Trusting Russian Root Certificates and Monitoring Domestic CT Logs
The discussion around trust in Russian root certificates issued by the Ministry of Digital Development and Communications has intensified following recent issues with GOST certificates on Gosuslugi. Users are weighing the security implications of adding these roots to system stores, browser profiles, or relying on Yandex Browser where they are pre-installed.
Root certificates themselves do not compromise systems, yet placing them in trusted stores creates a pathway for traffic interception. Entities with access to network flows via the TSPU system can issue intermediate certificates signed by the Russian root and perform real-time MitM attacks against sites such as gmail.com or telegram.org.
Defensive measures remain limited. One approach involves isolating the Russian roots to a dedicated browser profile used only for domestic sites that require them. Advanced configurations can further restrict the roots to specific domains such as *.ru.
Certificate Transparency as a Mitigation
Certificate Transparency logs record every issued certificate in an append-only structure, embedding proof of inclusion inside the certificate. Yandex Browser refuses certificates lacking a valid SCT from approved logs, significantly raising the bar for undetected MitM operations and leaving forensic traces.
Other browsers automatically disable CT verification for chains anchored to manually added roots, treating them as corporate environments. This behavior reduces visibility into potential abuse of Russian intermediates.
Domestic CT Logs
Three primary logs are recognized by Yandex:
- Yandex Agate Log (2026 and 2027 instances)
- VK NCA Log (2026 and 2027 instances)
- Ministry of Digital Development and Communications Log (2026 and 2027 instances)
Log endpoints rotate yearly, and the authoritative list is published at browser-resources.s3.yandex.net/ctlog/ctlog.json.
Verification Tools
Public monitors such as ct.tlscc.ru have shown gaps in coverage for newer log addresses and certain active certificates. A Python utility was developed to fetch the current log list, parse embedded SCTs, reconstruct precertificates, and query each domestic log via the standard CT HTTP API for inclusion proofs.
Related articles
Why Legitimate Russian Websites Fail to Load With or Without VPN: TSPU RKN Blocking and MinTsifry Certificates Explained
Russian internet users are experiencing widespread access issues to legitimate domestic websites both when using VPNs and when connecting directly. The problems stem from TSPU devices installed by all ISPs under Roskomnadzor requirements and the transition to national MinTsifry certificates that foreign browsers do not trust. Three distinct error scenarios are documented: ERR_CONNECTION_TIMED_OUT when accessing Russian-IP sites over VPN, ERR_CERT_AUTHORITY_INVALID on major bank sites without VPN, and partial page loading failures caused by TSPU fingerprinting. Solutions for ordinary users include split-tunneling VPN clients, installing MinTsifry root certificates, or switching to Yandex Browser and Chromium-Gost. Website owners are advised to disable TLS 1.3, enable HTTP/2 support, and consider changing server IP addresses if SSH connections are also blocked. The article explicitly excludes any discussion of circumvention methods for prohibited content and focuses only on legal Russian resources as of August 2026.
Smart Homes on Pause: Why Digital Systems in New Buildings Fail After Three Years
Modern residential complexes increasingly rely on digital infrastructure, yet many smart home systems stop functioning properly within three years of commissioning. The root causes lie in decisions made during the design phase rather than after handover. Marketing-driven features often lack any sustainable operational model, leading to disappearing services once the warranty period ends. A fragmented vendor landscape, missing documentation, and absent ownership further accelerate degradation. Cybersecurity risks grow when updates and monitoring are neglected, turning buildings into easy targets. The article outlines how to build resilient systems that remain functional for 10–20 years by focusing on total cost of ownership, open standards, and clear responsibility frameworks.
Rospotrebnadzor and FAS to Extend Oversight to Websites: Automating Foreign Word Replacement Using LLM
Russian compliance experts have developed a specialized microservice called Normograph that combines multi-stage filtering, OCR, and LLM processing to help organizations meet the requirements of Federal Law 168-FZ on protecting the Russian language. The system automatically identifies prohibited foreign borrowings and Latin script on websites, cross-references them against official dictionaries approved by the Russian Academy of Sciences, and suggests context-aware Russian replacements while preserving marketing meaning and grammatical agreement. It excludes registered trademarks, brand names, and terms without Russian equivalents using dynamic white lists and Rospatent data. The solution processes pages up to 20 times faster than manual review by filtering out already-compliant words before sending only problematic fragments to the language model. An OCR module based on Yandex Cloud Vision extends checks to images and banners. The service was built with GigaChat API but remains provider-agnostic and avoids sending full pages or confidential data to foreign AI services.
T-Bank Masks New iOS Banking App as K8CHEN PRO to Bypass Sanctions
T-Bank has released a new version of its mobile banking application for iPhone users that appears in the App Store under the neutral name K8CHEN PRO. After installation and user authentication, the app automatically renames itself to 8PRO. The application is currently available for download in the Russian, Kazakh, Turkish, Georgian, and American App Store regions. T-Bank confirms the legitimacy of the release through a direct link published on its official website. The disguise is a direct response to repeated removals of official Russian financial apps from the App Store following the introduction of sanctions. Users are strongly advised to obtain the app exclusively via the official site link rather than searching the store, as fraudsters frequently clone banking applications to steal credentials.