Human Rights Watch website blocked in Russia

Human Rights Watch’s website has been blocked in Russia over an article about Russia’s operation in Ukraine.

Russia’s telecoms watchdog, Roskomnadzor, has restricted access to a single page of the Human Rights Watch website on a demand from the prosecutor general’s office dated 12 April. However, the entire website has been rendered inaccessible.

Phishing emails with subject ‘Azovstal’ infect Ukrainian state organisations with Cobalt Strike Beacon

The Computer Emergency Response Team of Ukraine (CERT-UA) reported the spread of phishing emails that infect computers with Cobalt Strike Beacon malware.

The campaign targets Ukrainian state organisations by sending phishing emails which call for the deblocking of Azovstal, one of the largest steel plants in Ukraine. The emails contain a document dubbed ‘Urgent!,’ and if opened, it compromises the computer with the malware.

Brain drain of Russian tech workers

It is estimated that 70,000 Russian tech workers fled Russia since the beginning of the Ukraine conflict. Another 70,000–100.000 workers will likely leave Russia over the next few months.

Sanctions against Russia have affected software outsourcing to Russian programmers. Many of them reacted quickly by moving to Turkey, Armenia, and other countries that do not require visas.

The Russian economy could be adversely affected by this exodus, as the tech field is important for diversifying Russia’s energy-dominated economy.

Russia’s recent data leaks

Since Russia invaded Ukraine, large amounts of information regarding the Russian state and its operations have become public. Hundreds of gigabytes of files and millions of emails have been made public. In addition to the leaked data published by various hacktivist groups, Ukraine’s intelligence services have been active in publishing data concerning information about Russian military institutions and their servicemen deployed in Ukraine.

The group Distributed Denial of Secrets claims to have published more than 700 gigabytes of data from the Russian government and more than 3 million Russian emails and documents. DDoSecrets also has published more than 360,000 files from Roskomnadzor, the Russian media regulator; 62,000 emails from an investment firm owned by a sanctioned Russian individual; 900,000 emails from VGTRK, a state-owned broadcaster; 230,000 emails from the Russian Ministry of Culture; and 250,000 emails from the Ministry of Education.

A data list published by Ukraine’s intelligence services allegedly contains the personal information of 1,600 Russian troops who served in Ukraine’s city of Bucha. Another list reportedly contains the names and contact details of 620 Russian spies registered to work at the Moscow office of the FSB, the country’s central security agency.

While this data may be a valuable resource for researchers spanning from journalists to those tasked with investigating war crimes, doxing – publishing private or identifying information about a particular individual on the internet – is among the most destructive internet behaviours. Expert explained.

China accused of hacking Ukraine days before Russian invasion

China has been accused of hacking Ukraine’s networks days before the Russian invasion.

According to intelligence memos obtained by the British daily The Times, Chinese hackers reportedly carried out cyberattacks on Ukrainian institutions and nuclear facilities in the run-up to Russia’s invasion. Thousands of hacking attempts were made against more than 600 websites, including the Ukrainian Ministry of Defence and other agencies.

According to a source from the Security Service of Ukraine (SBU), cyberattacks began before the Winter Olympics had ended, and peaked on 23 February, the day before the Russian invasion, with the Chinese government coordinating the attacks.

The SBU, on the other hand, denied providing The Times with any information about the alleged attacks. ‘The SBU has nothing to do with the Times’ findings. The Ukrainian Security Service does not currently have such information, and no investigation is underway,’ according to The Guardian.

Ericsson suspending activities in Russia

In response to the latest EU sanctions, Ericsson has decided to suspend its operations in Russia.

‘In late February, Ericsson suspended all deliveries to customers in Russia. In the light of recent events and European Union sanctions, the company will now suspend its affected business with customers in Russia indefinitely. Ericsson is engaging with customers and partners regarding the indefinite suspension of the affected business.’ Ericsson’s statement said.

Facebook briefly blocks hashtags tied to Bucha killings

A company spokesman confirmed that Facebook and Instagram owner Meta Platforms briefly limited hashtags linked to civilian deaths in Bucha, outside Kyiv in northern Ukraine.

Meta Spokesman Andy Stone said automated systems that scan for violent imagery on Facebook and Instagram were responsible for blocking hashtags, including #bucha and #buchamassacre. Stone tweeted:

This happened automatically because of the graphic content people posted using these hashtags. When we were made aware of the issue yesterday, we acted quickly to unblock the hashtags.

Facebook and Instagram allow the posting of graphic and violent content when shared to raise awareness of possible human rights abuses, but are delete if the content is explicit or glorifies suffering.

USA disrupts Russia-backed Cyclops Blink botnet

The US Department of Justice (DoJ) announced that it had taken down Cyclops Blink, a botnet controlled by a threat actor known as Sandworm (APT28), which has been linked to Russia’s military intelligence agency, GRU.

‘Thanks to our close work with international partners, we were able to detect the infection of thousands of network hardware devices. We were then able to disable the GRU’s control over those devices before the botnet could be weaponized.’ the announcement stated.

In a press conference, US Attorney General Merrick Garland has accused Russia of using similar infrastructure to conduct cyberattacks on Ukraine. However, he noted that ‘fortunately, we could disrupt this botnet before it could be used’.

YouTube confirms deletion of video of Russian Foreign Ministry briefing

YouTube’s press service confirmed to Interfax that a recording of a briefing given by Russian Foreign Ministry Spokeswoman Maria Zakharova had been removed from the platform.

YouTube explained its decision by stating that the video violates the platform’s policies regarding Ukraine.

Roskomnadzor, Russia’s telecoms regulator, requested that Google lift the restrictions and explain why they were imposed.