DS9 S02E05 9:30

That's it.

#Thousands of consumer routers hacked by Russia’s military

##End-of-life routers in homes and small offices hacked in 120 countries.

The Russian military is once again hacking home and small office routers in widespread operations that send unwitting users to sites that harvest passwords and credential tokens for use in espionage campaigns, researchers said Tuesday.

An estimated 18,000 to 40,000 consumer routers, mostly those made by MikroTik and TP-Link, located in 120 countries, were wrangled into infrastructure belonging to APT28, an advanced threat group that’s part of Russia’s military intelligence agency known as the GRU, researchers from Lumen Technologies’ Black Lotus Labs said. The threat group has operated for at least two decades and is behind dozens of high-profile hacks targeting governments worldwide. APT28 is also tracked under names including Pawn Storm, Sofacy Group, Sednit, Tsar Team, Forest Blizzard, and STRONTIUM.

###Technical sophistication, tried-and-true techniques

A small number of routers were used as proxies to connect to a much larger number of other routers belonging to foreign ministries, law enforcement, and government agencies that APT28 wanted to spy on. The group then used its control of routers to change DNS lookups for select websites, including, Microsoft said, domains for the company’s 365 service.

“Known for blending cutting-edge tools such as the large language model (LLM) ‘LAMEHUG’ with proven, longstanding techniques, Forest Blizzard consistently evolves its tactics to stay ahead of defenders,” Black Lotus researchers wrote. “Their previous and current campaigns highlight both their technological sophistication and their willingness to revisit classic attack methods even after public exposure, underscoring the ongoing risk posed by this actor to organizations worldwide.”

To hijack the routers, the attackers exploited older models that hadn’t been patched against known security vulnerabilities. They then changed DNS settings for select domains and used the Dynamic Host Configuration Protocol to propagate them to router-connected workstations. When connected devices visited the selected domains, their connections were proxied through malicious servers before reaching their intended destination.

These adversary-in-the-middle servers used self-signed certificates. When the end user clicked through browser warnings, the servers captured all traffic passing through them. Among other things, they collected OAuth tokens and other credentials set after users, unaware their connections were being tapped, completed multifactor authentication.

The operation began in May 2025 on a limited number of devices. Then, in August, Britain’s National Cyber Security Center released an alert that documented a malware campaign a threat group was using to “intercept and exfiltrate Microsoft Office account credentials and tokens.” The following day, the threat group rapidly stepped up the router hijacking, an activity it continued to ramp up in the coming months.

Over a four-week period starting on December 12, Black Lotus observed more than 290,000 distinct IP addresses sending at least one DNS request to the malicious APT28 DNS resolver. “This suggested that as one capability was disclosed, the actor immediately shifted to another to continue acquiring authentication material,” company researchers wrote.

Black Lotus described the methodology this way:

1. DNS changes were then propagated to the workstations on the adjacent LAN via Dynamic Host Configuration Protocol (DHCP).
2. The actor operated a DNS server to behave like a typical recursive resolver, but when a targeted Fully Qualified Domain Name (FQDN) was queried, it was configured to provide a record back containing its own IP address instead of the correct address. The only interventions were triggered by domains associated with authentication-related services. If any other domain was requested, traffic passed directly through.
3. The actor ran a proxy service as the AitM that the end user was directed to via DNS. The only sign of this attack would be a pop-up warning about connecting to an untrusted source because of the “break and inspect.”
4. If warnings were present and ignored or clicked through, the actor proxied requests to the legitimate services, collecting the data at the midpoint and collecting data associated with the targeted account by passing the valid OAuth token. This allowed the actor to break and inspect traffic and access authentication material such as Oauth tokens after completing the multifactor challenge.

APT28 has a history of hacking routers. In 2018, researchers discovered 500,000 of the devices, mostly located in the US, were infected with malware tracked as VPNFilter. In 2024, the US Justice Department caught the group doing it again.

The easiest way for people to know if their router has been compromised in the operation is to review the current DNS settings to see if they list unrecognized servers. Users should also check event logs for any unrecognized changes to DNS server settings. People should also strongly consider replacing end-of-life routers with ones that receive regular security updates. People should never click through browser alerts warning of untrusted TLS certificates.

– Dan Goodin Senior Security Editor

I replied that [email protected] is a Russian pretending to be an American, that I have screenshots of him saying shit like "reality has a well known Russian bias". Proceed to get banned, because "you're accusing everyone of being Russian".

Well, no. Just the people vocally agreeing with Russian propaganda while pretending to be American.

##Ukraine is telling its citizens not to register Starlink terminals for Russian forces.

##The country struck a deal with SpaceX last week that effectively blocks Russian access to Starlink.

##Officials say Russians are threatening or offering money to Ukrainians to register terminals for them.

Kyiv officials warned that Ukrainians might be coerced into registering Starlink terminals for the Kremlin's forces after a recent block on Russia's access to the service.

Ukraine's auxiliary body for handling prisoners of war posted a notice on Tuesday saying that it had learned of multiple instances where families of Ukrainian prisoners were threatened and told to enroll such terminals.

The warning comes after Ukraine's defense ministry reached a deal with SpaceX earlier this month to cut off Russia's access to Starlink by blocking general connectivity across Ukrainian territory.

"Looking for a way out of the difficult situation in which they found themselves, the occupiers turned their attention to the families of the prisoners," the Coordination Headquarters for the Treatment of Prisoners of War wrote in a statement.

"Cases of threats and demands to officially register Starlink terminals have been recorded," it added.

To maintain Starlink access, Ukrainian troops, civilians, and businesses must register individual terminals to a "whitelist," either online or at municipal centers.

The sweeping move aimed to curb a black-market loophole that Russian forces were exploiting. In compliance with US sanctions, SpaceX doesn't do business with Russia, but Ukraine has repeatedly said that Russian troops were obtaining terminals and using them to guide attack and reconnaissance drones.

In its latest statement, the Coordination Headquarters for the Treatment of Prisoners of War said that officials could trace the registration of terminals that were later used by Russian forces because enrollment requires an ID.

"If the terminal is used to control drones that destroy infrastructure and take lives, the fact of registering the terminal by a citizen of Ukraine is grounds for criminal prosecution," the agency added.

Russia is not known to have a satellite internet service that compares to Starlink's in terms of speed, availability, and stability.

"For the enemy, Starlink is so important that they have deployed a whole network to search for traitors who are ready to register Starlink for themselves in the Central Administrative Service," wrote Serhii "Flash" Beskrestnov, a drone analyst and an advisor to Ukraine's defense ministry, in a Telegram statement on Sunday.

In some cases, Russian troops were offering up to $230 to register a single terminal, Beskrestnov added. That's roughly a third of the median monthly salary in Ukraine.

For the Kremlin's forces, the service disruption has been significant enough that pro-Russian military bloggers have reported that most Russian units now lack internet access. Some have blamed Moscow for what they called a reliance on Western technology, even as the US and Europe explicitly back Ukraine.

"It's about to suddenly become clear that units cannot operate effectively without communications. That'll be news to some in high places," one blogger, under the handle Belarusian Silovik, wrote.

Denying Russian access to Starlink had long been a priority for Ukraine's new defense minister, Mykhailo Fedorov, who had previously advocated such measures while serving as minister for digital transformation.

Pro-Kremlin propagandists are employing a range of disinformation tactics to deceive Ukrainians, including emotional manipulation, threats, and the creation of fake media outlets and AI-generated visuals. Notably, during the monitoring period, the primary strategy of these propagandists has shifted towards demoralising Ukrainians and spreading widespread discouragement

More news like this and less about orange clowns.

Wish the world made sense.

Published on 30 Sept 2025

Siberia is a very unique piece of territory that few people truly understand. Due to Russia's war against Ukraine, some interesting trends have emerged in Siberia. In this video, I draw a line through Siberia's dark history, from the Russian Empire, to the Soviet Union, to the Russian Federation. I ask the questions "Would Siberia ever want to secede, and if so, could they?" Then, to tie it all off, I bring China into the picture. Whatever happens, one thing is clear - history in the making is far more fascinating than we ever imagined.

The agency said the source of the interference had been traced to Russian territory, and also affected shipping. Other European nations have accused Russia of being behind the jamming, which Moscow denies.

North Karelia force says fence dividing Finland and Russia is no Berlin Wall – but it is now a key geopolitical faultline

... In an attempt to strike a note of optimism, he added: “We found a solution in 1944 and I’m sure that we will be able to find a solution in 2025.”

Matti Pitkäniitty, the commander of the North Karelia border guard district, believes illegal border crossings involving Russian defectors are likely to become a growing problem. Pointing to a gap in the vegetation where an old Finnish country lane passed through before the border was redrawn in 1940 after the Russo-Finnish war, resulting in Helsinki ceding part of Karelia, Pitkäniitty said most civilians trying to cross illegally preferred to stick to roads, limiting the number of potential routes.

“People are afraid of those thick forests here,” he said. But this would not be an issue for a Russian military professional trying to flee the war in Ukraine. “Now, one of the risks we are facing are the military-trained personnel fleeing the war. They of course know how to navigate through the woods and how to survive there if they need to stay out of sight for a couple of days.”

This is an old picture, I'm working up hunger to cook burgers today but the problem is the hungrier you get the less energy you'll have.

I got some beef and horse that I'm gonna mix, add a little beef fat to make a nice 75/25 mix i think or 80/20.

I want to eat to have energy to cook what a paradox

Calling out [email protected] obvious spam makes them delete my comment and ban me as a spammer.

A SINGLE COMMENT on their community is spam, but someone posting 10-minute reads every 5-minutes 247/365 isn't spam?

Honestly whoever mod this was, however fking stupid are you to let your emotions take over and admit I'm right by banning me for one comment calling out literal spam?

Ah, Lemmy is occasionally really entertaining (because unlike them, my life isn't on the line so I don't get upset like they seem to :D)

They're so insecure that they don't understand that banning me for calling out [email protected] as [email protected] proxy spam account is "bad faith".

How is it in bad faith? These people don't even understand the words of the rules they're using, lol.

Literally every accusation from them is an admission, and because I called out bad-faith users spamming links, I got banned supposedly for arguing in bad faith.

Feels like lemmy is mostly just russians, honestly, which is understandable as the pathetic fuckers can't engage anyone on any properly moderated forums

Don't know who bothers paying for these and why.

Not the best use of money I can think of, lol.

I've nothing to add.

Like a palms width away from the elbow, on the inside of your right forearm.

So... why do you have them?

But browsing active >95% of posts are by a user with literally "bot" in their name.

Might as well be reading the Google feed if I'm going to be reading a specific agenda by something, at least that's based on my interests and I can trust Google to put profit over everything, making their motives clearer than whatever the fuck is going on on Lemmy. (Cough tankies cough cough)

That's it. I'm looking for a specific bit, can't seem to find it. About a standup being impressed by a crusty old junkie tasting the sub-par quality of the drugs through injecting them?

It's not like the core of the bit, it's just on the sides iirc. It's someone like Tom Segura, John Mulaney, Jim Jefferies, uh... idk. I went through Ali Siddiq, Ari Shaffir, and a bunch of others. Tried using LLM's to help me search as well. Just can't seem to narrow it down, fucking brain full of weed can't remember anything clearly. Maybe Sam Morrill?

But I'm pretty sure there's a bit where a standup talks about some veteran drug user injecting either heroin/cocaine, probably cocaine iirc, and then sort of getting a bad taste in their mouth, and the comedian expressing how impressed they were that the user could taste the adulterants through the needle.

I hear the sarcastic tone, but ugh, can't recall who.

I'm just posting this on the off-chance someone just knows the bit and can tell me.

Edit found it it was Marc Maron and “the Legend of Frankie Bastille”

https://www.youtube.com/watch?v=ijThyoEH6oM

Took me a fucking while

That's kinda it.

Four years of photos, videos, notes and thoughts, recordings of my now passed dad and grandma, etc.

Last photos of my father, actually. Fuck.

Probably accidentally dropped it in the bin when I used it as a webcam one time when I was as drunk as a skunk. Then had no use for it between that and taking the thrash out. And that was a few weeks ago, so even dumpster diving wouldn't help now.

Hell, that guy looking for his bitcoin has waster years and millions.

I guess I can manage with photos other people have, I guess. I don't really have people to look at the photos with, so guess it shouldn't matter.

I'd be grateful if you could make me care less about my massive — but boring — fuckup.

Edit I'm trying to list things I probably won't miss. My notes are mostly incoherent brain farts I have over and over. And recordings of officials won't matter as no-one cares and they're too late for justice. Photos and videos, really. But I have no-one to browse them with so whatever.

I'll definitely pay more attention to backing up