Tag: Russia

  • Yandex Strike Shows Why 2 of 3 AI Supercomputers at One Site Is a Resilience Risk

    Yandex Strike Shows Why 2 of 3 AI Supercomputers at One Site Is a Resilience Risk

    TL;DR · 30-second read

    The Short Version

    Ukrainian drones have knocked out two of the five huge computer buildings run by Yandex, the company known as Russia’s Google. Russians then reported trouble reaching a video streaming service, an online bank and the national railway.

    One building held two of the three supercomputers Yandex uses to teach its chatbot. That is a lot of eggs in one basket.

    Ukraine called the strikes a response to Russian attacks on its own computer buildings, which disrupted phone and internet service for thousands. The internet lives in real buildings, and those buildings are now wartime targets.

    Ukrainian drone strikes on October 8 and 9 knocked out two of the five data centers operated by Yandex, the Russian technology company that runs the country’s most popular search engine, Ars Technica reported, citing Reuters and the independent Russian publication Meduza. The sites are in the Sasovo and Kaluga regions. Sasovo houses two of the three supercomputers Yandex uses to train its YandexGPT AI model, and Kaluga is the company’s largest data center.

    Yandex said no employees were hurt and acknowledged disruptions to some services. Russian users reported problems reaching media websites and the apps of video platform Ivi, digital bank T-Bank and state-owned Russian Railways. Ukrainian President Volodymyr Zelenskyy described the attacks as a “symmetrical response” to a Russian drone campaign against Ukraine’s data centers, which has disrupted mobile and internet service for thousands of Ukrainians since late September.

    Executive Summary

    The strikes hit two different kinds of concentration in a single campaign. Sasovo held most of Yandex’s AI training machines by count, while Kaluga is its largest facility. Together they represent 40% of the company’s data center sites, and Yandex’s AI chatbot and other online services have struggled to keep running as a result.

    The episode matters beyond Russia because it isolates a design tension in AI infrastructure. Large-scale AI training favors packing machines tightly into one location, while resilience favors spreading them apart. In a conflict zone, that tradeoff stops being an abstract engineering preference and becomes a question of how much capability a single attack can remove.

    It is also not an isolated event. Iranian drones knocked out multiple Amazon data centers in Bahrain and the United Arab Emirates earlier in 2026, and Russia has been striking Ukrainian facilities since late September. For operators and their customers in exposed regions, physical attack now belongs in the same risk discussion as power, cooling and connectivity.

    Two Supercomputers, One Address

    The most consequential number in this story is not two of five data centers. It is two of three supercomputers at a single site. A supercomputer used for AI training is a large group of processors linked by very fast internal networks, because the machines must constantly exchange data as a model learns. That requirement pulls hardware physically together: distance adds delay, and delay slows the job. Concentration is therefore often a sensible engineering choice rather than an oversight.

    The same choice creates a single point of failure, meaning one location whose loss removes a disproportionate share of a capability. By count, Sasovo held two-thirds of the supercomputers Yandex uses to train YandexGPT. Count is not the same as capacity, since the machines may differ in size, and the extent of damage to each has not been itemized. The exposure is still clear: one site carried most of the company’s named training systems, and an attack on that site put them at risk together.

    Those most directly affected are the teams that depend on those machines to build and update models. Ordinary backup does not fully solve the problem. Copies of data and model checkpoints, which are saved snapshots of a model in training, can be stored elsewhere, but the specialized compute needed to resume work at the same scale cannot simply be restored from a file.

    Training Can Wait. A Chatbot Cannot.

    AI workloads fall into two broad categories with very different tolerance for interruption. Training builds or updates a model and can often be paused and resumed later, at a cost in time. Inference is the live work of answering user requests, and when it fails, customers notice immediately. The reported struggle to maintain Yandex’s chatbot shows that the strikes reached the service people use, not only the long-term development pipeline.

    The Kaluga strike illustrates the second half of that risk. Losing a company’s largest facility tests whether the remaining sites can absorb its traffic. Good failover, the automatic shifting of work to surviving locations, depends on keeping spare capacity available. That capacity is expensive to hold in reserve during normal operation, which is why it tends to be most tightly rationed when demand for AI compute is high.

    The list of reported disruptions also carries a lesson for buyers. It ranged from a bank and a railway to a dating app, a real estate aggregator, a self-publishing platform and a leading soccer club’s website. Organizations that see their digital operations as distributed may still rely on one provider’s physical footprint. For enterprise customers, the practical questions are which sites their services actually run on, whether they can move to another region or provider, and whether that move has been tested under realistic conditions.

    Site Security Stops at the Fence

    Data center security has traditionally focused on perimeters, access control and insider threats. Those measures do little against one-way attack drones, which are uncrewed aircraft designed to strike a target and not return. Firepoint, the Ukrainian company whose FP-1 drones it said were involved in the Kaluga strike, makes that class of weapon. Defending against them is largely a matter for national air defenses, not facility managers, and Ukraine’s own shortage of interceptor weapons shows how difficult that defense can be even for a state at war.

    That shifts the operator’s realistic options from preventing every hit to limiting what any one hit can do. The available tools are geographic dispersal, spare capacity, separated power and network paths, offsite copies of critical data, and rehearsed recovery plans. Each costs money and some reduce efficiency, particularly for tightly linked training clusters. The decision is therefore a business tradeoff: how much performance and capital to give up in exchange for surviving the loss of a site.

    This should not be stretched into a claim that every data center faces the same danger. The reported attacks are tied to active conflicts, and most facilities operate far from them. Yet Amazon’s affected sites were in Bahrain and the UAE, not in the countries that launched the February attack on Iran, which suggests that regional exposure can extend beyond the main combatants. For operators and customers choosing locations in or near geopolitical flashpoints, conflict risk belongs in siting decisions alongside land, power and connectivity.

    Testing the Competing Claims

    The parties describe the same events in markedly different terms. Zelenskyy said Ukraine was responding “with high precision,” adding: “Another data center was hit as well—our symmetrical response.” Yandex’s acknowledgment of disruptions to “some services” is narrower than the picture of two facilities knocked out. Satellite imagery from Planet Labs shows damage at Sasovo, which supports the fact of a strike there but cannot on its own establish how much computing capacity was lost or how long it will stay offline.

    Each statement deserves scrutiny in light of its author’s interests. A government at war has reason to emphasize precision and effect, a drone manufacturer benefits from being associated with a successful strike, and a company has reason to reassure customers and users. The measure that will ultimately matter is operational: how quickly Yandex’s services stabilize, and when its training work resumes at full scale.

    Background

    A data center is a secured building filled with the computers, power systems and cooling equipment that keep online services running. Yandex operates Russia’s most popular search engine and has developed its own family of AI models under the YandexGPT name. Before these strikes it ran five data centers, three of which remain outside the reported damage.

    Russia has regularly launched mass missile and drone attacks on Ukrainian cities since beginning its full-scale invasion in February 2022, hitting power grid infrastructure, transportation hubs and residential buildings. Ukraine has expanded its own medium-range and long-range drone campaign, focusing on Russian military bases, supply lines, Russian-linked shipping and energy infrastructure such as oil refineries. In summer 2026, it also targeted warehouses of the Russian e-commerce companies Wildberries and Ozon, before turning to Yandex’s data centers in October.

    Sources

    Source: Ukraine’s drones knock out AI data center belonging to “Russia’s Google” (Ars Technica), on Ukrainian drone strikes against Yandex data centers in Russia’s Sasovo and Kaluga regions.

  • Russia-Linked Zimbra Exploit Takes 90 Days of Email on View. Patching Is the Defense

    Russia-Linked Zimbra Exploit Takes 90 Days of Email on View. Patching Is the Defense

    TL;DR · 30-second read

    The Short Version

    Hackers backed by the Russian state have spent about a year breaking into organizations through a popular email system called Zimbra, according to the United States National Security Agency and 26 partner agencies across 16 countries.

    The worrying part: nobody has to click anything. Simply opening a booby-trapped email on an out-of-date system lets the attackers copy the last three months of messages and the organization’s full staff contact list.

    The fix is ordinary but urgent: install the software update, then check whether anything was already taken.

    On July 23, 2026, the National Security Agency (NSA) said in a press release that it and 26 partner agencies from 16 countries had published a joint Cybersecurity Advisory titled “Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite.” The advisory attributes the activity to LAUNDRY BEAR, a Russian state-supported advanced persistent threat group, which has targeted Zimbra Collaboration Suite (ZCS) users across U.S. and allied government and commercial networks since July 2025.

    The group uses a custom tool the agencies call “Ulej” to deliver an exploit that triggers automatically when a user views a malicious email in a vulnerable version of Zimbra’s webmail. The flaw, CVE-2025-66376, was a zero-day when first used and is still being exploited on unpatched servers. The exploit attempts to exfiltrate the organization’s email directory, the last 90 days of the victim’s communications, and other sensitive information.

    Executive Summary

    A coalition of intelligence and cybersecurity agencies spanning the Five Eyes and much of NATO Europe has put its name to a single warning: a Russian state-supported group has been quietly harvesting email from Zimbra servers for roughly a year, and it is still succeeding wherever administrators have not patched. The co-sealing list runs from the FBI and CISA to the UK’s National Cyber Security Centre, France’s ANSSI, both Dutch intelligence services, and agencies in Poland, Estonia, Finland, Sweden and Moldova.

    What makes this advisory operationally important is the delivery mechanism. The exploit is “view-based”: it fires when a user opens the message in webmail, with no link to click and no attachment to run. That removes the human judgement that most phishing defenses rely on and turns the problem into one of patch management and network monitoring. For any organization that runs its own mail infrastructure, including data center, connectivity and cloud operators, the question is no longer whether staff can spot a suspicious email but whether the server was patched before the message arrived.

    The advisory also documents what the exfiltration looks like on the network and lists indicators of compromise, the specific technical fingerprints defenders can search for, along with remediation steps. That matters because patching closes the door going forward but does nothing about mail that has already left.

    When Viewing Is Enough, Training Stops Being the Control

    Most organizations treat phishing as a people problem: teach staff not to click unfamiliar links or open unexpected attachments, and run simulated campaigns to measure progress. The exploit described in this advisory sidesteps that model entirely. According to the NSA, it “triggers automatically when a user views a malicious email within a vulnerable version of the webmail service.” A well-trained employee who opens a plausible-looking message to decide whether it is suspicious has already triggered it.

    That shifts the controlling variable from user behavior to software version. On a patched Zimbra server, the message is inert; on an unpatched one, reading it is the compromise. The NSA states the exploit “is still used to successfully exploit ZCS instances that are still unpatched,” which tells defenders two things: the attackers are getting returns from this technique roughly a year after the campaign began in July 2025, and the population of vulnerable servers is large enough to keep them doing it. Awareness training remains useful against the wider phishing threat, but against this specific campaign the effective defense is patch speed, followed by hunting for signs of earlier theft.

    The people most affected are administrators of self-managed mail systems. When email runs as a cloud service, the provider patches the server. When an organization runs Zimbra on its own hardware or virtual machines, that job falls to an internal team competing with every other maintenance priority, and a webmail server that “still works” is easy to defer.

    What 90 Days of Mail and a Directory Are Worth to an Attacker

    The exploit targets three things: the organization’s email directory, the last 90 days of the victim’s communications, and “other sensitive information.” Each has distinct value. The directory is a map of the organization: names, roles and addresses that make the next round of targeted phishing more convincing. Ninety days of mail captures current projects, vendor relationships, internal decisions and, frequently, credentials or configuration details that people send to one another despite policy.

    For operators of physical and digital infrastructure, the stakes are concrete. Email is where maintenance windows are scheduled, where network change requests are discussed, where customer contracts and site access arrangements are negotiated. A three-month window of that traffic from one well-placed mailbox can give an intelligence service a detailed view of how an operator runs and who it serves, without ever touching the operational network itself.

    The directory theft also means the damage can compound. Contacts harvested from one victim become credible senders and plausible targets for the next, which is one reason a campaign of this kind can keep expanding across “U.S. and allied government and commercial networks,” as the release describes.

    A 27-Agency Signal on Breadth and Priority

    Joint advisories are common; one carrying the seals of 27 agencies across 16 countries is not routine. The list includes foreign intelligence services, military counterintelligence and financial authorities (the U.S. Department of the Treasury) alongside the civilian cyber agencies that usually issue these warnings. The release does not explain why each agency joined, and the breadth should not be over-read as a measure of damage. It does indicate that the activity has been observed, or is considered relevant, across a wide set of allied governments.

    The advisory’s technical focus is also telling. The NSA says it “characterizes the network activity occurring during the exfiltration stage.” That is aimed at defenders who may already be compromised: an organization that patched in, say, the last few months still needs to know whether data left its network before then. Egress logs, proxy records and firewall data from the preceding year are the relevant evidence, and teams that do not retain those logs long enough will struggle to answer the question.

    The Practical Sequence for Zimbra Operators

    The advisory implies a clear order of work. First, confirm that every Zimbra instance, including forgotten test or regional servers, is on a version that addresses CVE-2025-66376. Second, search mail and network logs for the indicators of compromise the advisory lists. Third, if any match, follow the remediation steps in the full report and assume the directory and recent mail of affected users are in hostile hands.

    That third step has consequences beyond IT. If 90 days of correspondence has been exfiltrated, legal, contractual and customer-notification questions follow. For infrastructure providers whose customers include government agencies or regulated industries, a confirmed compromise of internal mail may need to be treated as a customer-facing incident, not just an internal clean-up.

    Background

    Email servers have long been a favored target for state-backed intelligence operations because a single compromised mailbox can reveal an organization’s contacts, plans and internal discussions. Self-hosted webmail platforms such as Zimbra are especially exposed: they sit on the public internet by design, and keeping them patched depends entirely on the operator’s own team.

    Joint advisories from the NSA, CISA, FBI and allied agencies are the main channel through which Western governments share technical detail about state-sponsored campaigns with the private sector. They typically include indicators of compromise and mitigation guidance so that organizations can check their own systems, and a large number of co-sealing agencies generally reflects broad concern among allied governments about the activity described.

    Sources

    Source: NSA and Partners Alert Zimbra Collaboration Suite Users of a Russian State-Supported Phishing Campaign — National Security Agency press release announcing a joint advisory on LAUNDRY BEAR’s exploitation of CVE-2025-66376 in Zimbra webmail.