Why Russia Needs Specialized Circumvention Tools Beyond Standard VPNs
The developers of Tunnel Kitten have addressed a common question from users: why launch another circumvention tool when many VPN services and projects like AmneziaWG already exist.
A recent outage left many long-time users without access, highlighting the challenges of maintaining such services in a hostile environment. The team acknowledged that the incident damaged trust, particularly among early adopters who have supported the project since its beginning.
While self-hosted VPNs or existing commercial solutions may seem like obvious alternatives, the developers argue that these options fail to account for a critical factor. In Russia, the creation and ongoing maintenance of tools designed to bypass internet blocks has been criminalized.
This legal reality creates an asymmetry that standard VPN providers do not face in the same way. Public or easily detectable services can expose operators and users to significant legal risks under current regulations.
Tunnel Kitten therefore focuses on solving a narrower, higher-risk problem rather than competing directly with general-purpose VPN offerings. The project continues to work on restoring service while considering these constraints.
Related articles
Rosfinmonitoring Denies Mass Bank Account Blocks Over Partial Data Matches with Sanctions Lists
Rosfinmonitoring has issued clarifications rejecting reports of potential widespread freezes of bank accounts due to partial matches between client data and records of individuals subject to asset freezes. The agency stressed that the draft law is not intended to penalize people who merely share surnames or have similar name transliterations with sanctioned persons. Criteria for determining partial matches have not yet been defined and will be established by a separate order only after the federal law is adopted and real cases are analyzed. The measure provides only for temporary suspension of a transaction rather than automatic refusal or indefinite account blocking. Earlier reports from Izvestia had warned that loosely defined partial-match rules could generate numerous false positives affecting ordinary clients.
Understanding GOST Cryptography Standards: A Practical Guide for Russian Developers
The article provides a beginner-friendly breakdown of Russian GOST cryptographic standards, separating the core functions of hashing, digital signatures, and encryption. It covers the evolution of GOST algorithms across three generations from the 1990s to the current 2012+ standards including Stribog, Kuznechik, and Magma. Detailed explanations address how PKCS#11 interfaces with hardware tokens, how X.509 certificates function as digital passports, and how formats like CAdES, XAdES, and PAdES package signatures for verification. Comparisons with Western equivalents such as SHA-256, RSA, and AES help developers map familiar concepts to GOST implementations. The guide emphasizes practical integration with tools like CryptoPro for tasks involving detached signatures and certificate requests in PKCS#10 and PKCS#12 containers.
Why Vulnerability Management Specialists Must Master Compliance: Closing All CVEs but Leaving admin:admin
The article explains how compliance has evolved from a paperwork exercise into a mandatory, heavily penalized process in Russian cybersecurity. New regulations such as FSTEC Order 117, turnover fines for personal data leaks, and Presidential Decree 250 impose strict timelines and personal liability for vulnerability management failures. It outlines three approaches to compliance, from doing nothing to building custom standards based on CIS Benchmarks and local requirements. The text stresses moving from reactive scanning to golden images that embed compliance controls before deployment. It highlights tools like MaxPatrol HCC, RedCheck, and ScanOVAL for automated checks and warns that technical patches alone are useless without proper configuration controls such as strong passwords.
China Public Security Ministry Warns IoT Operators: Default Passwords on Devices Like Bus Stop Displays Violate Cybersecurity Law Even Without Major Incidents
A bus electronic display router in Wuhu, Anhui, was compromised in April 2026 because the device retained factory-default credentials and exposed multiple management ports. The Ministry of Public Security highlighted the case in its Hu Wang 2026 report, stressing that failing to change default passwords and leaving ports open constitutes a violation of the Cybersecurity Law regardless of whether serious harm occurred. The RCtea botnet actively targeted similar routers and cameras across China, infecting 9,827 devices in just six days in January 2026 through Telnet brute-force attacks. Experts from the Chinese Academy of Social Sciences clarified that penalties do not require actual damage and that operators must implement technical measures, retain logs for at least six months, and maintain internal security procedures. Additional cases in Qinghai and Nanchong demonstrated repeated enforcement actions against entities that ignored weak-password remediation orders. The report calls on operators, regulators, and manufacturers to enforce password changes at installation, close unnecessary ports, and apply network segmentation to prevent low-hanging IoT devices from becoming botnet recruits.