Russian Phishing Uses Fake CIA Sites to Target Anti-war, Ukraine Supporters

Silent Push researchers uncovered an alleged Russian intelligence phishing operation (early 2025) impersonating the CIA and various Ukraine-support organizations to harvest personal data from anti-war activists, informants, and Russian citizens; the campaign used bulletproof hosting (Nybula LLC ASN 401116), shared registrar/WHOIS artifacts, malicious domains (e.g., ciagovicu, rusvolcorpsnet, hochuzhitlife), and data exfiltration via POST requests and abused Google Forms, posing significant privacy and operational risks to targeted individuals.