惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

人人都是产品经理
人人都是产品经理
有赞技术团队
有赞技术团队
WordPress大学
WordPress大学
月光博客
月光博客
T
Tailwind CSS Blog
阮一峰的网络日志
阮一峰的网络日志
小众软件
小众软件
钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知
Last Week in AI
Last Week in AI
大猫的无限游戏
大猫的无限游戏
S
SegmentFault 最新的问题
罗磊的独立博客
Jina AI
Jina AI
酷 壳 – CoolShell
酷 壳 – CoolShell
宝玉的分享
宝玉的分享
让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
奇客Solidot–传递最新科技情报
奇客Solidot–传递最新科技情报
博客园 - 三生石上(FineUI控件)
量子位
雷峰网
雷峰网
Apple Machine Learning Research
Apple Machine Learning Research
美团技术团队
博客园 - 聂微东
V
V2EX

Intel 471 Blog

TeamPCP Supply Chain Attacks Turning Geopolitical Tension into Actionable Intelligence CVE-2025-68613: Zerobot botnet exploits critical vulnerability impacting n8n AI orchestration platform Introducing Cyber Threat Exposure Bundle: A Unified Approach to External Risk CVE-2026-20127: Critical Cisco SD-WAN vulnerability exploited in wild Handala Threat Group OpenClaw: A viral AI assistant and a magnet for infostealer malware and ClickFix trickery Israeli, US strikes against Iran triggers a surge in hacktivist activity CVE-2026-1731: Finding a critical RCE in an age of AI-driven vulnerability research Born to bypass MFA: Taking down Tycoon 2FA The UK Cyber Security Resilience Bill How AI and the human advantage beat tomorrow’s threats Winter Olympics 2026: Hacktivism Surges Ahead of Protests and Suspected Sabotage How Threat Hunting and “Good” Metrics Help The Business Likely fake ransomware operator 0APT causes panic — Our analysis Hunting APTs: from state policy to TTPs CrazyHunter Ransomware DevMan Ransomware Introducing HUNTER Tuning: a New Tool for Driving Behavioral Threat Hunt Detections Battling check fraud in the U.S. Gootloader Malware Update Shai-Hulud Worm 2.0 New FvncBot Android banking trojan targets Poland White Paper Preview: Black "Fraud Day” and Beyond — The Key Cyber Threats Facing the Retail Sector this Holiday Season Threat hunting case study: Detecting IAB activity Using deception to extract cyber threat intelligence Lynx Ransomware Qilin Ransomware Group ClickFix: Tricking users into installing infostealers Cybercrime Takedowns: Trust, Partnerships and Focus
Russian-speaking actors offer unique perspectives on Puti...
Intel 471 · 2022-10-27 · via Intel 471 Blog

Introduction

With the Russian army reportedly experiencing heavy casualties in the war with Ukraine, the Kremlin is seemingly doubling down on its war commitment by expanding its number of conscripted troops. On September 21, 2022, Russian President Vladimir Putin announced a so-called "partial" military mobilization in Russia, including summoning more than 300,000 people for military service, ostensibly to bolster their war effort.

By another name, this "partial" military mobilization is called "conscription," the state-mandated enlistment of people into a military or national service. Putin's signed order only called up military reservists with combat or service experience. However, Russian media reports have described attempts to round up men without relevant experience, including those ineligible for service due to medical reasons.

Underground forum chatter offers unique war mobilization perspectives

Following the mobilization announcement, Russian-speaking actors started numerous threads on a plethora of underground cybercrime forums to discuss the situation. Intel 471 reviewed the relevant chatter and documented the perspectives and reactions of underground actors regarding the mobilization. Some of the key points and anecdotal thoughts reveal:

  • Most Russian-speaking underground actors are not willing to join the army. However, some would go to the war with Ukraine if called up.
  • Civilians who participated in anti-mobilization protests were reportedly the first to be served call-up papers.
  • There was reportedly no medical examination for conscripts, including those with visible disabilities.
  • Despite official announcements, anyone allegedly could be drafted into the army, including employees working in critical infrastructure sectors (e.g., oil, utilities, etc.)
  • Actors assumed a classified section of the military mobilization order could summon more people, perhaps millions of Russians, for military service.
  • Underground actors suggested those subject to call-up should take defensive means by leaving the country or residing in a place different from their registration address. Other recommendations included buying fake IDs and avoiding using the Russian GosUslugi government information portal.

Actors find illegal avenues to help conscripts

Recognizing the dire situation, dozens of Russian-speaking actors capitalized on these trends and started offering services to help conscripts dodge military mobilization for a price, including:

  • Issuing fake HIV or hepatitis medical certificates
  • Providing fake entries to Russia's state HIV and hepatitis database (which, in theory, would disqualify candidates)
  • Making fake disability certificates
  • Creating illegitimate caregiver documents for dependents or disabled relatives
  • Issuing a military ID with special records claiming the person was not eligible for military service.
  • Arranging evacuation from Russia and Commonwealth of Independent States (CIS) countries.
  • Offering so-called 'private methods' not disclosed publicly.

Specific offers made by actors to avoid conscription

Intel 471's research has highlighted the many conscription-avoidance offers made by Russian-speaking actors across underground forums. Some of the more credible examples are below. The names of rivers are used as monikers and they are not the actors' real handles. These offers include:

  • The actor Nile offered a private method to circumvent being called up for hundreds of thousands of dollars. However, the seller said their plan would not work for well-known individuals.
  • The actor Amazon posted an offer for official military ID with prices for it ranging from hundreds to thousands of US dollars.
  • The actor Yangtze offered to help avoid being mobilized for military service. They claimed their method was "fully legitimate and official," but it was available for only a limited number of people and would cost thousands of US dollars.
  • The actor Mississippi posted an offer for official HIV and hepatitis certificates, costing several hundred US dollars.
  • The actor Rhine posted an offer providing “emergency evacuation” from Russia or other CIS countries. Prices and conditions for relocation were reportedly available on a case-by-case basis.

With global events come underground opportunities

While it is impossible to know how many takers these offers got, young Russian men from all walks of life have left the country. In the wake of Putin's mobilization order, more than 194,000 Russian nationals fled to neighboring Georgia and Finland. So it is highly likely that law-abiding Russian men took advantage of some of these offers from Russian-speaking underground actors to escape.

Interestingly, in the face of a historical conflict, Russian-speaking actors stay true to their colors. They dislike the army but, if called, would apparently serve in the war because of their allegiance to the Russian state. But financially motivated underground actors are always just that, financially motivated, devising new ways to make a profit or invent a scheme to make money. In that sense, their skills easily transfer from cybercrime to one geopolitical event to another, in this case, war profiteering.