OPSEC in 2026: An Anatomy of Failure

In 2017, SecureWorks researchers analyzed a cyberespionage toolkit attributed to APT28 and named it Scaramouche due to an unusual string found in the binaries’ PDB path¹. The exact origin of the operator was unknown. Three years later, Bellingcat published an attribution: the operator was identified as Dmitry Badin, an officer in GRU Unit 26165². The connection was not made through technical malware analysis. It was made by cross-referencing Badin’s vehicle registration, pointing to the unit’s headquarters at Komsomolsky Prospekt 20, with his phone number and recovered logs from a deleted VK account where the alias Scaramouche appeared as his personal handle years before he joined the GRU.

The operator compiled state-grade malware using the same alias he had registered as a teenager. The breakdown reads as a failure of compartmentalization between a pre-existing personal identity and the attack infrastructure, rather than a technical or operational error.

And the pattern repeats.

What We Do Not See

All the threat intelligence we have comes with a failure-selection bias. The cases documented in this analysis exclusively represent those who made mistakes. We only know the ones who failed.

Functional invisibility exists, but by definition, you cannot observe it. We can only study operators whose mistakes made them visible. The forensic evidence we rely on is a catalog of negligence, not a picture of the entire field.

Acknowledging this bias is the only honest way to analyze OPSEC. What follows is not a catalog of ghosts or a list of unreachable operators. It is an autopsy of personal failures that keep happening, often in operators who were technically competent but failed at managing their own identity.

The operational consequence of this bias is that any attempt to learn “what functional OPSEC does right” by generalizing from available cases tends to lead to wrong conclusions. Invisible operators do not necessarily share a methodology but they share a state that depends on circumstances. What this post lays out is not a recipe for emulating the invisible. It is an analysis of the specific bridges that brought the visible ones down, and what that means for anyone operating online today.

Public attribution in this field comes with a clear geographic bias. Individual identities of state APT operators are almost exclusively the work of Bellingcat, Intrusion Truth, and Western agencies. Technical analysis of TTPs is distributed across global firms such as Kaspersky GReAT, Trend Micro, ESET and Group-IB. The asymmetry does not seem accidental. It appears to reflect which firms can attribute which state actors without professional or jurisdictional consequences. What follows triangulates between the two sides where it can. Where it cannot, it says so.

The Russian Model

The GRU’s structure appears to operate on the assumption that attribution is inevitable. Its OPSEC seems to rely not on absolute anonymity, but on jurisdictional immunity. As long as the operator remains within Russian borders, technical or personal attribution carries no direct legal consequences inside Russia. Indirect consequences through Western sanctions and travel restrictions exist and can disrupt specific operations, but they do not stop the program³.

Trend Micro, which has tracked Pawn Storm continuously since 2014, frames this in its 2020 research: the group does not avoid simple, non-sophisticated attack methods when those methods remain effective⁴. The DNS hijacking technique used in FrostArmada in 2025 is over twenty years old. ESET reached a similar conclusion in its two-year research of the Sednit toolkit (2014-2016). The group’s high-end implants were technically advanced, but its operational methods relied on phishing infrastructure that was already documented and publicly burned⁵.

Relying on jurisdiction this way appears to produce systematic procedural negligence. In 2018, the Skripal investigation revealed that GRU officers traveled with passports issued by Central Migration Office Unit 770001, with passport numbers separated by only a few consecutive digits between operators on the same operations⁶. Identifying one officer made it possible to enumerate others through proximity in the issuing series. That same year, Bellingcat (working with the Russian outlet The Insider) identified Komsomolsky Prospekt 20 as the headquarters of Unit 26165, then cross-referenced that address against leaked Russian vehicle registration databases on the black market and identified 305 individuals (aged 27 to 53) who had registered personal vehicles at that location, with full names, passport entries, and mobile phone numbers exposed⁷. In April 2020, the German Federal Prosecutor (Generalbundesanwalt) issued an international arrest warrant against Dmitry Badin for his alleged role in the 2015 Bundestag hack, adding independent attribution to Unit 26165⁸.

The cyberespionage model shows the same weakness. The operator does not need to hide from their own government, so they accumulate a digital footprint under their real identity. When a cross-domain bridge connects that personal identity to an operational element (like a teenage alias reappearing in a PDB path) attribution cascades across the entire accumulated footprint.

The model appears built for sustained offensive capability and speed, rather than for individual anonymity. Attribution is relatively accessible (Bellingcat has shown this many times over recent years) but it produces limited operational impact as long as the operator remains within Russian borders. The structural weakness of the model is external attribution through personal data residue. Compared to the contractor model we will see next, its relative stability comes from lower exposure to massive internal leaks.

The Chinese Model

The PRC cyberespionage architecture appears to delegate a significant volume of its operations to a network of private contractors. This separation creates a different kind of OPSEC failure compared to the Russian model.

Significant parts of the contractor model have been taken apart over the last decade through basic administrative errors. Boyusec (APT3) was exposed through WHOIS data on C2 domains, which led to the names of Wu Yingzhuo and Dong Hao⁹. Wu had even advertised online offering help with trojan development. Both names were then matched against PRC corporate records that listed them as shareholders of the same company, Boyusec, which had been previously linked to the MSS. Huaying Haitai (APT10) was exposed through a different type of pivot. Cyber threat intelligence analysts discovered two Uber receipts¹⁰. The first showed APT10 actor Gao Qiang traveling at the end of the working day from the office of Huaying Haitai (384 Jiefang South Road, Tianjin) to a residential area in the Xiqing District. The second showed travel from that same residential area to 85 Zhujiang Road, the headquarters of the TSSB, a regional arm of the MSS¹¹. The Uber account also used an alternate alias Pig, but kept the same QQ email address across receipts.

In Chengdu 404 (APT41), the separation between civil and operational identity was minimal at best¹². Steam’s social graph mapped the internal connections. The account c0hb1rd (associated with Chengdu 404) had seven friends on the platform. One of them was standny, the alias of Fu Qiang, an employee and founding member of Chengdu 404 indicted by the DOJ. standny himself had only one friend on Steam: c0hb1rd¹². Fu Qiang continued to operate publicly under the standny handle, including app promotion on Twitter, well after the September 2020 DOJ indictment¹³.

The I-SOON leak documents this model from the inside¹⁴. Wu Haibo, operating under the alias shutd0wn (a handle he had used in the Chinese hacking scene since the late 1990s as part of the Green Army movement), founded i-SOON in 2010¹⁴. Thousands of leaked WeChat logs, sent without end-to-end encryption, show the bureaucratic routine of cyberespionage. The chat logs between Wu Haibo and Chen Cheng (alias lengmo) reveal coordinated bidding practices with Chengdu 404, formalized in the PRC ecosystem as 陪标¹³. According to Natto Thoughts’ analysis, i-SOON acted as a vendor for multiple MSS and MPS bureaus across China¹⁴.

The Wire China, examining the leaked documents directly, confirmed that i-SOON and Chengdu 404 operated as “business partners as well as competitors, supplying each other with technical services” and occasionally “conspiring to manipulate government contract bidding processes.”¹⁵ This is not foreign attribution. It is the contractor ecosystem documenting itself in its own internal communications. ESET’s Mathieu Tartare, who has tracked Winnti operations for years, puts the conclusion clearly: “Around 2019, we realized Winnti Group was an umbrella. It didn’t mean anything, as there are a lot of different actors using the same malware.” The Chinese ecosystem appears to operate not as a single APT but as a market, and shared codebases together with shared infrastructure are what a market ends up producing.

This internal asymmetry appears to be what holds the entire ecosystem together. When Intrusion Truth tried to identify the direct MSS liaison officers mentioned in internal leaks (referred to only as Chief Cui or Chief Wen), they found practically nothing. As the collective pointed out, this gap probably reflects “the level of personal OPSEC one would expect from the MSS.” The State had OPSEC. The contractors did not.

The plausible deniability of the PRC contractor model does not appear to come from hidden operators. It appears to come from genuinely normal operators working in genuinely real companies with genuinely real commercial portfolios. Their cover looks the same as commercial reality because part of it actually is reality. The main observable failure vector of this model so far has not been external attribution but the unhappy insider. The I-SOON and Knownsec leaks were published eighteen months apart. The pattern of insider leaks appears to be the main failure mode of this model.

The Russian and Chinese models differ in architecture. But they share a characteristic that the rest of this analysis will build upon: both appear to collapse mainly through cross-domain bridges between a pre-existing personal identity and the operation. That observation is not exclusive to the state apparatus.

The Public Profile Paradox

The common assumption is that APT operators work from absolute invisibility. Forensic evidence consistently shows the opposite. Operators maintain LinkedIn/Maimai profiles, active GitHub/Gitee repositories, publish academic papers, compete in CTFs, and maintain a complete digital footprint under their real identities.

The case of Olga Kolobova, a GRU officer operating in Italy from around 2011 and based in Naples from 2015 under the fabricated identity of Maria Adela Kuhfeldt Rivera, shows the problem from the other side. Kolobova became secretary of the Lions Club Napoli Monte Nuovo, a club that had been founded by a Naples-based NATO officer, and from that position she cultivated relationships in Italian diplomatic and military circles, including frequent social interactions with NATO and US Navy staff. Bellingcat established her likely GRU affiliation in late 2021, building on the consecutive-passport analysis published after Skripal in 2018¹⁶. What pointed to the attribution was not an operational error. It was negative data. Kolobova had no digital footprint in Moscow databases prior to November 2018, and only minimal traces in regional databases from years earlier. She then suddenly and actively appeared at the same time as her extraction from Italy.

In the 2026 intelligence ecosystem, total invisibility is not always protection. It can become a radar ping that confirms suspicions that were already there.

The rule works in both directions: invisibility is a signal on one end, exhaustive presence is attack surface on the other. What matters is not the amount of footprint, but the cross-domain traceability from the operation.

A pattern comes out of this evidence: functional OPSEC seems to operate not on the invisible/visible axis but on the traceable/untraceable axis from the operation.

Normality is not a cover but the background condition needed to exist on the network. Most pieces of legitimate digital presence look the same as the profile of any given professional, and that is why the cover tends to work. That is, until a single operational pivot activates the entire accumulated footprint as attribution evidence. What separates the operator with strong personal OPSEC from the one who ends up exposed in an indictment is a single variable: the discipline to leave no pivotable bridges between their real identity (which is inevitably normal and documented) and their operational output.

This strategy carries a cost. The more legitimate public profile an operator accumulates to sustain their normality, the bigger the correlation surface available after the pivot. OPSEC based on normality is statistically stable until the exact moment it is not. The instant the researcher finds the bridge (a recovery email, a recycled alias, a commit signed with a reused key) the entire profile turns against the operator with all the force accumulated through years of normality.

The 305 GRU officers did not fall one by one in individual investigations. They fell simultaneously the day a researcher cross-referenced the Unit 26165 headquarters address with a leaked Russian vehicle registration database circulating on the black market. The entire public profile built over years was turned against them in the time it takes to execute an SQL query.

When Defenders Become Targets

The same diagnostics that explain OPSEC failures in state operators also apply to their counterparts on the defensive side. The techniques that expose APTs are the same ones criminal actors apply against the analysts hunting them.

Starting in 2022, parts of the criminal ecosystem began industrializing the exploitation of individual identities. They showed that a structural vulnerability of many defenses lies not in the network, but in the person behind the console.

The Conti and TrickBot internal leaks in February 2022 documented systematic monitoring of threat intel researchers and security firms. Brian Krebs is repeatedly named in Conti’s internal chats¹⁷. The operators studied their analysts as carefully as the analysts studied them.

The tactic escalated to direct confrontation. In August 2025, the Scattered LAPSUS$ Hunters (SLSH) coalition appeared, an alliance combining elements of UNC3944 (Scattered Spider/Octo Tempest), LAPSUS$, and ShinyHunters under a shared public identity that appeared across at least sixteen Telegram channels documented by Trustwave SpiderLabs. Its operators ran public intimidation campaigns that included threats against company executives (notably the CEO of CrowdStrike), insider recruitment offers across the insurance, finance, automotive, hospitality and telecommunications sectors, and the publication of stolen internal screenshots from a fired CrowdStrike employee. In February 2026, the operator known as Dort (linked to the Kimwolf botnet) coordinated a swatting attack against Benjamin Brundage¹⁸. Brundage is the founder of Synthient and the researcher whose work led KrebsOnSecurity to publish the vulnerability behind the operation. Brundage had performed responsible disclosure but Dort responded with DDoS, doxing, email flooding, and a SWAT team sent to his home. Brian Krebs, who covered the investigation, was simultaneously targeted with the first three tactics.

Many adversaries shifted from attacking the perimeter to attacking the people defending it. The defender’s personal OPSEC became an increasingly relevant compromise vector.

This same understanding of human vulnerability is part of what enabled the perimeter collapse on a corporate scale during 2025-2026. It applies to the individual researcher, to the plant engineer, to the developer, to the federated identity administrator.

This is not a local reading. Group-IB’s High-Tech Crime Trends Report 2026, published in February with telemetry from Digital Crime Resistance Centers in 11 countries, frames the same shift. As Group-IB’s CEO Dmitry Volkov put it: “Cybercrime is no longer defined by single breaches. It is defined by cascading failures of trust.”¹⁹ The report identifies OAuth token abuse, malicious browser extensions, open-source package poisoning, and SaaS supply chain compromise as central vectors of 2026. The corporate perimeter has not weakened in absolute terms. It has been bypassed by the trust relationships the perimeter does not see.

Between August 8 and August 18, 2025, the compromise of OAuth tokens from the Salesloft Drift integration affected over 700 organizations using that integration²⁰. The attackers (designated as UNC6395 by Google Threat Intelligence Group and as GRUB1 by Cloudforce One) exported large volumes of data via the Salesforce Bulk API²⁰. They bypassed MFA by directly using valid OAuth tokens without the need for interactive authentication. Cloudflare reported 104 of its own API tokens that customers had pasted as plain text inside support case fields²¹. The case text fields had no controls to prevent users from pasting secrets, even though Cloudflare does not request or require this kind of input.

Joint advisory CISA AA26-097A, published on April 7, 2026, by six federal agencies (FBI, CISA, NSA, EPA, DOE, and U.S. Cyber Command CNMF), documented operational disruption and financial loss in US critical infrastructure across the government services, water and wastewater, and energy sectors²². Iranian-affiliated APT actors (linked to IRGC-CEC and previously tracked as CyberAv3ngers, Shahid Kaveh Group, Hydro Kitten, Storm-0784, BAUXITE, and UNC5691) accessed internet-exposed Rockwell PLCs (CompactLogix and Micro850) using Studio 5000 Logix Designer, the same engineering software used for legitimate operations. CISA added CVE-2021-22681 (a five-year-old authentication bypass vulnerability in Logix controllers) to its KEV catalog in March 2026. The headline mitigation in the advisory is to set the physical mode switch on the controller to RUN. This is the only control surface that the CIP protocol cannot override remotely.

Operation Masquerade, announced on April 7, 2026, by the DOJ and FBI, neutralized the U.S. portion of a GRU infrastructure (Unit 26165, APT28/Forest Blizzard)^{23 24 25}. This infrastructure had compromised 18,000 SOHO TP-Link routers worldwide and infiltrated more than 200 organizations through them^{26 27}. The operators exploited CVE-2023-50224 to gain access, then executed AiTM attacks against Microsoft 365 authentication domains, including Outlook Web Access, to harvest credentials and OAuth tokens from targets in the military, government, and critical infrastructure sectors. Brett Leatherman, deputy assistant director of the FBI’s Cyber Division, put it directly:

The GRU compromised a vast number of household routers in the US and around the world, as well as those used by small and medium sized businesses, to access high-value intelligence targets.

— Brett Leatherman

The implication extends beyond hardware. A professional digital identity with established reputation is operational raw material. Once compromised, it is reused as adversarial infrastructure: spear phishing from your account against your contacts, infrastructure purchased under your stolen identity, professional accounts hijacked to run reconnaissance against colleagues who trust the handle. Personal identity is not only a target to protect. It is an adversarial resource.

On March 31, 2026, during a three-hour window (00:21–03:20 UTC), attackers distributed malware via the NPM Axios package²⁸. This package sees roughly 100 million weekly downloads and is present in approximately 80% of cloud environments according to Wiz²⁹. The attackers published malicious versions (1.14.1 and 0.30.4) after a full account takeover of the lead maintainer’s NPM account, achieved through a sophisticated social engineering campaign. They changed the maintainer’s registered email before publishing. Although the project had adopted OIDC Trusted Publishing for its GitHub Actions workflow, NPM still defaulted to a long-lived legacy NPM_TOKEN that remained active for compatibility, allowing the attackers to bypass the OIDC verification controls and publish through a direct CLI flow instead of the trusted publisher flow. Google Threat Intelligence Group attributed the operation to UNC1069, a financially motivated actor linked to North Korea, through the deployment of the cross-platform WAVESHAPER.V2 backdoor²⁸. SILKBELL, the dropper preceding WAVESHAPER.V2, included an automatic anti-forensic routine. After deploying the payload, it deleted setup.js, removed the postinstall hook from the manifest, and replaced package.json with a clean copy. DFIR teams that arrived after detection found no trace of the original vector without historical network telemetry. Trend Micro placed the incident in a bigger pattern of compromises targeting the same weakness: developer-stored credentials in CI/CD systems and package registries.³⁰

Gartner estimates global cybersecurity spending at $213 billion for 2025, with an estimate of $240 billion for 2026³¹. The incidents documented above happened in organizations whose security budgets made up a significant part of that figure.

The documented vectors are reused credentials, over-permissive OAuth tokens, internet-exposed PLCs without proper segmentation, industrial controllers with physical switches left in remote programming mode, long-lived NPM tokens bypassing OIDC due to legacy configurations, and free-text fields where users could paste secrets.

None of these required a zero-day. Each one matches a commercially available product category. CASB and SSPM for OAuth abuse in SaaS. PAM and secrets management for long-lived tokens. ITDR and conditional access for AiTM against federated identity. EDR and NDR for endpoint and network lateral movement. ASM for external attack surface exposure. OT-specific monitoring for PLC environments. The affected organizations included Cloudflare, Google, Palo Alto Networks, and Zscaler, companies that themselves sell or operate at the front line of security tooling, and none of them lacked budget in these categories.

LINDDUN and Privacy-by-Default

These vectors are not new problems without solutions. They are old problems against which the industry has already specified countermeasures. To see why those countermeasures are not deployed at scale, the analysis has to shift from incident catalog to design methodology.

Threat modeling in the corporate ecosystem is predominantly done using STRIDE. STRIDE models security threats to systems. LINDDUN models privacy threats within systems³².

Both methodologies are valid, but they solve different problems. A individual’s OPSEC in 2026 is a problem of people within systems, where the operator is simultaneously vector and target.

Applying LINDDUN to the current ecosystem (taking four of its seven threat categories), the perimeter collapse reads not as a code failure but as a privacy-by-design failure:

• Linking: Cross-domain pivots destroy compartmentalization. The attacker connects civilian life to critical infrastructure.
• Identifying: Building the social graph is trivial when there is zero hygiene in profile separation.
• Data Disclosure: The market of data brokers ensures that the raw material to profile a target is publicly available.
• Non-compliance: Article 25 of the European GDPR³³, which requires data protection by design and by default, has been legally binding since May 2018. Eight years later, many organizations affected by the incidents documented in the previous section still treat the concept as a compliance checkbox rather than an architectural principle.

LINDDUN PRO turns this analysis into DFDs. Every interaction between system components is checked against the seven threat categories. The methodology is not abstract. It produces a mapped inventory of where each privacy threat materializes in the actual data flow. The Salesloft Drift incident is a textbook LINDDUN PRO failure. The OAuth data flow between Drift and Salesforce, which crossed a trust boundary, was not modeled as a privacy-relevant data flow, which is why customer support text containing API tokens passed through it without alerts. A LINDDUN PRO analysis would have caught the disclosure threat at the trust boundary before deployment.

The architectures that would block a large part of the documented vectors already exist and are fully specified. FIDO2/WebAuthn cryptographically binds each authentication to the origin verified by the browser³⁴. An AiTM proxy cannot obtain valid signatures because the user’s authenticator refuses to interact with any domain other than the original. DPoP (RFC 9449) binds each OAuth token to a client cryptographic key³⁵. A token exfiltrated from external infrastructure would require a signature with the private key held only by the legitimate client. DBSC, a Google proposal currently going through W3C standardization, does the equivalent for session cookies³⁶. It ties the proof of possession to the device’s TPM or secure area, ensuring a cookie stolen by an infostealer is not reusable outside the original hardware.

In 2026, FIDO2 adoption outside of Big Tech remains marginal in the private sector. DPoP sees limited deployment despite being approved as an RFC in September 2023. DBSC is barely beginning experimental adoption. The specifications exist. European regulation has implicitly required them since 2018. Most of the industry has not deployed them at scale.

Most incidents in the previous section have a specific architectural equivalent that already exists. Without privacy-by-default at the system level, the weight of discipline falls on the individual. Every user, every employee, every professional assumes the OPSEC cost that the system should have implemented by design.

Operational Execution

Executing any mitigation requires defining an individualized threat model first. Rushing is a vulnerability in itself. Taking the time to map out the model before executing the first operational change is critical. Moving without defining what is being protected, who it is being protected from, and under what jurisdiction one operates only generates a false sense of security and a waste of resources.

The risk profile is not symmetrical. The exposure of a systems engineer in an OT infrastructure differs from that of an OSINT analyst or a front-end developer. Functional OPSEC is not an absolute state. It is a resource allocation proportional to the anticipated adversary.

Under any model, the guiding principle is reducing the attack surface, not accumulating tools. Attempting to solve an architectural problem by piling up applications is a design flaw. Each additional layer often fails to mitigate risk and instead expands the exposure surface and adds supply chain dependencies. The only exception is intentional redundancy. Accepting the friction cost of maintaining two isolated parallel systems can be strategically superior to relying on a single weak solution for a critical vector. Security is built by subtracting, not adding.

For tactical execution, the community and industry professionals maintain four widely used operational references:

1. Privacy Guides: An open-source community that maintains software, service, and practice recommendations with explicit criteria. These include a preference for open-source code, documented threat models, and no commercial ties with vendors. It is the entry point for implementing privacy-by-default in hardware, operating systems, and everyday communications.
2. Surveillance Self-Defense (Electronic Frontier Foundation): Maintained by EFF since 2009, with continuous updates throughout 2025 and 2026. Its value is not the tool catalog, which shares ground with Privacy Guides, but the way it presents the method. SSD treats threat modeling as the foundation that everything else depends on, with security scenarios calibrated by adversary type rather than by tool category. It is the institutional reference for moving from generic privacy advice to threat-model-driven decisions.
3. Freedom of the Press Foundation: Operates digital security training for thousands of professional journalists, with an annually updated checklist (the latest is from December 2025, calibrated for 2026). Its scope is wider than the journalist label suggests. Risk assessment for sensitive work, account hardening, source protection, online harassment readiness, and data broker opt-out are common to anyone working under adversarial pressure. The checklist format is the operational complement to the way SSD frames the method.
4. Michael Bazzell: Mostly relevant for high-risk threat models, such as stalking victims, journalists in hostile jurisdictions, or professionals facing explicit personal risk. His protocols cover physical and financial unlinking, the systematic deletion of traces from data brokers, and the isolation of assets through anonymous corporate structures. They also cover defensive self-OSINT: applying open-source intelligence techniques to one’s own identity to detect exposed attack surface before an attacker does.

These four resources do not replace the operator’s personal discipline. They help to structure it. The information is out there, but what’s difficult is the ability to keep executing over time.

The Long View

Functional OPSEC tends to be invisible by design. The dark zone of unattributed operators exists, but their anonymity is not a permanent state or something out of reach. It is the temporary result of three factors at the same time: the lack of cross-domain bridges in their infrastructure, the defensive analyst’s opportunity cost (prioritizing incidents with higher immediate impact), and pure statistical luck against internal leaks.

Given enough exposure time, most covers break down. Exposed operators fall under one of the three documented vectors: the administrative footprint of a friendly jurisdiction, the commercial negligence of contractor infrastructure, or the data residue left behind by acting normal.

The same diagnostics apply outside the operator’s world. Anyone who maintains a professional digital identity, a public contribution history, or simply online presence under their real name is playing the same game with smaller stakes but the same rules. The cross-domain pivot does not care whether the target is a GRU officer, a security researcher, a journalist, or a developer.

The technical debt of personal identity does not expire.

The alias you registered at fourteen is still load-bearing.

The distinction between observer and observed, in this field, is not categorical.

Observation is merely the prerequisite for prepositioning.

References

1. SecureWorks (2017) - “IRON TWILIGHT Supports Active Measures” - https://www.secureworks.com/research/iron-twilight-supports-active-measures ↩

2. Bellingcat (2020) - “Who Is Dmitry Badin, The GRU Hacker Indicted By Germany Over The Bundestag Hacks?” - https://www.bellingcat.com/news/2020/05/05/who-is-dmitry-badin-the-gru-hacker-indicted-by-germany-over-the-bundestag-hacks/ ↩

3. U.S. Department of Justice (2018) - “U.S. Charges Russian GRU Officers with International Hacking and Related Influence and Disinformation Operations” - https://www.justice.gov/opa/pr/us-charges-russian-gru-officers-international-hacking-and-related-influence-and ↩

4. Trend Micro/Feike Hacquebord & Lord Alfred Remorin (2020) - “Pawn Storm’s Lack of Sophistication as a Strategy” - https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html ↩

5. ESET (2016) - “En Route with Sednit” whitepaper series - https://www.welivesecurity.com/2016/10/20/new-eset-research-paper-puts-sednit-under-the-microscope/ ↩

6. Bellingcat (2018) - “Skripal Suspects Confirmed as GRU Operatives: Prior European Operations Disclosed” - https://www.bellingcat.com/news/uk-and-europe/2018/09/20/skripal-suspects-confirmed-gru-operatives-prior-european-operations-disclosed/ ↩

7. Bellingcat (2018) - “305 Car Registrations May Point to Massive GRU Security Breach” - https://www.bellingcat.com/news/uk-and-europe/2018/10/04/305-car-registrations-may-point-massive-gru-security-breach/ ↩

8. Generalbundesanwalt/Auswärtiges Amt (2020) - International arrest warrant against Dmitry Badin for participation in the 2015 Bundestag hack - https://www.auswaertiges-amt.de/de/newsroom/hackerangriff-bundestag/2345542 ↩

9. Intrusion Truth (2017) - “APT3 is Boyusec, a Chinese Intelligence Contractor” - https://intrusiontruth.wordpress.com/2017/05/09/apt3-is-boyusec-a-chinese-intelligence-contractor/ ↩

10. Intrusion Truth (2018) - “APT10 was managed by the Tianjin bureau of the Chinese Ministry of State Security” - https://intrusiontruth.wordpress.com/2018/08/15/apt10-was-managed-by-the-tianjin-bureau-of-the-chinese-ministry-of-state-security/ ↩

11. U.S. Department of Justice (2018) - “Two Chinese Hackers Associated With the Ministry of State Security Charged with Global Computer Intrusion Campaigns” - https://www.justice.gov/archives/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion ↩

12. Intrusion Truth (2022) - “Chengdu 404” - https://intrusiontruth.wordpress.com/2022/07/22/chengdu-404/ ↩ ↩²

13. U.S. Department of Justice (2020) - “Seven International Cyber Defendants, Including ‘Apt41’ Actors, Charged In Connection With Computer Intrusion Campaigns” - https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer ↩ ↩²

14. Natto Thoughts (2023) - “i-SOON: Another Company in the APT41 Network” - https://nattothoughts.substack.com/p/i-soon-another-company-in-the-apt41 ↩ ↩² ↩³

15. The Wire China (2024) - “Hacking the Hackers” (i-SOON/Chengdu 404 leak analysis) - https://www.thewirechina.com/2024/03/03/hacking-the-hackers-i-soon-chengdu-404-data-leak/ ↩

16. Bellingcat (2022) - “Socialite, Widow, Jeweller, Spy: How a GRU Agent Charmed Her Way Into NATO Circles in Italy” - https://www.bellingcat.com/news/2022/08/25/socialite-widow-jeweller-spy-how-a-gru-agent-charmed-her-way-into-nato-circles-in-italy/ ↩

17. Krebs on Security (2022) - Conti Ransomware Group Diaries - https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-i-evasion/ ↩

18. Krebs on Security (2026) - “Who is the Kimwolf Botmaster Dort?” - https://krebsonsecurity.com/2026/02/who-is-the-kimwolf-botmaster-dort/ ↩

19. Group-IB (2026) - “High-Tech Crime Trends Report 2026: Supply Chain Attacks Emerge as Top Global Cyber Threat” - https://www.group-ib.com/landing/high-tech-crime-trends-report-2026/ ↩

20. Cloudflare (2025) - “The impact of the Salesloft Drift breach on Cloudflare and our customers” - https://blog.cloudflare.com/response-to-salesloft-drift-incident/ ↩ ↩²

21. Google Threat Intelligence Group/Mandiant (2025) - “Widespread Data Theft Targets Salesforce Instances via Salesloft Drift” - https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift ↩

22. CISA (2026) - “Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (AA26-097A)” - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a ↩

23. U.S. Department of Justice (2026) - “Justice Department Conducts Court-Authorized Disruption of DNS Hijacking Network Controlled by a Russian Military Intelligence Unit” - https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-dns-hijacking-network-controlled ↩

24. NSA (April 7, 2026) - “NSA Supports FBI in Highlighting Russian GRU Threats Against Routers” - https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4453919/ ↩

25. FBI Internet Crime Complaint Center (2026) - “PSA-260407: Russian GRU Exploiting Vulnerable Routers to Steal Sensitive Information” - https://www.ic3.gov/PSA/2026/PSA260407 ↩

26. Microsoft Security Blog (2026) - “SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks” - https://www.microsoft.com/en-us/security/blog/2026/04/07/soho-router-compromise-leads-to-dns-hijacking-and-adversary-in-the-middle-attacks/ ↩

27. Lumen Black Lotus Labs (2026) - “FrostArmada: Forest Blizzard DNS Hijacking” - https://www.lumen.com/blog-and-news/en-us/frostarmada-forest-blizzard-dns-hijacking ↩

28. Google Threat Intelligence Group/Mandiant (2026) - “North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack” - https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package ↩ ↩²

29. Wiz Research (2026) - “Axios NPM Distribution Compromised in Supply Chain Attack” - https://www.wiz.io/blog/axios-npm-compromised-in-supply-chain-attack ↩

30. Trend Micro (2026) - “Axios NPM Package Compromised: Supply Chain Attack Hits JavaScript HTTP Client with 100M+ Weekly Downloads” - https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html ↩

31. Gartner (2025) - “Forecast: Worldwide End-User Spending on Information Security to Total $213 Billion in 2025” - https://www.gartner.com/en/newsroom/press-releases/2025-07-29-gartner-forecasts-worldwide-end-user-spending-on-information-security-to-total-213-billion-us-dollars-in-2025 ↩

32. LINDDUN PRO - privacy threat modeling methodology maintained by KU Leuven - https://linddun.org/pro/ ↩

33. GDPR - Article 25: Data protection by design and by default - https://gdpr-info.eu/art-25-gdpr/ ↩

34. W3C (2021) - “Web Authentication: An API for accessing Public Key Credentials Level 2” - https://www.w3.org/TR/webauthn-2/ ↩

35. IETF (2023) - “RFC 9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP)” - https://datatracker.ietf.org/doc/html/rfc9449 ↩

36. W3C (2026) - “Device Bound Session Credentials” (working draft) - https://w3c.github.io/webappsec-dbsc/ ↩