In August, the degradation and fragmentation of the Runet picked up pace. Communication restrictions in the regions became a daily occurrence, and a major power outage cut electricity to a key data center in the capital city.
In parallel, Roskomnadzor stepped up pressure on hosting providers and VPN services, foreign CAsCertificate Authorities continued to revoke SSL/TLS certificates from banks and retailers en masse, and the popularity of blocking-bypass tools became a vehicle for promoting dubious resources.
In addition, there were repeat outages at Russian companies themselves, unrelated to any external interference.
This month we’re again releasing two versions of the digest, including a global one — stay on top of internet censorship worldwide
VPN Ads Put on a Par with “Drug Shops and Massage Parlors”
Early in the month, Roskomnadzor blocked the IP addresses and subnets of major hosting providers. This happened against the backdrop of the Ministry of Digital Development discussing tighter control over VPN services.
The blocking affected infrastructure shared across VPN services. Some of them urgently moved servers, reissued config files, and brought backup capacity online. According to industry channels, more than 20 VPN services were affected.
On the last day of the month, the Ministry of Digital Development asked CDN and hosting providers to move whitelisted sites’ IP addresses into separate subnets. The ministry believes the measure will restrict access to content banned in Russia: “ads for VPN services, drug shops, and massage parlors.”
Fake VPN Browser Extensions
The company Socket published a report that identified more than 700 fake VPN extensions for Chrome. They mainly target Russian-speaking users.
Almost a third of the extensions found directly copied the names of existing VPN services: Proton VPN, NordVPN, Surfshark, AdGuard VPN, ExpressVPN
All 737 extensions turned out to be part of a single sales scheme through which the fraudsters pushed people toward buying a paid subscription. Seemingly harmless at first glance, the extensions in fact put users at risk.
The traffic wasn’t encrypted but proxied — it ran through a single shared server. This means the service’s owners could see users’ IP addresses and the sites they visited.
What’s more, the services didn’t have a single server for paid subscribers in the countries they claimed, such as Japan, Singapore, Australia, and Turkey.
As of publication, Chrome Web Store moderators had removed only 221 of the 737 extensions.
Mass Revocation of SSL/TLS Certificates and Isolation of Services
Foreign certificate authorities sped up the revocation of SSL/TLS certificates from Russian resources. This affected the user experience in foreign browsers — Chrome, Safari, Firefox, and others.
An SSL/TLS certificate is a digital document that confirms a site’s authenticity and ensures data integrity and encryption
Certificates were unilaterally revoked from dozens of banks and corporations — from Sberbank and VTB to Alrosa and Geoscan. Foreign browsers won’t let users into their personal accounts or payment gateways, warning of possible cyberthreats.
By the end of the month, the certificate revocation had hit Russian Railways passengers — online services and the app stopped opening for them.
The online store Lamoda, the provider Xline, and the RZD-Zdorovye network also reported trouble with payments through foreign browsers. Customers are advised, among other things, to switch to Yandex Browser with its built-in Ministry of Digital Development certificates.
App Store Sanctions Against Yandex Pay
On August 12, App Store moderators removed the Yandex Pay app in all regions. Most likely because of another European Union sanctions package against Russian financial services. As of publication, the app is available on Google Play.
Outages at Individual Services
WB Bank
On August 2, users from the Samara, Murmansk, Kemerovo, and Sverdlovsk regions and Moscow encountered mass outages at WB Bank.
Complaints appeared on the Detector404 platform about the site, mobile app, and online banking being unavailable, with no official reasons announced. The incident may be related to the aforementioned mass revocation of SSL/TLS certificates.
Rostelecom
Also early in the month, a major internal technical failure on the national operator’s side caused cascading problems at OZON, Yandex, Avito, Russian Railways, Wildberries, T-Bank, and Pikabu.
Roblox
Users reported a general outage. Some reports concern problems solely with either the mobile app or the site.
The largest number of complaints came from Saint Petersburg, the Leningrad and Chelyabinsk regions, and Bashkortostan.
Wikipedia
According to Detector404 data for August 28, as well as a number of Russian media outlets, access to the online encyclopedia could be restored only through a VPN on some ISPs. The problems were observed in Saint Petersburg, Moscow, the Moscow, Novosibirsk, Chelyabinsk, and Nizhny Novgorod regions, and in Adygea and Khakassia.
The causes of the outage are unknown; as of publication, the service is available again.
The Blackout in Moscow and the Moscow Region
On the evening of August 18, residents of the capital and the Moscow region ran into mass problems with wired internet and Runet services.
The cause was a power supply failure that affected the Kaluzhsko-Rizhskaya metro line and the largest exchange node, Moscow Intercity Telephone Exchange No. 9 (MMTS-9).
We reported on a similar incident in May (in Russian)
The outage affected Rostelecom customers, the provider Lovit, and users of banks and messengers.
August Trends
August’s events highlighted three main trends:
- The Runet is being cut off from the internet at the certificate level. To restore access to their usual resources, users in Russia are forced into technical compromises and workarounds.
- Blocking is shifting toward blanket restrictions on hosting providers — unfortunately, quite successfully. Under these conditions, public and centralized VPN services with fixed IPs end up at the greatest risk.
- Growing security risks for users. The heightened demand for VPNs and proxies spurs fraudsters on — hiding behind legitimate services, they steal data and money.
We track the dynamics of internet censorship and the state of the network in Russia. Connect to Amnezia Free or Amnezia Premium to stay in touch with your loved ones and restore access to your usual resources.
8 min
