Adventures in Contacting the Russian FSB
Summary: KrebsOnSecurity contacted the Russian FSB and found its website runs over unencrypted http:// and requires visitors to install a Windows executable that bundles CryptoPro GOST encryption code, which at least 20 antivirus products flag as malware. Unit221B founder Lance James said each download generates a new one-time-use executable holding a session key, that he found no trojan activity beyond the file self-deleting, and that a test program invoking only the GOST cipher was flagged by six antivirus engines.
Why it matters: The FSB is the same agency Treasury sanctioned in April 2021 for cultivating and co-opting criminal hackers, including Evil Corp, to run ransomware and phishing campaigns - and its own contact channel asks sources to trust a dynamically changing executable delivered over a non-secure connection.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026