Sberbank

Digital Surveillance in Your Pocket: Audit Uncovers Tracking and Weak Cryptography in 11 Top Russian Android Apps

An independent security researcher conducted a static analysis and passive logcat review of 11 popular Russian Android applications from banks, government services, marketplaces, and navigation tools. The audit identified 237 vulnerabilities in total, including six apps signed with outdated RSA-1024 or DSA-1024 keys that violate current NIST standards. VK led the risk ranking with 11 trackers and a 98/100 surveillance score, while Gosuslugi transmitted analytics signals to VK, Yandex, Google, and Huawei ecosystems. Five apps used WebRTC ICE candidate leaks to detect VPN usage, potentially bypassing user privacy protections. Only Goskluch scored low at 42.4/100 by limiting trackers to two, avoiding VPN detection, and using a compliant RSA-2048 signing key. The methodology relied solely on MobSF, jadx, and logcat without bypassing SSL pinning or requiring root access.

Metascan Confirms Limited Data Breach After Two-Minute Telegram Bot Compromise

Metascan has publicly acknowledged a data breach involving internal materials obtained through a compromised Telegram bot token. The attacker gained access to a corporate Telegram chat for approximately two minutes on September 5 and exported a small set of documents before being removed. The incident stemmed from an overlooked bot token on test virtual machines after an employee departure. Among the leaked items were two pilot project reports from July 2026 that mentioned major Russian organizations including Transneft, Selectel, Lenta, Sberbank, and Rostelecom. Metascan attributed the leak to a former employee now working with a competitor and rejected claims of deliberately hidden vulnerabilities. The company has accepted full responsibility, outlined corrective measures, and launched a bug bounty program.

Why Legitimate Russian Websites Fail to Load With or Without VPN: TSPU RKN Blocking and MinTsifry Certificates Explained

Russian internet users are experiencing widespread access issues to legitimate domestic websites both when using VPNs and when connecting directly. The problems stem from TSPU devices installed by all ISPs under Roskomnadzor requirements and the transition to national MinTsifry certificates that foreign browsers do not trust. Three distinct error scenarios are documented: ERR_CONNECTION_TIMED_OUT when accessing Russian-IP sites over VPN, ERR_CERT_AUTHORITY_INVALID on major bank sites without VPN, and partial page loading failures caused by TSPU fingerprinting. Solutions for ordinary users include split-tunneling VPN clients, installing MinTsifry root certificates, or switching to Yandex Browser and Chromium-Gost. Website owners are advised to disable TLS 1.3, enable HTTP/2 support, and consider changing server IP addresses if SSH connections are also blocked. The article explicitly excludes any discussion of circumvention methods for prohibited content and focuses only on legal Russian resources as of August 2026.

Russian Ministry Certificates Enable Potential State MITM on Foreign Domains

Russian companies facing sanctions have started adopting root certificates issued by the Ministry of Digital Development and Communications to maintain HTTPS access after commercial CAs revoked or refused to renew their certificates. Installing these Ministry certificates allows browsers to trust sites using Russian national CAs but also creates a pathway for man-in-the-middle interception by state-controlled entities. The article details a concrete threat model where a government-linked operator could use the Ministry root to generate on-the-fly certificates for any domain, including foreign services outside Russian jurisdiction. To mitigate this, the author demonstrates how to re-sign the Ministry root with OpenSSL nameConstraints limited to .ru, .su, and .рф domains only. Tests on macOS with Homebrew show that the constrained certificate still validates Russian banking sites such as online.sberbank.ru while correctly rejecting attempts to validate foreign domains like sberbank.com. The technique requires users to maintain their own cross-signed root and never rely on pre-installed Ministry or Yandex Browser roots for full protection.

Sberbank to Terminate Currency and Multicurrency Visa Cards from September 2026 Despite Prior Extensions to 2030

Sberbank announced it will cease servicing currency and multicurrency Visa cards starting September 1, 2026, including those whose validity was previously extended until 2030. The bank notified customers via SMS and advised them to close affected cards in advance through the Sberbank Online app or at a branch to avoid access issues with their funds. This decision aligns with ongoing sanctions against Russia, import substitution policies, and the gradual removal of Visa and Mastercard from the Russian market. Central Bank officials, including Elvira Nabiullina and Alla Bakina, have confirmed that international payment systems must exit Russia, with the share of Visa and Mastercard already reduced to less than 17 percent. The National System of Payment Cards continues to incur costs supporting legacy cards while promoting domestic alternatives such as Mir. Customers are encouraged to transfer remaining balances to other accounts to maintain uninterrupted access to their money.