Full Report
Mobile internet in Moscow has been intermittently disrupted since March 6, with some areas still experiencing outages, local reports say.
Analysis Summary
# Incident Report: Moscow Intermittent Internet Disruption and "Whitelist" Implementation
## Executive Summary
Beginning March 6, 2026, Moscow and St. Petersburg experienced intermittent mobile internet disruptions attributed to state-mandated security measures. During these outages, Russian authorities operationalized a "whitelist" system, leveraging Deep Packet Inspection (DPI) to restrict access to government-approved platforms while blocking the broader global internet. The incident reflects a significant escalation in Russia’s "Sovereign Internet" (Runet) initiative, resulting in substantial regional economic impacts.
## Incident Details
- **Discovery Date:** March 6, 2026
- **Incident Date:** March 6, 2026 – Ongoing
- **Affected Organization:** Multiple Telecom Providers / General Public
- **Sector:** Telecommunications / Government
- **Geography:** Moscow and St. Petersburg, Russia
## Timeline of Events
### Initial Access
- **Date/Time:** March 6, 2026
- **Vector:** Government Mandate / Regulatory Control
- **Details:** Russian authorities initiated intermittent shutdowns of mobile internet services, citing the need to defend against Ukrainian drone attacks.
### Lateral Movement
- **Details:** Not applicable in a traditional cyber-intrusion sense; however, the restriction protocols moved from regional testing to major metropolitan hubs (Moscow and St. Petersburg).
### Data Exfiltration/Impact
- **Details:** Massive disruption of non-whitelisted digital services. Global platforms (Google, Apple, Microsoft) and encrypted messaging apps (Telegram, WhatsApp) were targeted for restriction. Economic impact estimated at 5 billion rubles ($60 million) over five days.
### Detection & Response
- **Discovery:** Reported by local media (Kommersant, Forbes Russia) and residents experiencing connectivity loss.
- **Response Actions:** Implementation of a "whitelist" system allowing only pre-approved Russian services (social media, marketplaces, taxi apps) to function via domestic infrastructure.
## Attack Methodology
- **Initial Access:** Regulatory enforcement over Domestic Internet Service Providers (ISPs).
- **Persistence:** Implementation of permanent traffic-filtering hardware within ISP networks.
- **Defense Evasion:** Requirements for whitelisted companies to ensure users cannot conceal IP addresses (forbidding VPN/proxy use).
- **Lateral Movement:** Expansion of filtering protocols across various regional jurisdictions.
- **Impact:** Use of **Deep Packet Inspection (DPI)** to analyze and drop packets destined for non-sanctioned IP ranges/URLs.
## Impact Assessment
- **Financial:** Estimated 5 billion rubles ($60 million) loss for Moscow businesses (logistics, car-sharing, retail).
- **Data Breach:** No unauthorized data theft reported; however, increased state surveillance via domestic routing requirements.
- **Operational:** Total disruption of mobile-dependent services; residents forced to revert to landlines and physical maps.
- **Reputational:** Public dissatisfaction and increased international scrutiny of Russia’s "Sovereign Internet" capabilities.
## Indicators of Compromise
- **Network Indicators:** Intermittent timeouts for non-Russian IP ranges; DNS resolution failures for non-approved domains.
- **Behavioral Indicators:** Success of connections only to services hosted on `*.ru` or specific state-approved infrastructure; blocked VoIP calls on Telegram/WhatsApp.
## Response Actions
- **Containment:** Authorities restricted mobile data to prevent perceived "drone threats" and external influence.
- **Eradication:** Not applicable; the "threat" (Western internet access) was neutralized by DPI filtering.
- **Recovery:** Shift of business operations to government-approved domestic alternatives.
## Lessons Learned
- **Infrastructure Dependency:** Excessive reliance on global cloud services (SaaS) creates a single point of failure when state-level "kill switches" are activated.
- **Localized Resiliency:** Organizations with domestic hosting and local dependencies maintained uptime while others failed.
- **DPI Potency:** High-level traffic filtering (DPI) is now a fully operationalized tool for nation-state internet fragmentation.
## Recommendations
- **For Local Entities:** Ensure all business-critical applications are hosted on servers within the domestic whitelisted infrastructure to ensure continuity during "Sovereign Internet" events.
- **For External Entities:** Monitor for regional availability disruptions and prepare for total market disconnection in regions implementing whitelist-only internet models.
- **General:** Defend against IP-masking bans by exploring hardware-level or alternative communication methods (e.g., satellite where legal/permitted).