Hackers pose as women seeking romance to spy on Russian soldiers
ID: 5014c9a8-cd4a-5e59-b965-b97fb1f94267
STIX ID: report--5014c9a8-cd4a-5e59-b965-b97fb1f94267
Feed Name: The Record from Recorded Future News
A previously undocumented cyber espionage group dubbed SiribClone has been targeting Russian military personnel since at least summer 2025 by posing as women on messaging platforms to deliver Android spyware (SafeLoveStealer), desktop file-stealers (SiribGrabber), and Telegram credential-phishing sites; operators use an internal platform called Kontur to store stolen Telegram sessions and review intercepted messages, indicating the campaign seeks battlefield intelligence and persistent access to victims' communications.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.