Security Research for the Community

A darknet data leak from the Russian research institute Spetsvuzavtomatika (SVA) has exposed an extensive cyber development ecosystem serving Russia’s Foreign Intelligence Service (SVR). The leaked Git repositories, project specs, and technical reports reveal a sophisticated, modular research and development model focused on automating key phases of espionage—from cloud-agent command-and-control (Initiative-24) and automated target reconnaissance (Felix-23, HAD) to internal domain exploitation (Putnik) and anonymous infrastructure procurement (Chain-24).

Leaked internal data from Russian contractor Okenit reveals "Lemmings" (Лемминги)—a Python-based framework designed to industrialize the creation, verification, and management of synthetic online personas for Russian active measures. Built to automate phone verification, email infrastructure, CAPTCHA solving, and anti-detection measures, Lemmings functions as the identity-provisioning layer within a larger ecosystem alongside proxy and tasking tools (SOI and SOS). Live tests against platforms like VK and Reddit demonstrate a shift toward scalable, modular software frameworks capable of maintaining durable cover identities for intelligence, influence, and disinformation operations.

A leaked cache of institutional files reveals that Department No. 4 at Bauman Moscow State Technical University operates as a structured force-generation pipeline for Russian military cyber operations, training roughly 250 students across specializations. Supervised directly by senior GRU leadership, the program blends offensive intrusion, malware analysis, financial-systems targeting, and cryptographic defense with field placements that feed graduates straight into GRU- linked cyber formations like APT28 (Unit 26165) and Sandworm (Unit 74455).