faced “civilisational erasure” and made explicit Washington’s support for Europe’s nationalist far-right parties – rattling EU leaders and opening up a seismic shift in transatlantic relations.

Continue reading...

© Photograph: Petras Malūkas/AFP/Getty Images

© Photograph: Petras Malūkas/AFP/Getty Images

© Photograph: Petras Malūkas/AFP/Getty Images

Ukraine war briefing: Kyiv’s SBU cripples shadow fleet tanker in Black Sea

Third sea drone strike in two weeks on Russian vessels; ‘coalition of the willing’ convenes as US continues chaotic peace efforts. What we know on day 1,387

Continue reading...

© Photograph: Shared By Security Service Official/Reuters

© Photograph: Shared By Security Service Official/Reuters

© Photograph: Shared By Security Service Official/Reuters

Trump has confirmed Europeans’ worst fears. Are their leaders ready to stand up to him now?

10 December 2025 at 10:30

The White House has formalised its contempt for ‘decaying’ Europe with an ominous plan to undermine the EU and boost the far right

Almost half of EU citizens regard Donald Trump as an enemy of Europe, a new survey across nine countries revealed last week. The poll, conducted for the French debate platform Le Grand Continent, found that across Europe, Trumpism is considered “a hostile force”.

The new US foreign policy doctrine published by the White House on Friday will have heightened these respondents’ worst fears. The 30-page National Security Strategy landed like a bombshell in Europe. And citizens may have been out in front of their political leaders in figuring out what Trump’s worldview could mean for Europeans.

Continue reading...

© Photograph: Jonathan Ernst/Reuters

© Photograph: Jonathan Ernst/Reuters

© Photograph: Jonathan Ernst/Reuters

Ukraine war: Trump criticises European leaders on eve of crunch coalition meeting

10 December 2025 at 13:44

President says there were ‘strong words’ in latest call, as Volodymyr Zelenskyy to join other European leaders to discuss peace plan on Thursday

Leaders of the “coalition of the willing” group of nations will hold a video call about the Ukraine war on Thursday as Donald Trump voiced impatience with European allies and put US involvement in further talks in doubt, saying they risked “wasting time”.

Amid chaotic American efforts to push through a peace deal, the US president said on Wednesday night: “We discussed Ukraine in pretty strong words”, when asked about an earlier phone call with British prime minister Keir Starmer, French President Emmanuel Macron and Germany’s Chancellor Friedrich Merz

Continue reading...

© Photograph: ABACA/Shutterstock

© Photograph: ABACA/Shutterstock

© Photograph: ABACA/Shutterstock

British paratrooper killed in Ukraine was observing defensive capability test

10 December 2025 at 09:32

Keir Starmer pays tribute to George Hooley, 28, and says soldier died in ‘tragic accident away from front lines’

A soldier killed in Ukraine as he watched the testing of a new defensive capability was a 28-year-old paratrooper.

The “tragic accident” happened on Tuesday morning when lance corporal George Hooley was with Ukrainian military counterparts.

Continue reading...

© Photograph: James Veysey/REX/Shutterstock

© Photograph: James Veysey/REX/Shutterstock

© Photograph: James Veysey/REX/Shutterstock

Zelenskyy ‘ready for elections’ after Trump questions Ukrainian democracy

9 December 2025 at 17:09

Zelenskyy says he would hold wartime elections within months given help from allies and Ukraine’s parliament

Volodymyr Zelenskyy has said he is ready to hold a wartime election within the next three months, if Ukraine’s parliament and foreign allies will allow it, after Donald Trump accused him of clinging on to power.

Zelenskyy, clearly irritated by Trump’s intervention, said that “this is a question for the people of Ukraine, not people from other states, with all due respect to our partners”.

Continue reading...

© Photograph: Tayfun Salcı/ZUMA Press Wire/Shutterstock

© Photograph: Tayfun Salcı/ZUMA Press Wire/Shutterstock

© Photograph: Tayfun Salcı/ZUMA Press Wire/Shutterstock

The Guardian view on Trump and Europe: more an abusive relationship than an alliance | Editorial

9 December 2025 at 13:49

The White House is aggressively seeking to weaken and dominate the United States’ traditional allies. European leaders must learn to fight back.

Sir Keir Starmer, Emmanuel Macron and Friedrich Merz have become adept at scrambling to deal with the latest bad news from Washington. Their meeting with Volodymyr Zelenskyy in Downing Street on Monday was so hastily arranged that Mr Macron needed to be back in Paris by late afternoon to meet Croatia’s prime minister, while Mr Merz was due on television for an end-of-year Q&A with the German public.

But diplomatic improvisation alone cannot fully answer Donald Trump’s structural threat to European security. The US president and his emissaries are trying to bully Mr Zelenskyy into an unjust peace deal that suits American and Russian interests. In response, the summit helped ramp up support for the use of up to £100bn in frozen Russian assets as collateral for a “reparations loan” to Ukraine. European counter-proposals for a ceasefire will need to be given the kind of financial backing that provides Mr Zelenskyy with leverage at a critical moment.

Do you have an opinion on the issues raised in this article? If you would like to submit a response of up to 300 words by email to be considered for publication in our letters section, please click here.

Continue reading...

© Photograph: Alex Brandon/AP

© Photograph: Alex Brandon/AP

© Photograph: Alex Brandon/AP

Drones to Diplomas: How Russia’s Largest Private University is Linked to a $25M Essay Mill

6 December 2025 at 09:45

A sprawling academic cheating network turbocharged by Google Ads that has generated nearly $25 million in revenue has curious ties to a Kremlin-connected oligarch whose Russian university builds drones for Russia’s war against Ukraine.

The Nerdify homepage.

The link between essay mills and Russian attack drones might seem improbable, but understanding it begins with a simple question: How does a human-intensive academic cheating service stay relevant in an era when students can simply ask AI to write their term papers? The answer – recasting the business as an AI company – is just the latest chapter in a story of many rebrands that link the operation to Russia’s largest private university.

Search in Google for any terms related to academic cheating services — e.g., “help with exam online” or “term paper online” — and you’re likely to encounter websites with the words “nerd” or “geek” in them, such as thenerdify[.]com and geekly-hub[.]com. With a simple request sent via text message, you can hire their tutors to help with any assignment.

These nerdy and geeky-branded websites frequently cite their “honor code,” which emphasizes they do not condone academic cheating, will not write your term papers for you, and will only offer support and advice for customers. But according to This Isn’t Fine, a Substack blog about contract cheating and essay mills, the Nerdify brand of websites will happily ignore that mantra.

“We tested the quick SMS for a price quote,” wrote This Isn’t Fine author Joseph Thibault. “The honor code references and platitudes apparently stop at the website. Within three minutes, we confirmed that a full three-page, plagiarism- and AI-free MLA formatted Argumentative essay could be ours for the low price of $141.”

A screenshot from Joseph Thibault’s Substack post shows him purchasing a 3-page paper with the Nerdify service.

Google prohibits ads that “enable dishonest behavior.” Yet, a sprawling global essay and homework cheating network run under the Nerdy brands has quietly bought its way to the top of Google searches – booking revenues of almost $25 million through a maze of companies in Cyprus, Malta and Hong Kong, while pitching “tutoring” that delivers finished work that students can turn in.

When one Nerdy-related Google Ads account got shut down, the group behind the company would form a new entity with a front-person (typically a young Ukrainian woman), start a new ads account along with a new website and domain name (usually with “nerdy” in the brand), and resume running Google ads for the same set of keywords.

UK companies belonging to the group that have been shut down by Google Ads since Jan 2025 include:

Proglobal Solutions LTD (advertised nerdifyit[.]com);
AW Tech Limited (advertised thenerdify[.]com);
Geekly Solutions Ltd (advertised geekly-hub[.]com).

Currently active Google Ads accounts for the Nerdify brands include:

-OK Marketing LTD (advertising geekly-hub[.]net⁩), formed in the name of Olha Karpenko, a young Ukrainian woman;
Two Sigma Solutions LTD (advertising litero[.]ai), formed in the name of Olekszij (Alexey) Pokatilo.

Google’s Ads Transparency page for current Nerdify advertiser OK Marketing LTD.

Mr. Pokatilo has been in the essay-writing business since at least 2009, operating a paper-mill enterprise called Livingston Research alongside Alexander Korsukov, who is listed as an owner. According to a lengthy account from a former employee, Livingston Research mainly farmed its writing tasks out to low-cost workers from Kenya, Philippines, Pakistan, Russia and Ukraine.

Pokatilo moved from Ukraine to the United Kingdom in Sept. 2015 and co-founded a company called Awesome Technologies, which pitched itself as a way for people to outsource tasks by sending a text message to the service’s assistants.

The other co-founder of Awesome Technologies is 36-year-old Filip Perkon, a Swedish man living in London who touts himself as a serial entrepreneur and investor. Years before starting Awesome together, Perkon and Pokatilo co-founded a student group called Russian Business Week while the two were classmates at the London School of Economics. According to the Bulgarian investigative journalist Christo Grozev, Perkon’s birth certificate was issued by the Soviet Embassy in Sweden.

Alexey Pokatilo (left) and Filip Perkon at a Facebook event for startups in San Francisco in mid-2015.

Around the time Perkon and Pokatilo launched Awesome Technologies, Perkon was building a social media propaganda tool called the Russian Diplomatic Online Club, which Perkon said would “turbo-charge” Russian messaging online. The club’s newsletter urged subscribers to install in their Twitter accounts a third-party app called Tweetsquad that would retweet Kremlin messaging on the social media platform.

Perkon was praised by the Russian Embassy in London for his efforts: During the contentious Brexit vote that ultimately led to the United Kingdom leaving the European Union, the Russian embassy in London used this spam tweeting tool to auto-retweet the Russian ambassador’s posts from supporters’ accounts.

Neither Mr. Perkon nor Mr. Pokatilo replied to requests for comment.

A review of corporations tied to Mr. Perkon as indexed by the business research service North Data finds he holds or held director positions in several U.K. subsidiaries of Synergy, Russia’s largest private education provider. Synergy has more than 35,000 students, and sells T-shirts with patriotic slogans such as “Crimea is Ours,” and “The Russian Empire — Reloaded.”

The president of Synergy is Vadim Lobov, a Kremlin insider whose headquarters on the outskirts of Moscow reportedly features a wall-sized portrait of Russian President Vladimir Putin in the pop-art style of Andy Warhol. For a number of years, Lobov and Perkon co-produced a cross-cultural event in the U.K. called Russian Film Week.

Synergy President Vadim Lobov and Filip Perkon, speaking at a press conference for Russian Film Week, a cross-cultural event in the U.K. co-produced by both men.

Mr. Lobov was one of 11 individuals reportedly hand-picked by the convicted Russian spy Marina Butina to attend the 2017 National Prayer Breakfast held in Washington D.C. just two weeks after President Trump’s first inauguration.

While Synergy University promotes itself as Russia’s largest private educational institution, hundreds of international students tell a different story. Online reviews from students paint a picture of unkept promises: Prospective students from Nigeria, Kenya, Ghana, and other nations paying thousands in advance fees for promised study visas to Russia, only to have their applications denied with no refunds offered.

“My experience with Synergy University has been nothing short of heartbreaking,” reads one such account. “When I first discovered the school, their representative was extremely responsive and eager to assist. He communicated frequently and made me believe I was in safe hands. However, after paying my hard-earned tuition fees, my visa was denied. It’s been over 9 months since that denial, and despite their promises, I have received no refund whatsoever. My messages are now ignored, and the same representative who once replied instantly no longer responds at all. Synergy University, how can an institution in Europe feel comfortable exploiting the hopes of Africans who trust you with their life savings? This is not just unethical — it’s predatory.”

This pattern repeats across reviews by multilingual students from Pakistan, Nepal, India, and various African nations — all describing the same scheme: Attractive online marketing, promises of easy visa approval, upfront payment requirements, and then silence after visa denials.

Reddit discussions in r/Moscow and r/AskARussian are filled with warnings. “It’s a scam, a diploma mill,” writes one user. “They literally sell exams. There was an investigation on Rossiya-1 television showing students paying to pass tests.”

The Nerdify website’s “About Us” page says the company was co-founded by Pokatilo and an American named Brian Mellor. The latter identity seems to have been fabricated, or at least there is no evidence that a person with this name ever worked at Nerdify.

Rather, it appears that the SMS assistance company co-founded by Messrs. Pokatilo and Perkon (Awesome Technologies) fizzled out shortly after its creation, and that Nerdify soon adopted the process of accepting assignment requests via text message and routing them to freelance writers.

A closer look at an early “About Us” page for Nerdify in The Wayback Machine suggests that Mr. Perkon was the real co-founder of the company: The photo at the top of the page shows four people wearing Nerdify T-shirts seated around a table on a rooftop deck in San Francisco, and the man facing the camera is Perkon.

Filip Perkon, top right, is pictured wearing a Nerdify T-shirt in an archived copy of the company’s About Us page. Image: archive.org.

Where are they now? Pokatilo is currently running a startup called Litero.Ai, which appears to be an AI-based essay writing service. In July 2025, Mr. Pokatilo received pre-seed funding of $800,000 for Litero from an investment program backed by the venture capital firms AltaIR Capital, Yellow Rocks, Smart Partnership Capital, and I2BF Global Ventures.

Meanwhile, Filip Perkon is busy setting up toy rubber duck stores in Miami and in at least three locations in the United Kingdom. These “Duck World” shops market themselves as “the world’s largest duck store.”

This past week, Mr. Lobov was in India with Putin’s entourage on a charm tour with India’s Prime Minister Narendra Modi. Although Synergy is billed as an educational institution, a review of the company’s sprawling corporate footprint (via DNS) shows it also is assisting the Russian government in its war against Ukraine.

Synergy University President Vadim Lobov (right) pictured this week in India next to Natalia Popova, a Russian TV presenter known for her close ties to Putin’s family, particularly Putin’s daughter, who works with Popova at the education and culture-focused Innopraktika Foundation.

The website bpla.synergy[.]bot, for instance, says the company is involved in developing combat drones to aid Russian forces and to evade international sanctions on the supply and re-export of high-tech products.

A screenshot from the website of synergy,bot shows the company is actively engaged in building armed drones for the war in Ukraine.

KrebsOnSecurity would like to thank the anonymous researcher NatInfoSec for their assistance in this investigation.

Update, Dec. 8, 10:06 a.m. ET: Mr. Pokatilo responded to requests for comment after the publication of this story. Pokatilo said he has no relation to Synergy nor to Mr. Lobov, and that his work with Mr. Perkon ended with the dissolution of Awesome Technologies.

“I have had no involvement in any of his projects and business activities mentioned in the article and he has no involvement in Litero.ai,” Pokatilo said of Perkon.

Mr. Pokatilo said his new company Litero “does not provide contract cheating services and is built specifically to improve transparency and academic integrity in the age of universal use of AI by students.”

“I am Ukrainian,” he said in an email. “My close friends, colleagues, and some family members continue to live in Ukraine under the ongoing invasion. Any suggestion that I or my company may be connected in any way to Russia’s war efforts is deeply offensive on a personal level and harmful to the reputation of Litero.ai, a company where many team members are Ukrainian.”

Russia Weaponizes Stolen Ukrainian IP Addresses to Disguise Cyberattacks Against Europe

3 December 2025 at 01:34

Ukrainian IP Addresses, IP Addresses, Digital Assets, Russia, Ukraine

Russian occupation forces in Kherson extracted login credentials from Ukrainian telecommunications operators through physical coercion, seizing control of IP addresses that Moscow now exploits to disguise cyberattacks and disinformation operations as originating from Ukrainian or European sources.

Despite Ukrainian appeals and clear sanctions violations, Amsterdam-based RIPE NCC—the nonprofit organization managing Internet number resources for Europe, the Middle East, and Central Asia—continues facilitating Russian access to these stolen digital assets while citing "neutrality" and insisting "the Internet is beyond politics."

The situation creates direct threats to European cybersecurity. Through stolen Ukrainian IP addresses, Russian entities can camouflage hostile operations as Ukrainian or European activity, making source attribution extremely difficult while undermining continental digital security.

Strategic Value of Stolen Digital Assets

IP addresses function as unique digital passports for devices connected to the Internet, providing information about geographic location and allowing data packets to be correctly routed across networks. These resources carry both economic and strategic value in an era where IP addresses are essentially exhausted globally.

One IPv4 address currently sells for 35 to 50 euros on shadow or semi-official exchanges. Major telecommunications companies own hundreds of thousands of such addresses, meaning the loss of even a few thousand units amounts to millions in losses, according to Oleksandr Fedienko, member of Ukraine's parliament and former head of the Ukrainian Internet Association.

Beyond economic impact, IP addresses carry strategic importance as government communications, banking transactions, and critical infrastructure signals pass through them. "Control over them is a matter of national security," Fedienko told Ukrinform, a state run news agency. That is why the theft of Ukrainian IP addresses poses risks not only for Ukraine.

Occupation-Driven Digital Theft

After Russia occupied parts of Ukrainian territories in 2014 and 2022, numerous Ukrainian Internet service providers lost not only physical property but also IP addresses that were re-registered through RIPE NCC to Russian companies. Communication operators in occupied territories who legally received these digital identifiers were forcibly deprived of them.

"I know about a situation in Kherson where these resources were forcibly taken from our communication operators through tortures. Because they are not that easy to take without knowing the appropriate login and password," Fedienko stated.

Moscow's information expansion in occupied Ukrainian territories operates through state-owned unitary communication enterprises created under installed administrations. These entities use the largest blocks of stolen IP addresses, including State Unitary Enterprise of the Donetsk People's Republic Ugletelecom, State Unitary Enterprise of the Donetsk People's Republic Comtel, Republican Communications Operator Phoenix, and State Unitary Enterprise of the Luhansk People's Republic Republican Digital Communications.

Sanctions Violations and RIPE's Intransigence

Andriy Pylypenko, a lawyer working as part of an ad hoc group helping shape Ukraine's legal position regarding frozen stolen IP addresses, argues these entities play key roles in providing information support to the occupying regime. The enterprises facilitated sham referendums and elections in occupied territories, spread Russian propaganda, conducted cyberattacks against Ukraine, and channeled Internet access payments to budgets of illegal DPR and LPR entities.

In 2018, the Ukrainian Internet Association warned RIPE against cooperating with the DPR and LPR, but the organization refused to react, claiming IP addresses supposedly were not economic resources and therefore did not fall under EU sanctions. This position persisted until the Dutch Foreign Ministry clarified in 2021 that IP resources are considered economic resources under EU sanctions regulations, legally requiring RIPE to freeze registration of IP addresses held by sanctioned entities.

RIPE's board publicly disagreed with this interpretation, arguing that access to the Internet and IP resources should not be affected by political disputes. The organization requested a sanctions exemption, but the Dutch Foreign Ministry stated no legal basis existed for such blanket exemptions.

Also read: Zelenskyy Signs Law Advancing Cybersecurity of Ukraine’s State Networks and Critical Infrastructure

Criminal Liability and European Security

Several sanctioned entities from occupied territories have since been added to EU sanctions lists through the 16th, 17th, and 19th sanctions packages. "The only way for them is to freeze the relevant IP addresses and restrict access to them for sanctioned entities," Pylypenko emphasized. In addition, the head of an organization that violated the EU sanctions regime is held responsible for committing a crime as defined by law.

Over the past three years, at least 70 companies and individuals have been prosecuted in the Netherlands for violating EU sanctions against Russia. The Dutch Public Prosecutor's Office recently launched a criminal case against Damen Shipyards and its executives on charges of corruption and international sanctions violations.

NATO formally recognized cyberspace as an operational domain and battlefield at the 2016 Warsaw Summit, affirming that significant cyberattacks could trigger collective defense responses under Article 5. Ukrainian experts warn that RIPE's inaction, combined with political influences and approaches to liberalism, creates risks for European security infrastructure.

Russian-Backed Threat Group Uses SocGholish to Target U.S. Company

26 November 2025 at 11:10
russian, Russia Microsoft phishing AWS Ukraine

The Russian state-sponsored group behind the RomCom malware family used the SocGholish loader for the first time to launch an attack on a U.S.-based civil engineering firm, continuing its targeting of organizations that offer support to Ukraine in its ongoing war with its larger neighbor.

The post Russian-Backed Threat Group Uses SocGholish to Target U.S. Company appeared first on Security Boulevard.

Canada Fines Cybercrime Friendly Cryptomus $176M

22 October 2025 at 13:21

Financial regulators in Canada this week levied $176 million in fines against Cryptomus, a digital payments platform that supports dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services. The penalties for violating Canada’s anti money-laundering laws come ten months after KrebsOnSecurity noted that Cryptomus’s Vancouver street address was home to dozens of foreign currency dealers, money transfer businesses, and cryptocurrency exchanges — none of which were physically located there.

On October 16, the Financial Transactions and Reports Analysis Center of Canada (FINTRAC) imposed a $176,960,190 penalty on Xeltox Enterprises Ltd., more commonly known as the cryptocurrency payments platform Cryptomus.

FINTRAC found that Cryptomus failed to submit suspicious transaction reports in cases where there were reasonable grounds to suspect that they were related to the laundering of proceeds connected to trafficking in child sexual abuse material, fraud, ransomware payments and sanctions evasion.

“Given that numerous violations in this case were connected to trafficking in child sexual abuse material, fraud, ransomware payments and sanctions evasion, FINTRAC was compelled to take this unprecedented enforcement action,” said Sarah Paquet, director and CEO at the regulatory agency.

In December 2024, KrebsOnSecurity covered research by blockchain analyst and investigator Richard Sanders, who’d spent several months signing up for various cybercrime services, and then tracking where their customer funds go from there. The 122 services targeted in Sanders’s research all used Cryptomus, and included some of the more prominent businesses advertising on the cybercrime forums, such as:

-abuse-friendly or “bulletproof” hosting providers like anonvm[.]wtf, and PQHosting;
-sites selling aged email, financial, or social media accounts, such as verif[.]work and kopeechka[.]store;
-anonymity or “proxy” providers like crazyrdp[.]com and rdp[.]monster;
-anonymous SMS services, including anonsim[.]net and smsboss[.]pro.

Flymoney, one of dozens of cryptocurrency exchanges apparently nested at Cryptomus. The image from this website has been machine translated from Russian.

Sanders found at least 56 cryptocurrency exchanges were using Cryptomus to process transactions, including financial entities with names like casher[.]su, grumbot[.]com, flymoney[.]biz, obama[.]ru and swop[.]is.

“These platforms were built for Russian speakers, and they each advertised the ability to anonymously swap one form of cryptocurrency for another,” the December 2024 story noted. “They also allowed the exchange of cryptocurrency for cash in accounts at some of Russia’s largest banks — nearly all of which are currently sanctioned by the United States and other western nations.”

Reached for comment on FINTRAC’s action, Sanders told KrebsOnSecurity he was surprised it took them so long.

“I have no idea why they don’t just sanction them or prosecute them,” Sanders said. “I’m not let down with the fine amount but it’s also just going to be the cost of doing business to them.”

The $173 million fine is a significant sum for FINTRAC, which imposed 23 such penalties last year totaling less than $26 million. But Sanders says FINTRAC still has much work to do in pursuing other shadowy money service businesses (MSBs) that are registered in Canada but are likely money laundering fronts for entities based in Russia and Iran.

In an investigation published in July 2024, CTV National News and the Investigative Journalism Foundation (IJF) documented dozens of cases across Canada where multiple MSBs are incorporated at the same address, often without the knowledge or consent of the location’s actual occupant.

Their inquiry found that the street address for Cryptomus parent Xeltox Enterprises was listed as the home of at least 76 foreign currency dealers, eight MSBs, and six cryptocurrency exchanges. At that address is a three-story building that used to be a bank and now houses a massage therapy clinic and a co-working space. But the news outlets found none of the MSBs or currency dealers were paying for services at that co-working space.

The reporters also found another collection of 97 MSBs clustered at an address for a commercial office suite in Ontario, even though there was no evidence any of these companies had ever arranged for any business services at that address.

Bulletproof Host Stark Industries Evades EU Sanctions

11 September 2025 at 13:40

In May 2025, the European Union levied financial sanctions on the owners of Stark Industries Solutions Ltd., a bulletproof hosting provider that materialized two weeks before Russia invaded Ukraine and quickly became a top source of Kremlin-linked cyberattacks and disinformation campaigns. But new findings show those sanctions have done little to stop Stark from simply rebranding and transferring their assets to other corporate entities controlled by its original hosting providers.

Image: Shutterstock.

Materializing just two weeks before Russia invaded Ukraine in 2022, Stark Industries Solutions became a frequent source of massive DDoS attacks, Russian-language proxy and VPN services, malware tied to Russia-backed hacking groups, and fake news. ISPs like Stark are called “bulletproof” providers when they cultivate a reputation for ignoring any abuse complaints or police inquiries about activity on their networks.

In May 2025, the European Union sanctioned one of Stark’s two main conduits to the larger Internet — Moldova-based PQ Hosting — as well as the company’s Moldovan owners Yuri and Ivan Neculiti. The EU Commission said the Neculiti brothers and PQ Hosting were linked to Russia’s hybrid warfare efforts.

But a new report from Recorded Future finds that just prior to the sanctions being announced, Stark rebranded to the[.]hosting, under control of the Dutch entity WorkTitans BV (AS209847) on June 24, 2025. The Neculiti brothers reportedly got a heads up roughly 12 days before the sanctions were announced, when Moldovan and EU media reported on the forthcoming inclusion of the Neculiti brothers in the sanctions package.

In response, the Neculiti brothers moved much of Stark’s considerable address space and other resources over to a new company in Moldova called PQ Hosting Plus S.R.L., an entity reportedly connected to the Neculiti brothers thanks to the re-use of a phone number from the original PQ Hosting.

“Although the majority of associated infrastructure remains attributable to Stark Industries, these changes likely reflect an attempt to obfuscate ownership and sustain hosting services under new legal and network entities,” Recorded Future observed.

Neither the Recorded Future report nor the May 2025 sanctions from the EU mentioned a second critical pillar of Stark’s network that KrebsOnSecurity identified in a May 2024 profile on the notorious bulletproof hoster: The Netherlands-based hosting provider MIRhosting.

MIRhosting is operated by 38-year old Andrey Nesterenko, whose personal website says he is an accomplished concert pianist who began performing publicly at a young age. DomainTools says mirhosting[.]com is registered to Mr. Nesterenko and to Innovation IT Solutions Corp, which lists addresses in London and in Nesterenko’s stated hometown of Nizhny Novgorod, Russia.

Image credit: correctiv.org.

According to the book Inside Cyber Warfare by Jeffrey Carr, Innovation IT Solutions Corp. was responsible for hosting StopGeorgia[.]ru, a hacktivist website for organizing cyberattacks against Georgia that appeared at the same time Russian forces invaded the former Soviet nation in 2008. That conflict was thought to be the first war ever fought in which a notable cyberattack and an actual military engagement happened simultaneously.

Mr. Nesterenko did not respond to requests for comment. In May 2024, Mr. Nesterenko said he couldn’t verify whether StopGeorgia was ever a customer because they didn’t keep records going back that far. But he maintained that Stark Industries Solutions was merely one client of many, and claimed MIRhosting had not received any actionable complaints about abuse on Stark.

However, it appears that MIRhosting is once again the new home of Stark Industries, and that MIRhosting employees are managing both the[.]hosting and WorkTitans — the primary beneficiaries of Stark’s assets.

A copy of the incorporation documents for WorkTitans BV obtained from the Dutch Chamber of Commerce shows WorkTitans also does business under the names Misfits Media and and WT Hosting (considering Stark’s historical connection to Russian disinformation websites, “Misfits Media” is a bit on the nose).

An incorporation document for WorkTitans B.V. from the Netherlands Chamber of Commerce.

The incorporation document says the company was formed in 2019 by a y.zinad@worktitans.nl. That email address corresponds to a LinkedIn account for a Youssef Zinad, who says their personal websites are worktitans[.]nl and custom-solution[.]nl. The profile also links to a website (etripleasims dot nl) that LinkedIn currently blocks as malicious. All of these websites are or were hosted at MIRhosting.

Although Mr. Zinad’s LinkedIn profile does not mention any employment at MIRhosting, virtually all of his LinkedIn posts over the past year have been reposts of advertisements for MIRhosting’s services.

Mr. Zinad’s LinkedIn profile is full of posts for MIRhosting’s services.

A Google search for Youssef Zinad reveals multiple startup-tracking websites that list him as the founder of the[.]hosting, which censys.io finds is hosted by PQ Hosting Plus S.R.L.

The Dutch Chamber of Commerce document says WorkTitans’ sole shareholder is a company in Almere, Netherlands called Fezzy B.V. Who runs Fezzy? The phone number listed in a Google search for Fezzy B.V. — 31651079755 — also was used to register a Facebook profile for a Youssef Zinad from the same town, according to the breach tracking service Constella Intelligence.

In a series of email exchanges leading up to KrebsOnSecurity’s May 2024 deep dive on Stark, Mr. Nesterenko included Mr. Zinad in the message thread (youssef@mirhosting.com), referring to him as part of the company’s legal team. The Dutch website stagemarkt[.]nl lists Youssef Zinad as an official contact for MIRhosting’s offices in Almere. Mr. Zinad did not respond to requests for comment.

Given the above, it is difficult to argue with the Recorded Future report on Stark’s rebranding, which concluded that “the EU’s sanctioning of Stark Industries was largely ineffective, as affiliated infrastructure remained operational and services were rapidly re-established under new branding, with no significant or lasting disruption.”

Proxy Services Feast on Ukraine’s IP Address Exodus

5 June 2025 at 18:44

Image: Mark Rademaker, via Shutterstock.

Ukraine has seen nearly one-fifth of its Internet space come under Russian control or sold to Internet address brokers since February 2022, a new study finds. The analysis indicates large chunks of Ukrainian Internet address space are now in the hands of shadowy proxy and anonymity services that are nested at some of America’s largest Internet service providers (ISPs).

The findings come in a report examining how the Russian invasion has affected Ukraine’s domestic supply of Internet Protocol Version 4 (IPv4) addresses. Researchers at Kentik, a company that measures the performance of Internet networks, found that while a majority of ISPs in Ukraine haven’t changed their infrastructure much since the war began in 2022, others have resorted to selling swathes of their valuable IPv4 address space just to keep the lights on.

For example, Ukraine’s incumbent ISP Ukrtelecom is now routing just 29 percent of the IPv4 address ranges that the company controlled at the start of the war, Kentik found. Although much of that former IP space remains dormant, Ukrtelecom told Kentik’s Doug Madory they were forced to sell many of their address blocks “to secure financial stability and continue delivering essential services.”

“Leasing out a portion of our IPv4 resources allowed us to mitigate some of the extraordinary challenges we have been facing since the full-scale invasion began,” Ukrtelecom told Madory.

Madory found much of the IPv4 space previously allocated to Ukrtelecom is now scattered to more than 100 providers globally, particularly at three large American ISPs — Amazon (AS16509), AT&T (AS7018), and Cogent (AS174).

Another Ukrainian Internet provider — LVS (AS43310) — in 2022 was routing approximately 6,000 IPv4 addresses across the nation. Kentik learned that by November 2022, much of that address space had been parceled out to over a dozen different locations, with the bulk of it being announced at AT&T.

IP addresses routed over time by Ukrainian provider LVS (AS43310) shows a large chunk of it being routed by AT&T (AS7018). Image: Kentik.

Ditto for the Ukrainian ISP TVCOM, which currently routes nearly 15,000 fewer IPv4 addresses than it did at the start of the war. Madory said most of those addresses have been scattered to 37 other networks outside of Eastern Europe, including Amazon, AT&T, and Microsoft.

The Ukrainian ISP Trinity (AS43554) went offline in early March 2022 during the bloody siege of Mariupol, but its address space eventually began showing up in more than 50 different networks worldwide. Madory found more than 1,000 of Trinity’s IPv4 addresses suddenly appeared on AT&T’s network.

Why are all these former Ukrainian IP addresses being routed by U.S.-based networks like AT&T? According to spur.us, a company that tracks VPN and proxy services, nearly all of the address ranges identified by Kentik now map to commercial proxy services that allow customers to anonymously route their Internet traffic through someone else’s computer.

From a website’s perspective, the traffic from a proxy network user appears to originate from the rented IP address, not from the proxy service customer. These services can be used for several business purposes, such as price comparisons, sales intelligence, web crawlers and content-scraping bots. However, proxy services also are massively abused for hiding cybercrime activity because they can make it difficult to trace malicious traffic to its original source.

IPv4 address ranges are always in high demand, which means they are also quite valuable. There are now multiple companies that will pay ISPs to lease out their unwanted or unused IPv4 address space. Madory said these IPv4 brokers will pay between $100-$500 per month to lease a block of 256 IPv4 addresses, and very often the entities most willing to pay those rental rates are proxy and VPN providers.

A cursory review of all Internet address blocks currently routed through AT&T — as seen in public records maintained by the Internet backbone provider Hurricane Electric — shows a preponderance of country flags other than the United States, including networks originating in Hungary, Lithuania, Moldova, Mauritius, Palestine, Seychelles, Slovenia, and Ukraine.

AT&T’s IPv4 address space seems to be routing a great deal of proxy traffic, including a large number of IP address ranges that were until recently routed by ISPs in Ukraine.

Asked about the apparent high incidence of proxy services routing foreign address blocks through AT&T, the telecommunications giant said it recently changed its policy about originating routes for network blocks that are not owned and managed by AT&T. That new policy, spelled out in a February 2025 update to AT&T’s terms of service, gives those customers until Sept. 1, 2025 to originate their own IP space from their own autonomous system number (ASN), a unique number assigned to each ISP (AT&T’s is AS7018).

“To ensure our customers receive the best quality of service, we changed our terms for dedicated internet in February 2025,” an AT&T spokesperson said in an emailed reply. “We no longer permit static routes with IP addresses that we have not provided. We have been in the process of identifying and notifying affected customers that they have 90 days to transition to Border Gateway Protocol routing using their own autonomous system number.”

Ironically, the co-mingling of Ukrainian IP address space with proxy providers has resulted in many of these addresses being used in cyberattacks against Ukraine and other enemies of Russia. Earlier this month, the European Union sanctioned Stark Industries Solutions Inc., an ISP that surfaced two weeks before the Russian invasion and quickly became the source of large-scale DDoS attacks and spear-phishing attempts by Russian state-sponsored hacking groups. A deep dive into Stark’s considerable address space showed some of it was sourced from Ukrainian ISPs, and most of it was connected to Russia-based proxy and anonymity services.

According to Spur, the proxy service IPRoyal is the current beneficiary of IP address blocks from several Ukrainian ISPs profiled in Kentik’s report. Customers can chose proxies by specifying the city and country they would to proxy their traffic through. Image: Trend Micro.

Spur’s Chief Technology Officer Riley Kilmer said AT&T’s policy change will likely force many proxy services to migrate to other U.S. providers that have less stringent policies.

“AT&T is the first one of the big ISPs that seems to be actually doing something about this,” Kilmer said. “We track several services that explicitly sell AT&T IP addresses, and it will be very interesting to see what happens to those services come September.”

Still, Kilmer said, there are several other large U.S. ISPs that continue to make it easy for proxy services to bring their own IP addresses and host them in ranges that give the appearance of residential customers. For example, Kentik’s report identified former Ukrainian IP ranges showing up as proxy services routed by Cogent Communications (AS174), a tier-one Internet backbone provider based in Washington, D.C.

Kilmer said Cogent has become an attractive home base for proxy services because it is relatively easy to get Cogent to route an address block.

“In fairness, they transit a lot of traffic,” Kilmer said of Cogent. “But there’s a reason a lot of this proxy stuff shows up as Cogent: Because it’s super easy to get something routed there.”

Cogent declined a request to comment on Kentik’s findings.

Oops: DanaBot Malware Devs Infected Their Own PCs

22 May 2025 at 17:53

The U.S. government today unsealed criminal charges against 16 individuals accused of operating and selling DanaBot, a prolific strain of information-stealing malware that has been sold on Russian cybercrime forums since 2018. The FBI says a newer version of DanaBot was used for espionage, and that many of the defendants exposed their real-life identities after accidentally infecting their own systems with the malware.

DanaBot’s features, as promoted on its support site. Image: welivesecurity.com.

Initially spotted in May 2018 by researchers at the email security firm Proofpoint, DanaBot is a malware-as-a-service platform that specializes in credential theft and banking fraud.

Today, the U.S. Department of Justice unsealed a criminal complaint and indictment from 2022, which said the FBI identified at least 40 affiliates who were paying between $3,000 and $4,000 a month for access to the information stealer platform.

The government says the malware infected more than 300,000 systems globally, causing estimated losses of more than $50 million. The ringleaders of the DanaBot conspiracy are named as Aleksandr Stepanov, 39, a.k.a. “JimmBee,” and Artem Aleksandrovich Kalinkin, 34, a.k.a. “Onix”, both of Novosibirsk, Russia. Kalinkin is an IT engineer for the Russian state-owned energy giant Gazprom. His Facebook profile name is “Maffiozi.”

According to the FBI, there were at least two major versions of DanaBot; the first was sold between 2018 and June 2020, when the malware stopped being offered on Russian cybercrime forums. The government alleges that the second version of DanaBot — emerging in January 2021 — was provided to co-conspirators for use in targeting military, diplomatic and non-governmental organization computers in several countries, including the United States, Belarus, the United Kingdom, Germany, and Russia.

“Unindicted co-conspirators would use the Espionage Variant to compromise computers around the world and steal sensitive diplomatic communications, credentials, and other data from these targeted victims,” reads a grand jury indictment dated Sept. 20, 2022. “This stolen data included financial transactions by diplomatic staff, correspondence concerning day-to-day diplomatic activity, as well as summaries of a particular country’s interactions with the United States.”

The indictment says the FBI in 2022 seized servers used by the DanaBot authors to control their malware, as well as the servers that stored stolen victim data. The government said the server data also show numerous instances in which the DanaBot defendants infected their own PCs, resulting in their credential data being uploaded to stolen data repositories that were seized by the feds.

“In some cases, such self-infections appeared to be deliberately done in order to test, analyze, or improve the malware,” the criminal complaint reads. “In other cases, the infections seemed to be inadvertent – one of the hazards of committing cybercrime is that criminals will sometimes infect themselves with their own malware by mistake.”

Image: welivesecurity.com

A statement from the DOJ says that as part of today’s operation, agents with the Defense Criminal Investigative Service (DCIS) seized the DanaBot control servers, including dozens of virtual servers hosted in the United States. The government says it is now working with industry partners to notify DanaBot victims and help remediate infections. The statement credits a number of security firms with providing assistance to the government, including ESET, Flashpoint, Google, Intel 471, Lumen, PayPal, Proofpoint, Team CYMRU, and ZScaler.

It’s not unheard of for financially-oriented malicious software to be repurposed for espionage. A variant of the ZeuS Trojan, which was used in countless online banking attacks against companies in the United States and Europe between 2007 and at least 2015, was for a time diverted to espionage tasks by its author.

As detailed in this 2015 story, the author of the ZeuS trojan created a custom version of the malware to serve purely as a spying machine, which scoured infected systems in Ukraine for specific keywords in emails and documents that would likely only be found in classified documents.

The public charging of the 16 DanaBot defendants comes a day after Microsoft joined a slew of tech companies in disrupting the IT infrastructure for another malware-as-a-service offering — Lumma Stealer, which is likewise offered to affiliates under tiered subscription prices ranging from $250 to $1,000 per month. Separately, Microsoft filed a civil lawsuit to seize control over 2,300 domain names used by Lumma Stealer and its affiliates.

Further reading:

Danabot: Analyzing a Fallen Empire

ZScaler blog: DanaBot Launches DDoS Attack Against the Ukrainian Ministry of Defense

Flashpoint: Operation Endgame DanaBot Malware

Team CYMRU: Inside DanaBot’s Infrastructure: In Support of Operation Endgame II

March 2022 criminal complaint v. Artem Aleksandrovich Kalinkin

September 2022 grand jury indictment naming the 16 defendants

When Getting Phished Puts You in Mortal Danger

27 March 2025 at 12:39

Many successful phishing attacks result in a financial loss or malware infection. But falling for some phishing scams, like those currently targeting Russians searching online for organizations that are fighting the Kremlin war machine, can cost you your freedom or your life.

The real website of the Ukrainian paramilitary group “Freedom of Russia” legion. The text has been machine-translated from Russian.

Researchers at the security firm Silent Push mapped a network of several dozen phishing domains that spoof the recruitment websites of Ukrainian paramilitary groups, as well as Ukrainian government intelligence sites.

The website legiohliberty[.]army features a carbon copy of the homepage for the Freedom of Russia Legion (a.k.a. “Free Russia Legion”), a three-year-old Ukraine-based paramilitary unit made up of Russian citizens who oppose Vladimir Putin and his invasion of Ukraine.

The phony version of that website copies the legitimate site — legionliberty[.]army — providing an interactive Google Form where interested applicants can share their contact and personal details. The form asks visitors to provide their name, gender, age, email address and/or Telegram handle, country, citizenship, experience in the armed forces; political views; motivations for joining; and any bad habits.

“Participation in such anti-war actions is considered illegal in the Russian Federation, and participating citizens are regularly charged and arrested,” Silent Push wrote in a report released today. “All observed campaigns had similar traits and shared a common objective: collecting personal information from site-visiting victims. Our team believes it is likely that this campaign is the work of either Russian Intelligence Services or a threat actor with similarly aligned motives.”

Silent Push’s Zach Edwards said the fake Legion Liberty site shared multiple connections with rusvolcorps[.]net. That domain mimics the recruitment page for a Ukrainian far-right paramilitary group called the Russian Volunteer Corps (rusvolcorps[.]com), and uses a similar Google Forms page to collect information from would-be members.

Other domains Silent Push connected to the phishing scheme include: ciagov[.]icu, which mirrors the content on the official website of the U.S. Central Intelligence Agency; and hochuzhitlife[.]com, which spoofs the Ministry of Defense of Ukraine & General Directorate of Intelligence (whose actual domain is hochuzhit[.]com).

According to Edwards, there are no signs that these phishing sites are being advertised via email. Rather, it appears those responsible are promoting them by manipulating the search engine results shown when someone searches for one of these anti-Putin organizations.

In August 2024, security researcher Artem Tamoian posted on Twitter/X about how he received startlingly different results when he searched for “Freedom of Russia legion” in Russia’s largest domestic search engine Yandex versus Google.com. The top result returned by Google was the legion’s actual website, while the first result on Yandex was a phishing page targeting the group.

“I think at least some of them are surely promoted via search,” Tamoian said of the phishing domains. “My first thread on that accuses Yandex, but apart from Yandex those websites are consistently ranked above legitimate in DuckDuckGo and Bing. Initially, I didn’t realize the scale of it. They keep appearing to this day.”

Tamoian, a native Russian who left the country in 2019, is the founder of the cyber investigation platform malfors.com. He recently discovered two other sites impersonating the Ukrainian paramilitary groups — legionliberty[.]world and rusvolcorps[.]ru — and reported both to Cloudflare. When Cloudflare responded by blocking the sites with a phishing warning, the real Internet address of these sites was exposed as belonging to a known “bulletproof hosting” network called Stark Industries Solutions Ltd.

Stark Industries Solutions appeared two weeks before Russia invaded Ukraine in February 2022, materializing out of nowhere with hundreds of thousands of Internet addresses in its stable — many of them originally assigned to Russian government organizations. In May 2024, KrebsOnSecurity published a deep dive on Stark, which has repeatedly been used to host infrastructure for distributed denial-of-service (DDoS) attacks, phishing, malware and disinformation campaigns from Russian intelligence agencies and pro-Kremlin hacker groups.

In March 2023, Russia’s Supreme Court designated the Freedom of Russia legion as a terrorist organization, meaning that Russians caught communicating with the group could face between 10 and 20 years in prison.

Tamoian said those searching online for information about these paramilitary groups have become easy prey for Russian security services.

“I started looking into those phishing websites, because I kept stumbling upon news that someone gets arrested for trying to join [the] Ukrainian Army or for trying to help them,” Tamoian told KrebsOnSecurity. “I have also seen reports [of] FSB contacting people impersonating Ukrainian officers, as well as using fake Telegram bots, so I thought fake websites might be an option as well.”

Search results showing news articles about people in Russia being sentenced to lengthy prison terms for attempting to aid Ukrainian paramilitary groups.

Tamoian said reports surface regularly in Russia about people being arrested for trying carry out an action requested by a “Ukrainian recruiter,” with the courts unfailingly imposing harsh sentences regardless of the defendant’s age.

“This keeps happening regularly, but usually there are no details about how exactly the person gets caught,” he said. “All cases related to state treason [and] terrorism are classified, so there are barely any details.”

Tamoian said while he has no direct evidence linking any of the reported arrests and convictions to these phishing sites, he is certain the sites are part of a larger campaign by the Russian government.

“Considering that they keep them alive and keep spawning more, I assume it might be an efficient thing,” he said. “They are on top of DuckDuckGo and Yandex, so it unfortunately works.”

Further reading: Silent Push report, Russian Intelligence Targeting its Citizens and Informants.

❌