/
← Voltar ao feed
medium telecommunications government finance technology

Russia escalates VPN blocking, regional internet shutdowns and surveillance, raising operational risk for firms in Russia

1 fonte(s) · 1 atualização(ões) · publicado 14/10/2026 21:00 · coletado há 3 dias

Since mid-2025 the Kremlin has sharply escalated restrictions on digital communications, according to Insikt Group (Recorded Future). Measures include VPN blocking, state-managed regional internet shutdowns, throttling of Telegram and WhatsApp, promotion of the state-owned Max messenger, and expanded surveillance of Russian and foreign entities. Insikt Group assesses the aims are suppressing domestic dissent and building infrastructure that could isolate the Russian internet. A fully "sovereign RuNet" remains unlikely in the near term because of technical limits and domestic pushback. Organizations operating in or exposed to Russia face surveillance and data exposure, communication and tooling disruption, legal and sanctions risk, and degraded open-source visibility.

Detalhes técnicos

  • Roskomnadzor uses TSPU DPI hardware at ISPs and major internet exchange points to block VPN protocols (OpenVPN, WireGuard, Shadowsocks) rather than individual server IPs. Blocked VPN services rose from 258 (October 2025) to 460 (early 2026), and a unified state commission for central traffic filtering was set up in March 2026.
  • In April 2026 major domestic platforms (Gosuslugi, banks and others) were ordered to reject traffic from known VPN IP addresses.
  • Since May 2025, mobile and broadband outages have shifted to state-managed blackouts: over 37,000 cumulative hours in 2025, affecting nearly 80% of Russian territory. During blackouts ISPs and carriers are forced into allowlist-only modes, foreign CDNs such as AWS and Cloudflare are blocked, and throttling that allows only the first 16 KB of data to load has been tested.
  • WhatsApp was fully blocked by February 2026 by removing its domain from the National DNS, and Telegram is heavily throttled via TSPU. Max has been pre-installed on devices since September 2025 and reportedly lacks end-to-end encryption for chats.
  • Surveillance expansion includes Presidential Decree No. 467 (a unified database on foreign nationals), FSB demands that banks install SORM interception hardware, and mandatory reporting by ISPs and hosts of users who circumvent blocks, with domain de-delegation and fines for non-compliance.
  • Google was fined 22 million rubles in February 2026 for providing VPN services to Russians on Google Play.
  • Limits: TSPU has "limited capacity", allowlisted services failed in Moscow in May 2026, and VPN use grew to 39% of Russians despite the blocks.

Remediação

  • Plan for surveillance and exposure of sensitive data, and avoid relying on Russian-controlled messengers or infrastructure for sensitive communications.
  • Prepare emergency communication and business continuity plans for allowlist-only blackouts and corporate VPN/cloud access disruption.
  • Assess legal and sanctions exposure, and supply-chain disruption risk, for operations with direct or indirect Russia ties.
  • Expect further restrictions: VPN deterrence, punitive actions against non-compliant platforms, more outages framed as security measures, and a shift to domestic alternatives.

Linha do tempo

  1. recordedfuture.com ↗ · pub. 14/10/2026 21:00 · coletado 20/10 16:30 primeiro registro

    Russia escalates VPN blocking, regional internet shutdowns and surveillance, raising operational risk for firms in Russia

    ler a análise desta fonte

    Since mid-2025 the Kremlin has sharply escalated restrictions on digital communications, according to Insikt Group (Recorded Future). Measures include VPN blocking, state-managed regional internet shutdowns, throttling of Telegram and WhatsApp, promotion of the state-owned Max messenger, and expanded surveillance of Russian and foreign entities. Insikt Group assesses the aims are suppressing domestic dissent and building infrastructure that could isolate the Russian internet. A fully "sovereign RuNet" remains unlikely in the near term because of technical limits and domestic pushback. Organizations operating in or exposed to Russia face surveillance and data exposure, communication and tooling disruption, legal and sanctions risk, and degraded open-source visibility.

    Technical Details

    • Roskomnadzor uses TSPU DPI hardware at ISPs and major internet exchange points to block VPN protocols (OpenVPN, WireGuard, Shadowsocks) rather than individual server IPs. Blocked VPN services rose from 258 (October 2025) to 460 (early 2026), and a unified state commission for central traffic filtering was set up in March 2026.
    • In April 2026 major domestic platforms (Gosuslugi, banks and others) were ordered to reject traffic from known VPN IP addresses.
    • Since May 2025, mobile and broadband outages have shifted to state-managed blackouts: over 37,000 cumulative hours in 2025, affecting nearly 80% of Russian territory. During blackouts ISPs and carriers are forced into allowlist-only modes, foreign CDNs such as AWS and Cloudflare are blocked, and throttling that allows only the first 16 KB of data to load has been tested.
    • WhatsApp was fully blocked by February 2026 by removing its domain from the National DNS, and Telegram is heavily throttled via TSPU. Max has been pre-installed on devices since September 2025 and reportedly lacks end-to-end encryption for chats.
    • Surveillance expansion includes Presidential Decree No. 467 (a unified database on foreign nationals), FSB demands that banks install SORM interception hardware, and mandatory reporting by ISPs and hosts of users who circumvent blocks, with domain de-delegation and fines for non-compliance.
    • Google was fined 22 million rubles in February 2026 for providing VPN services to Russians on Google Play.
    • Limits: TSPU has "limited capacity", allowlisted services failed in Moscow in May 2026, and VPN use grew to 39% of Russians despite the blocks.

    Remediation

    • Plan for surveillance and exposure of sensitive data, and avoid relying on Russian-controlled messengers or infrastructure for sensitive communications.
    • Prepare emergency communication and business continuity plans for allowlist-only blackouts and corporate VPN/cloud access disruption.
    • Assess legal and sanctions exposure, and supply-chain disruption risk, for operations with direct or indirect Russia ties.
    • Expect further restrictions: VPN deterrence, punitive actions against non-compliant platforms, more outages framed as security measures, and a shift to domestic alternatives.