Back Therecord.Media

Hackers pose as women seeking romance to spy on Russian soldiers

Therecord.Media • June 9, 2026

The group, dubbed SiribClone by Russian cybersecurity firm F6, has been active since at least the summer of 2025 and has primarily targeted members of the Russian armed forces stationed in border regions and combat zones.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cybercriminals Target Russian Troops with Fake Dating Profiles for Espionage A cyberespionage group named 'SiribClone' has been targeting Russian military personnel since summer 2025. This group uses social engineering tactics, posing as women seeking romantic relationships to compromise soldiers' mobile phones and Telegram accounts. The attackers aim to gather sensitive military intelligence by persuading victims to download malicious applications or enter credentials on phishing sites. The malware, identified as 'SafeLoveStealer,' can steal personal data and provide remote access to infected devices. The campaign was detected in early 2026, with a resurgence in May linked to Victory Day celebrations. Researchers from the Russian cybersecurity firm F6 have documented this threat, highlighting its focus on troops in border regions and combat zones. The group employs various deceptive tactics, including fake humanitarian aid offers and requests for intimate photos. 2 sources 71

Extracted Entities

Hackers pose as women seeking romance to spy on Russian soldiers

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

MITRE ATT&CK (1)