Aroshka Cloud Faces Scrutiny Over Alleged False Claims of SOC 24/7 Operations and High-End Infrastructure

StackWorks has published the fourth installment in its investigative series on Aroshka Cloud, detailing how the cloud storage provider accused the studio of orchestrating a DDoS attack shortly after the third part appeared. The service published five posts claiming technical evidence linked StackWorks to the attack, including IP traces from Moscow, Ufa, and Stavropol, while asserting that its SOC 24/7 team mitigated a 3.5 Gbit/s assault within seconds. StackWorks responded with a pre-trial claim demanding removal of the posts and a public retraction, which Aroshka Cloud rejected within seven minutes. Analysis of the provider’s own Kwork job postings reveals requests for template-based support staff, a five-VDS server pool, and later up to eight NVIDIA H200 GPUs with InfiniBand, contradicting public statements about multi-country data centers and round-the-clock security engineers. Further inconsistencies include mismatched time zones in email headers, inflated user statistics, and reliance on the BeDrive script rather than custom development. The investigation continues with plans to involve law enforcement regarding suspicious visitor logs.

HabrOctober 25, 2026Translated from Russian

Read at source

Aroshka Cloud has accused StackWorks of conducting a DDoS attack and running an OSINT campaign after the studio published the third part of its investigation into the cloud storage service.

Within hours of the third article, the provider released five blog posts alleging that StackWorks possessed direct or indirect links to coordinated technical attacks. The posts named a StackWorks employee and referenced the studio’s website while claiming the attack reached 3.5 Gbit/s and was detected by an alleged SOC 24/7 team.

StackWorks denies any involvement in attacks and has sent a pre-trial claim demanding removal of the posts and publication of a retraction. The service refused within seven minutes and published an additional post about the claim itself.

Examination of Aroshka Cloud’s own public statements and job advertisements reveals multiple contradictions. Earlier postings sought support staff to answer messages “according to ready templates” with no technical knowledge required, while later orders described a pool of five VDS servers that later expanded to requests for up to eight NVIDIA H200 GPUs, 3–6 TB RAM, and 400 Gbit/s InfiniBand connectivity.

Public DNS records show the domain resolves to a single IP address hosted by Scalaxy B.V. in Almaty, Kazakhstan, with no protective CDN headers present. The service’s claimed multi-country infrastructure and advanced security operations are not corroborated by these technical details.

Additional discrepancies include mismatched time zones between the website settings (Europe/Moscow), the dev.to profile (Amsterdam), and email headers (+04:00), as well as statistical claims that appear internally inconsistent regarding user growth and partner payouts.

The service is built on the off-the-shelf BeDrive script from Vebto, contradicting earlier marketing statements that presented it as a custom-built platform significantly cheaper than Google Drive.

Aroshka Cloud StackWorks BeDrive NVIDIA H200 Scalaxy B.V.

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Fraud & Social Engineering

Fraud & Social Engineering

Scammers Use *#62# USSD Command to Fabricate Surveillance Claims and Steal Victims' Funds

Fraudsters are exploiting the USSD command *#62# to convince targets that their phones are being tapped, then directing them to hand over cash to supposed couriers. The scheme begins with a familiar pretext such as a doorphone replacement or parcel delivery, after which the victim is tricked into revealing a verification code that the attackers themselves sent. A fake government official then claims the victim's account has been compromised and an extremist has been granted power of attorney. Victims are instructed to visit a counterfeit state website, enter *#62#, and interpret the displayed forwarding number as proof of interception. In reality the code only reveals call-forwarding settings for when the phone is unreachable, often showing a voicemail or missed-call service number. T-Bank warns that the displayed number has no connection to surveillance and urges anyone receiving such calls to hang up and contact the real organization through official channels.

AntiMalwareOct 28, 2026Translated from Russian

Fraud & Social Engineering

Reports Surface on Alleged De-Anonymization of Admins Running Major Russian Hacker Forums

An independent researcher has compiled publicly available information pointing to the possible identities of administrators behind prominent Russian-language darknet forums including exploit.in and duty-free.to. The analysis traces exploit.in back to its 2006 launch by a user known as Toha, later linked to Ukrainian authorities or associates, with the forum reportedly transferred or sold. Forum moderator Quake3, identified in open sources as Anatoly Kravchuk, ceased activity in October 2026 and appears on a German police wanted list. Additional details from forum posts and anonymous Telegram channels name Mikhail Rytikov, known as Abdulla, as a key figure tied to server hosting and operations. The report also notes the recent involvement of known Russian hacker wazawaka on duty-free.to and highlights the declining viability of several legacy forums due to law enforcement actions. All claims are presented as unverified public speculation without new original sourcing.

HabrOct 24, 2026Translated from Russian

Fraud & Social Engineering

Google Strengthens Chrome Defenses Against ClickFix Clipboard-Based Scams

Google has updated Chrome to detect and warn users about malicious commands copied to the clipboard as part of ClickFix attacks. These scams trick users into pasting harmful scripts into system tools such as PowerShell under the guise of fixing errors or providing tech support. The new protections activate when Enhanced Protection in Safe Browsing is enabled and send suspicious commands for analysis after removing personal data. Google has also shifted scam page detection from a local Gemini model to a server-side implementation to improve accuracy against fake tech support, antivirus, and browser update sites. The changes make it harder for attackers to bypass browser download checks by abusing clipboard and system console execution. Official details were published in the Google Security Blog.

AntiMalwareOct 21, 2026Translated from Russian