Skip to content
SpetsVuzAvtomatika Leak Reveals Russian Cyber Espionage Projects

SpetsVuzAvtomatika Leak Reveals Russian Cyber Espionage Projects

First seen 2 Oct 2026, 09:06 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 2, 2026 at 09:07 UTC
  • •Leaked documents reveal SpetsVuzAvtomatika's support for Russian state-sponsored cyber operations.
  • •Seven projects identified focus on credential theft, data extraction, and cyber intelligence.
  • •The institute has denied a breach, but experts confirm sensitive data is in criminal circulation.

Leaked documents from SpetsVuzAvtomatika, a Russian cyber research institute, indicate its involvement in state-sponsored hacking and espionage. The leak, discovered on the darknet, outlines seven projects focused on cyber intelligence collection, including credential theft and data extraction from corporate networks. Notable projects include Felix-23 and HAD for target scanning, Putnik for internal network access, and Initiative-24 for using cloud services to control software agents. Despite the institute's denial of a network breach, experts assert that sensitive data has entered criminal circulation. The documents do not confirm the deployment of all tools but indicate a robust development environment for cyber operations. SpetsVuzAvtomatika has been sanctioned by the US Treasury since May 2021 for its role in developing hacking tools for Russia's foreign intelligence service, SVR.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2021-05-01
US Treasury sanctions SpetsVuzAvtomatika
The institute was sanctioned for developing hacking tools for Russia's SVR.
Cybernews
2026-05-01
Data advertised on darknet
An actor using the handle SVA2027 began advertising stolen data from SpetsVuzAvtomatika.
DomainTools
2026-10-02
Leak disclosed
Cybernews reports on the SpetsVuzAvtomatika leak, detailing its implications for Russian cyber operations.
Cybernews

More articles in this cluster (3)

Following this threat?

Track Blik and SpetsVuzAvtomatika in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (13)

1 / 3

Common questions

What projects were revealed in the leak?
The leak identified seven projects, including Felix-23, HAD, and Initiative-24, focusing on various aspects of cyber intelligence.
Is there confirmation of exploitation?
The articles do not confirm active exploitation of the tools mentioned in the leak.
What should organizations do in response?
Organizations should monitor for any suspicious activity and assess their exposure to the tools described in the leak.