Tag: Russia

  • Hackers Send Fake Nuclear Threat Alerts to Ukrainian and Russian Citizens

    Hackers Send Fake Nuclear Threat Alerts to Ukrainian and Russian Citizens

    Hackers reportedly hit Ukraine ‘s and Russia ‘s emergency alert apps, sending fake nuclear and attack warnings and raising concerns over public safety.

    Ukraine and Russia both said on Sunday night that hackers had compromised their emergency alert apps and used them to send fake warnings about air raids and other attacks, including nuclear threats. The BBC reported the incident, but neither side’s claims have been independently confirmed.

    Shortly before 11 p.m. local time (9 p.m. GMT), Ukraine’s widely used Air Alarm app sent the highest-level air raid warnings across the country. Some people, including residents of Kyiv, also received alerts about possible radiation, chemical attacks and street fighting. A message posted on Telegram said the app had likely been targeted by a cyberattack, confirmed there was no radiation threat and urged people to remain calm.

    “Shortly before 23:00 local time (21:00 GMT), Ukraine’s widely usedair raid app sent red-level air raid warnings nation-wide, with additional warnings of radiation, chemical attacks, and street fighting sent to some residents in areas including Kyiv.” reports BBC.

    “The Air Alarm application has probably been subjected to hostile interference. There is no radiation threat! Stay calm and follow our updates on our channel.” an alert on Telegram read.

    The false alerts started at about 22:47 with a message that a radiation threat had been declared in Kyiv. At 22:48 came a message in Russian saying a nuclear alert would cover all of Ukraine and not to worry because “it’s Oreshnik flying”. Oreshnik is a Russian intermediate-range ballistic missile that can carry nuclear or conventional warheads, and Russia has the world’s biggest nuclear arsenal, with President Vladimir Putin repeatedly hinting he’s open to using every weapon available.

    Two more alerts arrived at 22:49. One, in Ukrainian, warned of a chemical attack on Kyiv and told people not to go outside, and the other said street fighting was taking place in the city. Red, orange and green messages reached phones, and at 23:53 users got all-clear messages, each declaring one of the Kyiv threats over.

    A Ukrainian intelligence body, which the BBC calls the Central Intelligence Agency, said there had been a failure in the app and urged people to use other sources of information. It added that the alerts triggered a radiation hazard signal on loudspeakers in the Lviv region, with no real threat.

    “The Air Alert app is supported by the Ministry of Digital Transformation of Ukraine, and informs users instantly about the beginning and end of defence alerts. The ministry said it temporarily disabled the app for maintenance after it had “apparently been compromised”. states BBC.

    “While the false alerts were quickly contained, cybersecurity experts suggested it was a new line in apparent Russian cyberattacks.”

    The temporary shutdown of the Air Alert app also carries significant risks, even if it lasts only a short time. During an outage, users may not receive timely warnings about incoming attacks, leaving them with less time to reach shelters or take protective measures. This is particularly dangerous in a country where missile and drone attacks can happen with little warning.

    The incident also highlights a difficult security trade-off: disabling a compromised alert system may prevent attackers from spreading false warnings, but it can temporarily remove a critical channel for delivering real emergency information. Any shutdown therefore needs reliable backup channels, such as sirens, official messaging services and other emergency communication systems.

    Regional leaders tried to calm people. Svitlana Onyshchuk, head of the Ivano-Frankivsk region, said everything was calm, even though the app had shown a red-level alert for her region from 22:50 to 23:57. Natalya Zabolotna, her counterpart in Vinnytsia, confirmed a cyberattack on the app and warned people not to click the link in the message, which could be phishing.

    Ukraine’s Centre for Countering Disinformation has advice for when the app isn’t working: turn on smartphone notifications, pay attention to sirens, and read only official sources. Oleksander Merezhko, chair of the foreign affairs committee in the Ukrainian parliament and a member of President Zelensky’s Servant of the People party, said the attack caused no panic. Ukrainians, especially in Kyiv, are used to practically non-stop alerts, he told the BBC, and the message in Russian aroused suspicion at once. The attackers picked a language that gave them away.

    A few hours later, Russia’s ministry of emergency situations said its own app had suffered “a massive cyberattack” that sent fake information to the public. Ukrainian outlet UNN reported that the hack sent fake nuclear threat alerts inside Russia, citing Atesh, a partisan Ukrainian group operating in Russian-held territory. A screenshot Atesh shared on Telegram, described as purported, claimed nuclear warheads mounted on Ukrainian P1-Sun attack drones had been launched at all regions of Russia, opened with a “risk of getting lively” warning and told residents to stock up on three weeks of food and hide. The alert also had profanities.

    Russia said it was still restoring the app but claimed the hack had not affected its wider alert system. It said people could still receive warnings through sirens, loudspeakers, text messages, TV and radio. The false alerts appeared minutes before a local ceasefire in Ukraine’s Kherson region ended on Sunday night. The truce had allowed civilians to leave Russian-occupied Oleshky. Although the fake warnings were quickly stopped, experts see the attack as a worrying escalation.

    “I think it’s the first time it’s happened to an official Ukrainian information app, but I suspect it won’t be the last,” Herbert Lin, a senior research scholar for cyber policy and security at Stanford University, told BBC World Service’s Newsday programme.

    Follow me on Twitter: @securityaffairs and Facebook and Mastodon

    Pierluigi Paganini

    (SecurityAffairs – hacking, Ukraine)

    Source: Security Affairs · 2026-11-02

  • Officials seize domain of top bulletproof hosting provider Virtualine

    Authorities seized the domain of Virtualine, a bulletproof hosting provider that cybercriminals used to commit a large-scale sextortion scheme, ransomware, data theft, malware hosting and money laundering, the Justice Department said Tuesday. 

    Virtualine facilitated prolific criminal activity, including the distribution of child sexual abuse material (CSAM), the Justice Department said. The Russian-speaking bulletproof hosting provider was among the most active this year in crypto-related crime in particular, researchers said. 

    The site and its associated infrastructure stands out among the dozens of bulletproof hosting providers currently tracked by TRM Labs. “It was not among the largest by total inflows, but it received the most illicit-attributed value in 2026 to date,” the blockchain and cryptocrime research firm wrote in a blog post.

    Virtualine received almost one-fifth of all illicit-attributed inflow among bulletproof hosting providers tracked by TRM this year to date.

    A Russian drug marketplace accounted for nearly 44% of the direct payments Virtualine received from customers and attributed counterparties so far this year, according to TRM. A sextortion scheme accounted for nearly 17% of direct payments to Virtualine, followed by a cryptocurrency mixer at almost 13%, ransomware at nearly 5%, cybercrime services at 3% and malware at 2%.

    “Virtualine is another example of Russia’s illicit economy at work: darknet markets, ransomware groups, non-compliant exchanges, and brokers all feeding the same ecosystem,” Ari Redbord, global head of policy at TRM Labs, said in a prepared statement. 

    “Bulletproof hosting is the connective tissue. Seizing a domain matters, but the blockchain record doesn’t disappear with it. It shows who is paying, who is getting paid, and where they go next,” he added. 

    Virtualine attracted many criminals as customers. Ransomware groups, including Coinbase Cartel, The Gentlemen, INC, DragonForce and Qilin all paid the site’s operators, according to TRM. The bulletproof hosting provider also received payments from the StealC infostealer, the Matanbuchu loader, bot and malware-distribution services and sites linked to CSAM. 

    The FBI and prosecutors got a court order to seize Virtualine’s primary domain, which was also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech.

    Officials said Virtualine continued hosting services for a customer that distributed CSAM and a hack-for-hire service after it received numerous notices from law enforcement in Germany, Canada, Australia, the National Center for Missing and Exploited Children and a victim’s attorney.

    TRM underscores that Virtualine was disrupted, but not completely shut down. “A domain seizure disrupts how customers find and access a service,” researchers wrote. “It does not, by itself, establish that the operator has stopped working, or that customers have lost access to all underlying infrastructure.”

    Source: CyberScoop · 2026-10-29

  • Kremlin payment firm A7 has been pumping billions in ‘untraceable’ cash into global financial system

    Kremlin payment firm A7 has been pumping billions in ‘untraceable’ cash into global financial system

    At the sprawling Sadovod market in southeast Moscow, among the 160 acres of clothing, jewelry and appliance booths, at least eight teams are spotted, working apart from the everyday hustle and bustle of the market.

    Throughout a business day, these teams, known in confidential records as “departments,” receive a steady stream of customers, almost always carrying bags of various shapes and sizes.

    And inside the bags are piles and piles of cash — Russian rubles. These departments, staffed by payment brokers, are a key intake point for one of the largest, and most secretive, cash-processing operations in the world.

    The inside of the sprawling, 160-acre market. Image: Natalia Senatorova / Wikimedia

    Welcome to the industrial cash machine that is A7, the payments giant backed by the Russian state.

    Between November 2024 and July 2025, A7 processed at least 283 tons of cash rubles, worth more than $14 billion, an investigation by the International Consortium of Investigative Journalists and Russian independent media outlet Proekt has found.

    For A7, ICIJ discovered, cash is king, the jet fuel for a firm now under scrutiny as a “shadow banking network” designed to evade Western sanctions at scale, according to U.S. authorities.

    On Oct. 1, the U.S. Treasury sanctioned A7 as a “significant transnational criminal organization,” which “utilizes money laundering methodologies to fraudulently move vast sums of money in violation of sanctions and other laws in the jurisdictions in which it operates.”

    But while Western governments and banks scramble to trace A7 money flows through the international financial system, ICIJ’s investigation reveals that the origins of the bulk of A7 transmissions are, in fact, untraceable.

    According to internal A7 records seen by ICIJ, and people familiar with the matter, a huge portion of A7’s payments do not stem from conventional bank transfers by clients inside Russia, but literally from hundreds of tons of cash rubles.

    Leaked internal records allowed ICIJ to identify that a handful of wholesale markets and other businesses around the Russian capital, including Sadovod, where much of the business is done in cash, made up a significant share of the cash A7 processed.

    The records show that while the source of the cash is untraceable, its destination is not: Most of the cash is bound not for Western markets, but for China.

    A fountain in Sadovod market in southeast Moscow. Image: Nikita Andreev / Wikimedia

    A7 did not return ICIJ’s requests for comment.

    In public statements, A7 has strongly rejected the U.S. allegations of wrongdoing, saying that it “employs a modern, multi-tiered compliance system” and that it was “established to ensure uninterrupted settlements for the Russian market, which has been subjected to unlawful restrictive measures.”

    “All clients undergo screening to identify risks and prevent the servicing of individuals or organizations whose activities violate regulatory requirements,” it continued.

    Experts say the fact that cash drives A7 raises the spectre of a money laundering operation limited only by the size of the market and A7’s capacity to physically handle the cash. As such, A7’s cash-based model presents challenges not previously understood both to the conventional banking system and to law enforcement.

    “Cash is considered one of the highest risk methods of payment and store of value because it’s anonymous, it can travel across borders, and it doesn’t attach to any specific individual or company,” George Voloshin, an expert at ACAMS, a global training body for anti-financial crime, told ICIJ in an interview.

    “The A7 network not only helps Russia circumvent Western sanctions and export controls,” Voloshin continued. The fact that A7 takes massive volumes of cash from Moscow’s wholesale markets suggests that the company “is also likely to facilitate cash-based money laundering by effectively legitimizing potential proceeds of crime,” he said.

    Voloshin added that international banks bear an additional burden of tracing payments emanating from A7. “The main risk is that [foreign] intermediary or beneficiary banks become complicit in [a] form of criminal activity that they know nothing about, because they don’t have any visibility into what’s happening in Russia where the money originates from.”

    Cash by the ton, bound for China

    On its launch in late 2024, A7 touted itself as a sanctions-proof payments system, and has come under increasing scrutiny for its role as one of the Kremlin’s principal channels for laundering billions of dollars worth of payments out of Russia and into the global financial system, via a global network of shell companies, often with accounts at major international banks.

    As part of its launch, A7 integrated into its business a hodgepodge of informal payment brokers at Moscow markets, including Sadovod, according to internal A7 records seen by ICIJ.

    “For [A7], Sadovod is simply a big client base — a big, aggregated pile of clients,” a person familiar with the matter, who requested anonymity due to security concerns, told ICIJ. “And that’s exactly what they go there for: the money and the profit.”

    For years, this ecosystem of market brokers converted importers’ cash into conventional bank transfers or crypto, most often bound for China. This informal system was upended by Western sanctions, which barred Russian businesses from the SWIFT system, the international messaging network that allows banks to exchange transactions. The threat of U.S. secondary sanctions — which target entities for doing business with sanctioned states or businesses — made Chinese banks more cautious when dealing with Russia.

    The informal cash payment system at Moscow’s wholesale markets “depends on trusted intermediaries, established relationships and confidence that money will arrive,” Ilia Shumanov, managing partner of Russia-focused due diligence firm Tri-Trace Investigations, told ICIJ. “Its international reach can be extensive, while outsiders have limited visibility into the underlying transactions.”

    Under A7’s new, supercharged system, a platoon of market brokers takes in the bags of cash brought by vendors and makes an initial count.

    The brokers then stuff the rubles into numbered bags to be loaded, along with clients’ payment orders, into vans bound for an A7 processing office elsewhere in the Russian capital, according to leaked internal payment and cash management records.

    A review of cash deposit and internal payment records shows that a small army of 50 or so A7 cashiers feeds the cash into a counting system where the amounts are verified; A7 enters the bag number, ruble amount and the client’s payment order into a bespoke payment management system, then trucks the cash on to Promsvyazbank, or PSB, the Russian state defense bank, a co-owner of the company. PSB puts it in a vault and credits A7 accounts. PSB acknowledged ICIJ’s request for comment, but did not provide a response.

    Photo of an industrial complex with tanks and pipes, including Gunvor's logo.

    https://www.icij.org/investigations/china-capital/gunvor-publicly-condemned-russias-war-but-continued-to-do-business-with-russian-energy-firms-records-show/

    CHINA CAPITAL Gunvor publicly condemned Russia’s war but continued to do business with Russian energy firms, records show  Oct 01, 2026

    https://www.icij.org/news/2026/09/trump-administration-gave-firm-with-ties-to-ballroom-donor-the-green-light-to-do-business-with-a-sanctioned-russian-bank/

    Accountability Trump administration gave firm with ties to ballroom donor the green light to do business with a sanctioned Russian bank Sep 21, 2026

    https://www.icij.org/news/2026/02/hong-kong-firms-feed-european-tech-to-russias-war-in-ukraine-report-says/

    SANCTIONS Hong Kong firms feed European tech to Russia’s war in Ukraine, report says Feb 18, 2026

    Recommended reading CHINA CAPITAL Gunvor publicly condemned Russia’s war but continued to do business with Russian energy firms, records show  Oct 01, 2026 Accountability Trump administration gave firm with ties to ballroom donor the green light to do business with a sanctioned Russian bank Sep 21, 2026 SANCTIONS Hong Kong firms feed European tech to Russia’s war in Ukraine, report says Feb 18, 2026

    Source: ICIJ · 2026-10-21

  • Leaked files reveal how Deloitte Cyprus helped Roman Abramovich hide $10B fortune

    Leaked files reveal how Deloitte Cyprus helped Roman Abramovich hide $10B fortune

    The accounting giant Deloitte helped doctor a paper trail that enabled Russian billionaire Roman Abramovich to conceal billions in assets and dodge millions in tax, according to a joint investigation by the Bureau of Investigative Journalism and BBC Panorama.

    A forensic analysis of corporate records obtained as part of the Cyprus Confidential leak reportedly shows how staff at Deloitte’s Cyprus branch, and its offshoot MeritServus, routinely falsified documents while managing the oligarch’s vast offshore fortune.

    Between 1999 and 2013, Abramovich’s associates worked closely with the financial services providers to backdate and rubber-stamp more than 1,000 documents, the investigation found, including as part of an alleged scheme that one leading expert described as “straightforward and blatant” tax evasion.

    “What you take away from it is that there are professionals who are prepared to bend and break the rules of their profession and therefore the law,” Andrew Mitchell KC, a financial crime barrister who reviewed the findings, told BBC Panorama. “And it looks that they will stop literally at nothing in terms of creating documents.”

    Around 2006,

     

    after Cyprus introduced new corporate disclosure rules,

    more than $600 million in luxury assets — including a French château, superyachts and private jets — disappeared from the accounts of one of Abramovich’s Cypriot companies, Amiscan Investments, TBIJ and the BBC reported. A separate yearslong maneuver wiped nearly $2 billion from the balance sheet of Kravin Investments, another Cypriot company, by effectively rewriting its financial history.

    The revelations from TBIJ and the BBC, alongside the Guardian and the Organized Crime and Corruption Reporting Project, are the latest from the Cyprus Confidential leak obtained by Paper Trail Media and Distributed Denial of Secrets and shared by the International Consortium of Investigative Journalists. The leak includes about 450,000 files from Meritservus, a family-run Limassol firm that spun off from Deloitte in 2005.

    The Deloitte headquarters in Cyprus. Image: Kostas Pikoulas/NurPhoto via Getty Images

    Despite the public split, the firms worked together closely behind closed doors and served as key financial advisors to Abramovich for nearly 20 years, severing ties after he was sanctioned by the United Kingdom and the European Union in response to Russia’s 2022 invasion of Ukraine. ICIJ’s previous reporting on the MeritServus files connected Abramovich to 261 companies and trusts in Cyprus, the British Virgin Islands, Jersey and other secrecy jurisdictions.

    In response to TBIJ and the BBC’s findings, Abramovich’s lawyers denied their client was aware of unlawful backdating, evaded taxes or misled Cypriot authorities: “If an arrangement was proposed by professional advisers of Deloitte’s standing, it would have been entirely proper for companies linked to our client … to rely on it.”

    Deloitte Cyprus said that it “acts in compliance with all applicable laws.”

    The vanishing billions

    Abramovich made his fortune in the 1990s by buying Russia’s state-owned oil company Sibneft after the fall of the Soviet Union for roughly $250 million. A decade later he sold the company back to the government for billions in profit, which he parlayed into investments in real estate, superyachts, a nearly $1 billion art collection and the Chelsea Football Club.

    In 2003, one of Abramovich’s Cypriot companies, Kravin Investments, received a windfall of $3 billion from his sale of Sibneft shares, TBIJ and the BBC reported. Around $2 billion was left accruing interest in Kravin’s bank account — and becoming a tax liability.

    View embedded content

    Leaked emails show how members of Abramovich’s inner circle, who oversaw his financial affairs from London, agreed on a plan to solve the tax issue with his advisors in Cyprus, including MeritServus founder Demetris Ioannides and Antonis Taliotis, a senior tax advisor at Deloitte Cyprus until earlier this year. In one email, Deloitte advised that “certain changes will have to be made to the accounts (bank account balances, interest income, profit and loss account).”

    Ioannides’ lawyers told TBIJ and the BBC that he was unable to respond to requests for comment. Talitotis declined to comment through Deloitte Cyprus.

    From 2005, MeritServus began backdating documents to 2003, making it appear as though the $3 billion was transferred out of Kravin’s accounts to another of Abramovich’s companies in the British Virgin Islands instead of sitting untouched for years, the investigation found.

    MeritServus reportedly then created a backdated agreement claiming that Kravin had been holding and investing the money on the other company’s behalf and therefore shouldn’t be taxed in Cyprus. To add to the illusion, MeritServus also drafted fake correspondence between the companies as well as other corroborating documents — some reportedly as recently as 2008.

    Several experts, including Mitchell, told TBIJ and the BBC that the backdated records were devised to evade taxes.

    A couple stand together, linking arms andsmiling at a gallery opening

    https://www.icij.org/investigations/cyprus-confidential/chelsea-fc-fined-millions-over-secret-payments-under-abramovich-ownership/

    IMPACT Chelsea FC fined millions over secret payments under Abramovich ownership Mar 17, 2026

    https://www.icij.org/investigations/cyprus-confidential/uk-mps-push-for-probe-into-russian-billionaires-possible-1b-tax-dodge/

    TAX HAVENS UK MPs push for probe into Russian billionaire’s possible $1B tax dodge Feb 05, 2025

    https://www.icij.org/investigations/russia-archive/leak-reveals-majority-interest-in-roman-abramovichs-nearly-1-billion-art-collection-was-transferred-to-his-ex-wife-ahead-of-sanctions/

    Art Leak reveals majority interest in Roman Abramovich’s nearly $1B art collection was transferred to his ex-wife ahead of sanctions Sep 22, 2023

    Recommended reading IMPACT Chelsea FC fined millions over secret payments under Abramovich ownership Mar 17, 2026 TAX HAVENS UK MPs push for probe into Russian billionaire’s possible $1B tax dodge Feb 05, 2025 Art Leak reveals majority interest in Roman Abramovich’s nearly $1B art collection was transferred to his ex-wife ahead of sanctions Sep 22, 2023

    Source: ICIJ · 2026-10-14