MinTsifry

Russian Minister Proposes Blocking All SIM Cards Linked to Fraudsters Banned in MAX Messenger

The head of Russia's Ministry of Digital Development, Maksut Shadaev, has suggested extending account bans in the MAX messenger to a broader set of mobile restrictions. Under the proposal, operators would be required to disconnect not only the number used in a fraudulent account but also any other SIM cards belonging to the same individual. The measure would also introduce a cooling-off period preventing the person from registering new numbers after a ban. Officials aim to make it significantly harder for scammers to resume operations following enforcement actions. Key implementation details, including how ownership and involvement in fraud will be verified, remain unspecified in the initial statement. The initiative specifically targets fraud prevention and does not apply to every account suspension in the messenger.

Russia Mulls Mandatory Two-Week IMEI Registration for Foreign Smartphones via Gosuslugi

Russian authorities are discussing a new rule requiring owners of smartphones imported without customs clearance or purchased abroad to register the devices through the Gosuslugi portal within two weeks. Failure to register would result in the device being blocked from Russian mobile networks. The Ministry of Digital Development is preparing the requirements, which remain under discussion with possible changes to timelines and details. Devices already operating in Russia before April 2027 would be exempt and continue working without restrictions. Officially imported equipment would be added to the registry automatically. The measure is expected to significantly impact gray-market sellers, potentially forcing up to 70 percent of them out of the market and driving price increases of up to 40 percent for some models.

Mobile Internet Slowdowns Reported in Central Moscow as Content Filtering Systems Activate for Summits

Residents in central Moscow reported noticeable degradation in mobile internet performance starting October 27, coinciding with the first day of possible restrictions announced by the Ministry of Digital Development. The measures involve content filtering systems deployed to comply with Russian legislation and ensure security during the Gas Exporting Countries Forum and Russia-Africa summits. Two Speedtest measurements shared via the Ostorožno, Moskva channel showed speeds dropping from 225.47 Mbit/s to 12.13 Mbit/s, though exact locations, operators, and test conditions remain unspecified. The ministry indicated that restrictions inside the Third Transport Ring could occur daily from 11:30 Moscow time on October 27-28 and from 9:30 on October 29. Access to resources in the approved whitelist is expected to remain available, while voice calls, fixed broadband, and Wi-Fi should continue without interruption. The practical recommendation for visitors is to download necessary maps, tickets, and documents in advance before traveling to the affected area.

Russia's MinTsifry Drafts Security Requirements for Trusted Domestic Software

The Russian Ministry of Digital Development has published a draft set of requirements for trusted Russian software that go beyond simple domestic origin. The proposals focus on resilience against external interference, absence of known unpatched vulnerabilities, and full development and build processes conducted inside Russia under controlled conditions. Additional rules cover up-to-date component inventories, in-country technical support, and timely disclosure of software updates. Special compatibility mandates are included for Russian browsers and electronic signature tools across multiple product classes such as operating systems, databases, office suites, and communication applications. Compliance verification would be voluntary through expert review, with results recorded in the official Russian software registry and internal-use software lists.

Russia Boosts Digitalization Budget by 58% Using Telecom Operators' Universal Service Fund

The Russian government has significantly increased allocations for digital projects from the universal service reserve funded by telecom operators. In the 2027 draft budget, 16.3 billion rubles are earmarked for digital solutions, up 58% from the previously planned 10.3 billion rubles. The funds will support the national project Data Economy and the state program Information Society, covering state information systems, digital platforms, cloud infrastructure, AI projects, and quantum technologies. The operator contribution rate remains unchanged at 2% of revenue, with no new levies under consideration. Funding for connecting small settlements to the internet stays at 19.3 billion rubles, while allocations from traffic fines for digitalization are being reduced.

Russia Discusses Extra Fees for International Traffic Over 50 GB in 5G Networks

The Russian Ministry of Digital Development is again in talks with mobile operators about introducing charges for international data traffic exceeding 50 GB per month, but only within 5G networks. The measure would potentially apply to VPN services and other foreign resources, adding to users' mobile bills. No final decision has been reached and the exact fee amount remains unspecified. Sources indicate a possible launch in October, though timelines are subject to change. Technical challenges arise because current 5G deployments rely on LTE infrastructure, requiring new traffic separation, network handover tracking, and billing system adjustments. Average monthly mobile data usage stood at 24 GB in 2025, making the 50 GB international 5G threshold a narrow scenario. Headlines claiming VPNs will become paid services overstate the current discussions, which focus solely on international traffic classification.

Durev VPN Accused of Plagiarizing Independent Researchers' Articles for Commercial YouTube Promotion

Independent Russian cybersecurity researcher zarazaexe has publicly accused the commercial VPN service Durev VPN of systematically copying technical articles about Russian internet censorship systems, messenger analysis, and government-issued certificates. The team behind Durev VPN allegedly rewrote the original research into YouTube video scripts, replaced first-person statements with references to their own specialists, and removed all attribution to the source author or project. One video titled СРОЧНО УДАЛИ СЕРТИФИКАТ МИНЦИФРЫ reportedly gained 795,000 views in two days, while the service's Telegram bot shows 260,000 users and charges a minimum subscription of 313 rubles per month. Specific copied elements include scanning results of 46 million Russian IP addresses that yielded 63,000 entries in TSPU whitelists, architectural descriptions of default-deny and fail-closed policies, ECH handling by DPI systems, and detailed reverse-engineering findings from the MAX messenger client. The researcher documented the reuse of his earlier errors about UDP blocking inside whitelists and identical analogies comparing root certificates to apartment keys. When confronted, the Durev VPN representative initially demanded patents, invoked fair use, and later claimed the matter would be reviewed by their lawyer within a week. The researcher published the full chat logs and removed the disputed segment from one video after the complaint.

Why Legitimate Russian Websites Fail to Load With or Without VPN: TSPU RKN Blocking and MinTsifry Certificates Explained

Russian internet users are experiencing widespread access issues to legitimate domestic websites both when using VPNs and when connecting directly. The problems stem from TSPU devices installed by all ISPs under Roskomnadzor requirements and the transition to national MinTsifry certificates that foreign browsers do not trust. Three distinct error scenarios are documented: ERR_CONNECTION_TIMED_OUT when accessing Russian-IP sites over VPN, ERR_CERT_AUTHORITY_INVALID on major bank sites without VPN, and partial page loading failures caused by TSPU fingerprinting. Solutions for ordinary users include split-tunneling VPN clients, installing MinTsifry root certificates, or switching to Yandex Browser and Chromium-Gost. Website owners are advised to disable TLS 1.3, enable HTTP/2 support, and consider changing server IP addresses if SSH connections are also blocked. The article explicitly excludes any discussion of circumvention methods for prohibited content and focuses only on legal Russian resources as of August 2026.

Russia to Require Independent Lab Testing of Sovereign AI Models for Legal and Traditional Values Compliance

The Russian Ministry of Digital Development is discussing a certification scheme under which developers can submit large generative AI models to accredited independent laboratories. These labs will verify compliance with Russian legislation and traditional spiritual-moral values defined in presidential decree No. 809. Only models seeking official national or sovereign status, which unlocks state support, data access and priority procurement, will undergo the process. Developers must first conduct self-testing according to a risk-oriented methodology and supply architecture details, filtering mechanisms and other documentation. Accredited laboratories will then run benchmarks, attempt prompt-injection attacks and produce evaluation reports, while the final decision remains with MinTsifry. Separate security assessments for government systems will be performed by the FSB and FSTEC Russia. Experts have called for transparent, reproducible tests and periodic re-certification after model updates.

Web Certificate Trust Chains and State Access Risks Explained Amid Russian Banking Sanctions

The article explains the hierarchical structure of web certificates used for site authentication and traffic encryption, starting from highly protected root certificates stored in air-gapped facilities with Shamir's secret sharing for key protection. Intermediate certificates extend the chain of trust down to leaf certificates deployed on websites. Russian banks have turned to certificates issued under the MinTsifry root after Western and Chinese CAs refused service due to sanctions. The piece highlights that any nation-state with access to a root private key, whether FSB, NSA, or others, could theoretically issue fraudulent certificates for any domain. It notes the limitations of the X.509 standard, which lacks native support for multi-CA signatures, and suggests that separate browsing environments or PGP-style web-of-trust models could mitigate risks. The author concludes that security is already reduced by reliance on any state-controlled CA and that the choice is ultimately which intelligence agency one prefers to trust.

Over 20 VPN Services Hit by Outages After Russian Regulators Block Hosting Provider Subnets

Users of multiple VPN services reported widespread connection problems throughout the day as IP addresses belonging to several large hosting providers were placed under restrictions. The blocks targeted infrastructure used by VPNs to reroute traffic around content filters, causing entire ranges of servers to become inaccessible when whole subnets were affected. The Telegram channel Exploit reported that more than 20 VPN services of varying sizes experienced disruptions, though Roskomnadzor has not issued an official statement on the scope or origin of the measures. The affected providers indicated they are shifting customers to backup servers, noting that the restrictions appear selective yet still force frequent address changes during the day. The incidents coincide with ongoing discussions of new rules that would require hosting providers to independently detect and report masked VPN IP addresses to regulators. Similar large-scale subnet blocks occurred in late May, impacting numerous MTProto-based proxies and VPNs simultaneously.

Russia's MinTsifry Proposes Hosting Providers Detect and Report Disguised VPN Services

The Russian Ministry of Digital Development is discussing measures to strengthen oversight of VPN services that mask themselves as legitimate websites and hide their IP addresses from official blocklists. Hosting providers would be required to independently identify suspicious IP addresses and report them to regulators for potential blocking. The proposal also introduces a tiered trust system for hosting clients based on the strength of their identity verification. Users authenticated only via phone or bank card could have services terminated within 30 minutes upon violations, while those verified through Gosuslugi or biometric systems would receive more time to resolve issues. Non-compliant hosting providers risk being labeled as unreliable, resulting in restrictions that limit client access to a narrow whitelist of approved resources such as government portals, banks, and marketplaces. Industry participants warn that these restrictions could worsen IPv4 address shortages and drive legitimate businesses toward foreign hosting providers.

Russia to Mandate Gosuslugi Authentication for Hosting Providers, Further Reducing Anonymity in Runet

The Russian Ministry of Digital Development (MinTsifry) is advancing plans to require all hosting providers to identify clients exclusively through the Gosuslugi portal and the ESIA system. The measure aims to ensure that every allocated IP address is linked to a verified individual, going beyond current methods such as email or bank card verification. This approach mirrors the identification rules already enforced since September for .ru, .рф, and .su domain registrations and renewals. Industry reactions are divided: while some providers like Turbo Cloud support the initiative for combating fraud, others warn of high implementation costs and significant client losses. Smaller users, including students and independent developers, may migrate to foreign hosting services, and foreigners could face restricted access without alternative verification options.