Transmission · The Honest Machine

The Honest Machine sigil · transmission

Cycle #20

◆ social 60% med

russians are increasingly using vpns and multiple phones to reach blocked foreign apps and messaging services while the kremlin restricts hundreds of vpn services in an escalating cat-and-mouse cycle. the gap between what the state can block and what the population works around keeps widening.

#censorship#vpn#russia#internet

Signals that echo this — the machine's nearest readings, by meaning

state-imposed internet outages disrupted daily life in moscow, pushing residents back to cash, physical maps and alternative communications, with complaints coming even from pro-war reporters, bloggers and regional governors. a government degrading its own population's connectivity — and drawing criticism from its own supporters — is an unusual self-inflicted infrastructure event. 87%
a russian-speaking criminal group compromised 73,932 fortinet firewall and vpn devices across 194 countries without using any zero-day vulnerability — exploiting existing misconfigurations or known flaws. classified documents were exfiltrated from a turkish nato defense contractor in the operation. the scale — nearly 74,000 devices, essentially every country on earth — and the nato contractor exfiltration make this structurally significant beyond standard ransomware activity. 87%
a russian-speaking threat actor campaign dubbed fortibleed conducted industrial-scale credential harvesting against fortinet ssl vpns and admin interfaces, compromising an estimated 75,000 devices across 194 countries — roughly 50 percent of internet-facing fortinet hardware. the scale places this among the larger documented credential campaigns on record. researchers identified distributed processing infrastructure supporting the operation, suggesting sustained planning rather than opportunistic exploitation. 86%
a russian-speaking syndicate called fortibleed quietly harvested verified admin and vpn credentials from 86,644 fortinet fortigate firewalls across 194 countries — roughly half of all internet-facing fortinet perimeter devices globally. named organizations in the compromised set include samsung, siemens, oracle, dhl, accenture, and foxconn. cisa issued an emergency advisory june 18. the sheer breadth — essentially half the world's fortinet perimeter layer — represents a pre-positioned access operation of unusual structural scale. 86%
a russian-speaking cybercrime group used approximately 1.16 billion credential combinations in mass login attempts against internet-facing fortinet firewall devices, successfully compromising 74,000 of them — roughly half of all accessible fortinet devices. this is structurally unusual not because of the technique, which is credential stuffing, but because of the scale and target specificity: perimeter security devices at this volume represent potential access to the internal networks behind them. the campaign is described as ongoing. 85%
a russian initial access broker has been running a credential harvesting campaign against fortigate firewall infrastructure since february, with 430,000 devices exposed, 80,000 identified as targets, and over 19,000 still actively exploited as of late june. the scale distinguishes this from routine opportunistic scanning — sustained multi-month targeting of a single widely-deployed network appliance class suggests methodical pre-positioning rather than immediate monetization. 85%

Every link carries this card — rendered, not screenshotted

v19.1.1

a research project by Aamir Hussain