Russia Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, Russia
Background readingHacktivismIncident response
No public level found
No published national cyber threat level found for Russia's cyber threat posture and 2026 incidents, checked 7 Nov 2026. Russia publishes no cyber alert level; officials report blocked attack counts and usually blame foreign states, often without public evidence.
Source: The Record
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
| Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|---|---|---|
| DDoS waves against election and government systems, per the Central Election Commission | More than 3,000 | 18 to 20 September 2026 (State Duma election) | The Record |
| DDoS attacks from outside Russia, per Roskomnadzor | More than 1,500 | 18 to 20 September 2026 | The Record |
| Attacks blocked on online voting and e-government, per Deputy Minister Oleg Kachanov | About 2,000 | 18 to 20 September 2026 | The Record |
Who is targeting it
| Group | Kind | What it did | Sources | Reports |
|---|---|---|---|---|
| DataSuckers | Extortion | Claimed Dodo Pizza and other breaches; Russian authorities detained three suspected members in October 2026. | The Record | |
| Cyber Corps (with Ukraine's HUR) | State-aligned | HUR claimed a joint operation against Wildberries in August 2026. | The Record | |
| Black Spark | Hacktivist | Claimed the August 2026 breach of network monitoring firm Microolap, which confirmed partial compromise. | The Record |
Laws and rules this year
- 8 Jun 2026Updated SORM technical standards (Ministry of Digital Development). Sets how operators search, process and pass data to the SORM surveillance system and widens searchable fields to IDs, URLs, device IDs and geolocation; published in late May 2026. Source
Full stories
Official statements
- 20 Sep 2026CEC chair Ella Pamfilova said election attacks came mainly from abroad and none compromised voting systems. The Record
- 4 Jun 2026Russia's Supreme Court agreed to consider labelling Belarusian Cyber Partisans and Silent Crow extremist organisations. The Record
- 27 Feb 2026Roskomnadzor said a DDoS attack hit its own sites and the Defense Ministry's, with traffic mainly from botnets inside Russia. The Record
Incidents
7 of 7 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
 ✅ ConfirmedBeget | 1 Nov 2026 | Other | Intrusion | None | Confirmed. Beget said on Telegram that attackers wiped data across its cloud infrastructure, disrupting hundreds of websites. | The Record✓ 7 Nov |
 ✅ ConfirmedDodo Pizza | 29 Sep 2026 | Retail | Data leak | Confirmed. Dodo Pizza confirmed attackers accessed customer personal data and said it notified Roskomnadzor. Claimed. DataSuckers claimed records on 68 million customers and offered them for about 100,000 dollars. | The Record✓ 7 Nov | |
 ✅ ConfirmedWildberries | 10 Sep 2026 | Retail | DDoS | Confirmed. Wildberries said a DDoS attack triggered security measures that delayed seller payouts. Claimed. Ukraine's HUR intelligence agency claimed it ran a wider cyber operation against Wildberries with the group Cyber Corps. | The Record✓ 7 Nov | |
 ✅ ConfirmedKaluga AstralVia a vendor | 15 Jun 2026 | Other | Intrusion | None | Confirmed. Kaluga Astral confirmed a cyberattack that disrupted tax reporting, cash register and certificate services for about a week. | The Record✓ 7 Nov |
 ✅ ConfirmedRostelecom | 6 Apr 2026 | Telecom | DDoS | None | Confirmed. Rostelecom told TASS that a large-scale DDoS attack and its emergency filtering disrupted home internet in about 30 cities. | The Record✓ 7 Nov |
| ✅ ConfirmedRoskomnadzor, Defense Ministry and Main Radio Frequency Center | 27 Feb 2026 | Government | DDoS | None | Confirmed. Roskomnadzor said a complex multi-vector DDoS attack briefly disrupted access to its sites and those of the Defense Ministry and GRFC. | The Record✓ 7 Nov |
| ✅ ConfirmedDelta (alarm and security systems) | 26 Jan 2026 | Other | Intrusion | None | Confirmed. Marketing director Valery Ushkov confirmed a cyberattack that the company blamed on a hostile foreign state. Claimed. A Telegram channel claiming to be the attackers posted an archive of allegedly stolen data. | The Record✓ 7 Nov |
FAQ
Does Russia have a national cyber threat level?
No published national cyber threat level was found for Russia's cyber threat posture and 2026 incidents (checked 7 Nov 2026). Russia publishes no cyber alert level; officials report blocked attack counts and usually blame foreign states, often without public evidence.
Which organisations in Russia confirmed cyber incidents recently?
7 incidents confirmed since January 2026: Beget, Dodo Pizza, Wildberries, Kaluga Astral, Rostelecom, Roskomnadzor, Defense Ministry and Main Radio Frequency Center and Delta (alarm and security systems).
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.