Positive Technologies Uncovers Disinformation Factory Linking 45 Domains and 74 Telegram Channels
Researchers from Positive Technologies have identified a large-scale disinformation factory that combined fraudulent emails, fabricated news sites, and coordinated social-media amplification. The operation involved 45 domains and at least 74 Telegram channels, forming a single, self-sustaining information network.
The scheme started with emails sent on behalf of Russian government agencies and major companies. Attackers used domains such as minpromtorg.digital, gosuslugi.digital, and rosstat.live that closely resembled official addresses but employed zones including .digital, .live, and .work. Recipients were asked to provide lists of employees, salary information, and other internal data, likely to support subsequent targeted phishing campaigns. The messages contained no malicious attachments; their purpose was to verify active addresses and willing respondents.
At the same time, operators ran a parallel network of pseudo-news websites. These platforms blended authentic publications with invented stories, referenced nonexistent sources, and adopted regional narratives. Among the identified domains were rulenta.live, crime24.live, daganews.ru, and pressklub.az. Fabricated claims published on one site were frequently cited by others as authoritative confirmation, creating a closed loop of apparent legitimacy.
Distribution relied on multiple platforms: VKontakte, Odnoklassniki, YouTube, Instagram, TikTok, and Telegram. Channels were disguised as regional or patriotic communities and often posted identical material simultaneously, driving traffic to the linked websites. Some channels had accumulated thousands of subscribers.
Investigators observed a possible connection to the cybercriminal group Rare Werewolf. One domain previously hosted an archive named bk.rar, a path previously associated with the group’s infrastructure. However, Positive Technologies stated that available evidence is insufficient for definitive attribution and described the link as probable rather than confirmed.
The operation illustrates a complete information pipeline: reconnaissance emails collect contact data, pseudo-news sites lend credibility to fabrications, and synchronized social-media activity ensures wide dissemination to targeted audiences.
Related articles
Reports Surface on Alleged De-Anonymization of Admins Running Major Russian Hacker Forums
An independent researcher has compiled publicly available information pointing to the possible identities of administrators behind prominent Russian-language darknet forums including exploit.in and duty-free.to. The analysis traces exploit.in back to its 2006 launch by a user known as Toha, later linked to Ukrainian authorities or associates, with the forum reportedly transferred or sold. Forum moderator Quake3, identified in open sources as Anatoly Kravchuk, ceased activity in October 2026 and appears on a German police wanted list. Additional details from forum posts and anonymous Telegram channels name Mikhail Rytikov, known as Abdulla, as a key figure tied to server hosting and operations. The report also notes the recent involvement of known Russian hacker wazawaka on duty-free.to and highlights the declining viability of several legacy forums due to law enforcement actions. All claims are presented as unverified public speculation without new original sourcing.
Google Strengthens Chrome Defenses Against ClickFix Clipboard-Based Scams
Google has updated Chrome to detect and warn users about malicious commands copied to the clipboard as part of ClickFix attacks. These scams trick users into pasting harmful scripts into system tools such as PowerShell under the guise of fixing errors or providing tech support. The new protections activate when Enhanced Protection in Safe Browsing is enabled and send suspicious commands for analysis after removing personal data. Google has also shifted scam page detection from a local Gemini model to a server-side implementation to improve accuracy against fake tech support, antivirus, and browser update sites. The changes make it harder for attackers to bypass browser download checks by abusing clipboard and system console execution. Official details were published in the Google Security Blog.
SPF, DKIM and DMARC: Practical Guide to Detecting Email Spoofing and Phishing
The article explains how email authentication mechanisms SPF, DKIM, and DMARC work together to combat spoofed messages that impersonate trusted services. It provides concrete DNS record examples and shows how to interpret Authentication-Results headers in received emails. SPF verifies authorized sending IP addresses but does not check the visible From address. DKIM adds cryptographic signatures to message content and headers, while DMARC ties these checks to the sender domain visible to users and defines handling policies. The guide also covers common configuration errors, forwarding issues, and why successful authentication does not guarantee message safety. It concludes that these protocols must be combined with additional security measures such as attachment scanning and user awareness training.
JPAAWG 9th General Meeting to Examine AI-Driven Messaging Threats and Global Standards in Tokyo
The Japan Anti-Abuse Working Group will hold its ninth annual General Meeting on November 5-6, 2026, in Tokyo as a hybrid event focused on evolving messaging security challenges. Keynote speaker Tom Bartel from M3AAWG will address worldwide anti-abuse trends and the practical realities of AI-powered attacks and defenses. Sessions will cover the recently standardized DMARCbis specification under RFC 9989, ongoing work on DKIM2 to counter replay attacks, BIMI logo display adoption, and sender guidelines for AI-generated email summaries. Practical workshops will teach DMARC report analysis using real sample data along with related technologies such as ARC, DNSSEC, and MTA-STS. Government agencies including the National Police Agency and Ministry of Internal Affairs and Communications will also present, alongside a dedicated track on post-quantum cryptography.