Moscow Internet Blackouts and State-Approved Web Access
Russian authorities are restricting internet access in Moscow during ongoing mobile network disruptions by allowing connectivity only to a government-approved whitelist of domestic websites and services. Reporting indicates the system keeps selected Russian platforms—such as government sites, telecom services, marketplaces, and transport or delivery apps—available while broader internet access is blocked, reportedly using deep packet inspection (DPI) and infrastructure controls that require traffic to stay within Russia and prevent users from masking IP addresses. Officials have framed the outages and restrictions as protective measures against Ukrainian drone attacks, while similar controls are reportedly being prepared or used in other Russian cities including St. Petersburg.
The disruptions are also producing visible social and economic effects in Moscow, where residents and businesses are struggling with failed QR-code payments, degraded app-based services, and loss of normal mobile connectivity. One account describes a broader regression to offline workarounds, including increased demand for walkie-talkies, pagers, and paper maps, as GPS-dependent and internet-based services become unreliable. A separate report on Kazakhstan's proposed social media monitoring regime concerns a different country and policy process and does not describe the same Moscow outage and whitelist event.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
8 events from the most recent confirmed update back to the earliest known activity.
Russia proposes sovereign AI rules requiring domestic training data
Russia's Ministry for Digital Development reportedly proposed sovereign AI rules to be implemented by 2027 that would require chatbots to be developed and trained in Russia using only Russian datasets rather than broader internet sources. Business groups and firms including Yandex and Gigachat reportedly argued that domestic compute capacity and local training data are currently insufficient and that several years would be needed to build the necessary infrastructure.
DDoS attack on Rostelecom disrupts internet access across Russia
A large-scale DDoS attack hit state-run telecom provider Rostelecom on Monday evening, causing temporary internet disruptions in roughly 30 Russian cities and affecting services including Steam, Gosuslugi, Rutube, and banking platforms. Rostelecom said the attack was quickly contained, though emergency filtering measures contributed to degraded access and some government sites remained affected into the next day.
Internet controls reportedly expand from Moscow to other large Russian cities
By early April, reports described mobile internet shutdowns and tighter controls on Telegram, WhatsApp, and VPN access not only in central Moscow but also in other major Russian cities. The expansion suggested the Kremlin's whitelist-style, state-controlled internet model was being rolled out more broadly across the country.
St. Petersburg expected to face similar internet restrictions
Reports indicated that similar connectivity disruptions were expected in St. Petersburg as Russian authorities expanded or prepared comparable controls beyond Moscow. This suggested the measures could spread to other major cities.
Residents shift to analog tools amid degraded connectivity
With digital services impaired, Moscow residents reportedly increased their use of analog alternatives such as walkie-talkies, pagers, and paper maps. The disruptions also created pressure to move from Telegram and WhatsApp to the state-backed MAX app developed by VK.
Economic and civic disruption from outages becomes evident
As the restrictions continued, businesses and public institutions in Moscow experienced significant disruption, including problems with payments, navigation, logistics, retail operations, and even government functions. Analysts estimated that five days of internet restrictions could cost Moscow businesses up to 5 billion rubles.
Whitelist-based internet controls are reportedly deployed in Moscow
Russian authorities were reported to be introducing a mobile internet "whitelist" system in Moscow that permits access only to government-approved websites and services, apparently using deep packet inspection to block most other traffic. The move was described as part of a broader push toward a more isolated sovereign Runet.
Moscow begins sustained mobile internet disruptions
A prolonged disruption of internet and mobile connectivity in Moscow began, with Russian authorities publicly presenting the restrictions as a response to Ukrainian drone threats. The outages affected everyday digital services across the city.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
5 references tracked. Mallory keeps watching after this page renders.
Russia demands a sovereign AI - Pivot to AI
pivot-to-ai.com
Open sourceCyberattack on telecom giant Rostelecom disrupts internet services across Russia | The Record from Recorded Future News
therecord.media
Open sourceAs� es la 'c�rcel digital' de Putin: sin 3G en la calle ni chat en casa y con una app esp�a obligatoria en el m�vil | Internacional
elmundo.es
Open sourceMoscow seeks to limit internet to state-approved websites amid ongoing outages | The Record from Recorded Future News
therecord.media
Open sourceThe Digital Iron Curtain: 5 Surprising Realities of Moscow’s Great Internet Blackout - Center for Cyber Diplomacy and International Security
cybercenter.space
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian Banking and Metro Payment Outage Disrupts Cards, ATMs, and Mobile Apps
A widespread outage disrupted banking apps and payment systems across Russia, leaving customers unable to make card payments, withdraw cash, or access mobile banking for several hours. Major banks including **Sberbank**, **VTB**, **Alfa-Bank**, **T-Bank**, and **Gazprombank** were affected, while payment failures also hit public transport in Moscow, where metro and suburban train turnstiles reportedly stopped accepting cards. Russian authorities said the incident was caused by a technical failure at one bank and insisted customer funds were not affected, but the exact cause was not publicly confirmed. Russian media and local experts pointed to a problem at **Sberbank** that may have cascaded across the financial sector because of its central role in acquiring, while other reports tied the disruption to **Roskomnadzor** internet-blocking activity and the government’s broader campaign against VPN services; independent media later said outlets were ordered to remove reporting that linked the outage to VPN restrictions.
Jun 29, 2026
Russia Uses DNS Blocking and Throttling to Disrupt WhatsApp and Telegram and Push State-Backed MAX Messenger
Russian authorities escalated restrictions on **WhatsApp** and **Telegram**, using network-level controls to disrupt access and steer users toward the Kremlin-promoted *MAX* messaging app. WhatsApp said Russia attempted to fully block the service, warning that isolating more than **100 million** users from “private and secure communication” would reduce safety. Reporting indicated Roskomnadzor removed `whatsapp.com` and `web.whatsapp.com` from Russia’s **National Domain Name System**, effectively breaking domestic DNS resolution so the service becomes largely reachable only via **VPNs** or non-domestic resolvers; digital rights monitors also reported other major services being removed from the national domain registry. Telegram also faced deliberate degradation: Roskomnadzor confirmed it “slowed down” the app, citing noncompliance with Russian law, amid widespread user-reported disruptions across multiple regions. State media reported Moscow courts opened multiple cases against Telegram in early 2026 for allegedly failing to remove content authorities label “extremist” or pornographic, with reported fines exceeding **$820,000**. Kremlin spokesperson **Dmitry Peskov** publicly tied restoration of access to compliance with Russian legislation, while Telegram founder **Pavel Durov** characterized the measures as authoritarian and aimed at forcing adoption of *MAX*, which he described as built for surveillance and censorship; Russia has a history of attempting to block Telegram, including a 2018 ban later lifted in 2020.
Jun 29, 2026
Escalating Cyber and Infrastructure Measures in Russia-Ukraine Conflict
Russia has intensified its campaign against Ukraine's energy infrastructure, deploying advanced weaponry to target not only electricity generation but also natural gas production, with a focus on the most vulnerable regions. In response, Ukraine has launched strikes on Russian energy sites deep within Russian territory, forcing Moscow to curtail some energy exports and ration fuel internally. The ongoing attacks have placed significant strain on Ukraine's energy grid, which relies heavily on nuclear power plants, thermal power, and hydroelectric sources, while the Zaporizhzhia nuclear plant remains under Russian control and offline. Concurrently, Russia has implemented new digital security measures, including 24-hour mobile internet blackouts for travelers returning from abroad, to prevent Ukrainian drones from exploiting domestic SIM cards for navigation. These restrictions have caused unexpected outages, particularly in border regions, and are part of a broader effort to expand the powers of the FSB to order shutdowns of mobile and internet access in response to perceived threats. Despite these measures, government-approved digital services remain accessible, and officials have indicated that some restrictions will persist around critical infrastructure until the end of the conflict.
Jun 29, 2026