Gosuslugi

Russia Mulls Mandatory Two-Week IMEI Registration for Foreign Smartphones via Gosuslugi

Russian authorities are discussing a new rule requiring owners of smartphones imported without customs clearance or purchased abroad to register the devices through the Gosuslugi portal within two weeks. Failure to register would result in the device being blocked from Russian mobile networks. The Ministry of Digital Development is preparing the requirements, which remain under discussion with possible changes to timelines and details. Devices already operating in Russia before April 2027 would be exempt and continue working without restrictions. Officially imported equipment would be added to the registry automatically. The measure is expected to significantly impact gray-market sellers, potentially forcing up to 70 percent of them out of the market and driving price increases of up to 40 percent for some models.

How to Secure Your Gosuslugi Account Against Hacks and Recover Access After Takeover

Russia's Gosuslugi portal now holds far more than basic documents, including tax notifications, child records, data-sharing consents, and access to other government services, making account security critical. The guide stresses using a unique strong password, enabling two-factor authentication with TOTP or biometrics instead of SMS, and regularly reviewing active sessions and connected mobile apps. It details steps to add a trusted contact for recovery, audit consents granted to third parties, and monitor for unauthorized logins or statements. In case of suspicious codes or calls, users must never share verification codes and should immediately check actions in the system, revoke unknown consents, and contact support. If access is lost, recovery options include online password reset with passport data or in-person visits to service centers, followed by credit history checks and self-imposed credit bans via Gosuslugi starting March 2025. The advice also covers protecting the linked phone number and email to prevent SIM swaps and further fraud.

Scammers Impersonate Social Fund to Threaten Child Benefit Cancellation and Steal Savings

Fraudsters have launched a new social engineering campaign targeting parents by impersonating officials from Russia's Social Fund. Callers claim that suspicious transfers have been detected on family accounts and threaten the cancellation of child benefits unless savings are moved to a special transit account. The scheme relies on fabricated rules about income assessment and uses the promise of an 'unreported' account to trick victims into sending money. The Narodny Front's Moshelovka platform, cited by RIA Novosti, confirms that the Social Fund never requests transfers to third-party accounts for benefit verification. Families are instructed to check official notifications exclusively through Gosuslugi or by visiting an SFR office in person. Authentication codes from government services or banking apps must never be shared over the phone.

Russia Plans Additional Security Checks for Gosuslugi Portal Access

Prime Minister Mikhail Mishustin has directed the Ministry of Digital Development to develop extra authentication measures for the Gosuslugi portal used by 120 million citizens. The new controls would apply both to initial logins and to account recovery procedures. Details on the exact checks and implementation timeline remain unspecified as the ministry must first propose a concrete mechanism. In parallel, officials are preparing a third package of anti-fraud measures that includes a unified consent platform inside Gosuslugi for managing personal data processing permissions. The platform would let users view which organizations access their data, revoke prior consents, and report violations. Russian police have separately warned that fraudsters are already exploiting the topic of account protection by sending messages that threaten blocking or data leaks and urge victims to call provided numbers.

Paper Mail Combined with Phishing: Russians Targeted by Fake FNS Tax Portal Copies

Russian scammers have started blending traditional postal mail with digital phishing to steal taxpayer credentials. Victims first receive official-looking paper letters from the Federal Tax Service demanding corrections to tax declarations or supporting expense documents. These letters are followed by emails directing users to a counterfeit version of the FNS personal account portal. The fake site captures login details, passwords, and other authentication data that can be reused for further identity theft and account takeovers. Senator Artem Sheikin highlighted the scheme, noting that the paper letter builds initial trust before the electronic follow-up appears legitimate. Users are advised to access tax information only by manually visiting the official FNS website or through the Gosuslugi platform without clicking any links. The attack relies primarily on psychological manipulation rather than technical sophistication.

Digital Surveillance in Your Pocket: Audit Uncovers Tracking and Weak Cryptography in 11 Top Russian Android Apps

An independent security researcher conducted a static analysis and passive logcat review of 11 popular Russian Android applications from banks, government services, marketplaces, and navigation tools. The audit identified 237 vulnerabilities in total, including six apps signed with outdated RSA-1024 or DSA-1024 keys that violate current NIST standards. VK led the risk ranking with 11 trackers and a 98/100 surveillance score, while Gosuslugi transmitted analytics signals to VK, Yandex, Google, and Huawei ecosystems. Five apps used WebRTC ICE candidate leaks to detect VPN usage, potentially bypassing user privacy protections. Only Goskluch scored low at 42.4/100 by limiting trackers to two, avoiding VPN detection, and using a compliant RSA-2048 signing key. The methodology relied solely on MobSF, jadx, and logcat without bypassing SSL pinning or requiring root access.

Russian Ministry Certificates Enable Potential State MITM on Foreign Domains

Russian companies facing sanctions have started adopting root certificates issued by the Ministry of Digital Development and Communications to maintain HTTPS access after commercial CAs revoked or refused to renew their certificates. Installing these Ministry certificates allows browsers to trust sites using Russian national CAs but also creates a pathway for man-in-the-middle interception by state-controlled entities. The article details a concrete threat model where a government-linked operator could use the Ministry root to generate on-the-fly certificates for any domain, including foreign services outside Russian jurisdiction. To mitigate this, the author demonstrates how to re-sign the Ministry root with OpenSSL nameConstraints limited to .ru, .su, and .рф domains only. Tests on macOS with Homebrew show that the constrained certificate still validates Russian banking sites such as online.sberbank.ru while correctly rejecting attempts to validate foreign domains like sberbank.com. The technique requires users to maintain their own cross-signed root and never rely on pre-installed Ministry or Yandex Browser roots for full protection.

How to Submit Documents for Online Master's Programs via Gosuslugi: Complete Guide

The admission campaign for online master's programs at partner universities is nearing its end, with less than a month remaining for applicants. Yandex Practicum provides a detailed walkthrough on using the Gosuslugi super service to submit applications entirely online without visiting admissions offices in person. The process covers selecting programs at institutions such as ITMO and MEPhI, uploading required documents like diplomas and passports, and tracking application status through a personal account. Specific deadlines are outlined for 2026, including final document submission dates in late August for programs in areas like DevOps, AI solutions, and cybersecurity. Additional steps include arranging entrance exams, signing contracts remotely, and accessing state-supported education loans at a 3% interest rate. Common pitfalls such as unverified accounts or unreadable document scans are highlighted to help applicants avoid delays.

Russia's Ministry of Digital Development to Bind M2M SIM Cards to Devices and Restrict Unauthorized Calls Starting 2027

The Russian Ministry of Digital Development has proposed new regulations requiring companies and individual entrepreneurs to register M2M SIM cards and associated equipment in the ESIA system. The rules, scheduled for launch on September 1, 2027, aim to combat fraud by preventing the misuse of these cards for anonymous calls and mass messaging. Each M2M SIM card will be strictly tied to a specific device, with changes to identifiers allowed only once per month except in cases of loss or damage. Operators will gain access to a unified platform for managing SIM cards, including activation, deactivation, status checks, location tracking via base stations, and service suspension for discrepancies. All relevant data such as owner INN, operator details, equipment type, identifier, and installation address must be submitted through Gosuslugi or operator platforms. Voice calls will be limited to one minute, white lists for contacts can be updated monthly, and mass SMS or auto-dialing will be banned except for authorized senders.

Russia's MinTsifry Proposes Hosting Providers Detect and Report Disguised VPN Services

The Russian Ministry of Digital Development is discussing measures to strengthen oversight of VPN services that mask themselves as legitimate websites and hide their IP addresses from official blocklists. Hosting providers would be required to independently identify suspicious IP addresses and report them to regulators for potential blocking. The proposal also introduces a tiered trust system for hosting clients based on the strength of their identity verification. Users authenticated only via phone or bank card could have services terminated within 30 minutes upon violations, while those verified through Gosuslugi or biometric systems would receive more time to resolve issues. Non-compliant hosting providers risk being labeled as unreliable, resulting in restrictions that limit client access to a narrow whitelist of approved resources such as government portals, banks, and marketplaces. Industry participants warn that these restrictions could worsen IPv4 address shortages and drive legitimate businesses toward foreign hosting providers.

Natalia Kasperskaya Advises Against Mass Biometric Rollout in Russia Citing High Costs, Reliability Issues and Deepfake Threats

Natalia Kasperskaya, president of InfoWatch and chair of the Domestic Software association, has warned that widespread deployment of biometric authentication across Russia would be both prohibitively expensive and insufficiently reliable. She argued that systems such as face recognition, which rely on creating detailed digital models from tens of thousands of points, require enormous computing power and data storage when scaled nationally. Kasperskaya highlighted practical limitations including poor camera quality, inadequate lighting and low-resolution source images that can prevent accurate recognition, especially on older smartphones. A growing concern she raised is the rapid improvement of deepfakes, which are becoming increasingly difficult for both humans and systems to distinguish from genuine images, thereby opening new avenues for fraud. She recommended using biometrics only in limited, high-value scenarios as a supplementary verification method rather than a universal replacement for other authentication techniques. The remarks come as Russia already operates the Unified Biometric System that enables access to Gosuslugi, electronic signatures, eSIM issuance and certain banking services.

Russia to Mandate Gosuslugi Authentication for Hosting Providers, Further Reducing Anonymity in Runet

The Russian Ministry of Digital Development (MinTsifry) is advancing plans to require all hosting providers to identify clients exclusively through the Gosuslugi portal and the ESIA system. The measure aims to ensure that every allocated IP address is linked to a verified individual, going beyond current methods such as email or bank card verification. This approach mirrors the identification rules already enforced since September for .ru, .рф, and .su domain registrations and renewals. Industry reactions are divided: while some providers like Turbo Cloud support the initiative for combating fraud, others warn of high implementation costs and significant client losses. Smaller users, including students and independent developers, may migrate to foreign hosting services, and foreigners could face restricted access without alternative verification options.