Max Bernhard | @mxbernhard.bsky.social

journalist @correctiv_fakt @correctiv_orgㅣ@DowJones @WSJ alumㅣprev. work @dpa @LHreports @dwnews @guardian @WIRED othersㅣOSINT

[Max Bernhard | @mxbernhard.bsky.social @mxbernhard]

New: We looked into the large-scale phishing campaign that's targeting Signal users and found digital evidence pointing to Russian involvement – and a connection to previous attacks in Ukraine and Moldova.

[Henrik Moltke @moltke]

Thanks to @mxbernhard & Correctiv for picking this up blazingly fast! We built on their excellent investigation into the Neculiti Brothers and Stark Industries: https://t.co/AtqjK90oqV

[Henrik Moltke @moltke]

EU sanctions were supposed to shut down Russia’s favorite bulletproof hosting service, Stark Industries. Instead, it moved next door.
Proud & happy to share this story. Huge thanks to
@huibmodderkolk & every source who contributed, on or off the record. Lots more to say soon! https://t.co/Xtf2innE5i

[CORRECTIV.Faktencheck @correctiv_fakt]

In den Niederlanden wurden zwei IT-Unternehmer verhaftet, weil diese gegen EU-Sanktionen verstoßen haben sollen. Im Fokus der Ermittlungen steht ein Unternehmen, über dessen Rolle in Russlands hybridem Krieg CORRECTIV berichtet hatte. https://t.co/voybdFtUnM

[Donncha Ó Cearbhaill @DonnchaC]

In January, a phishing message arrived on my Signal account, supposedly from "Signal Support."

The unwise attack attempt, gave me a unique opportunity to peek inside this wide-scale phishing campaign targeting journalists and politicians.

I was target #13,730 in their database.

[CORRECTIV.Faktencheck @correctiv_fakt]

Vor einer Weile stießen wir auf #Tiktok auf ein auffälliges Profil: Eine junge Frau wirbt einerseits für ihr Profil auf einer Erotik-Plattform, andererseits für die #AfD. Und: Sie arbeitet mit #KI. https://t.co/l9qAVTBPzV (1/6)

[Max Bernhard | @mxbernhard.bsky.social @mxbernhard]

.@derspiegel and others now report that the German government suspects Russia to be behind this espionage campaign, in line with our findings last month
https://t.co/b9aeKz5BWo

[Max Bernhard | @mxbernhard.bsky.social @mxbernhard]

New: We looked into the large-scale phishing campaign that's targeting Signal users and found digital evidence pointing to Russian involvement – and a connection to previous attacks in Ukraine and Moldova.

[Centre for Information Resilience @Cen4infoRes]

Since 28 February 2026, southern Lebanese villages close to the Blue Line have been systematically destroyed. CIR has analysed satellite imagery of 46 towns and villages to document the scale and pattern of what is happening on the ground. 1/5

[📽️: Detonation of residential homes in Naqoura, southern Lebanon at coordinates 33.1209, 35.1345 and 33.1208, 35.137. Source: X]

[CORRECTIV.Faktencheck @correctiv_fakt]

Ein Satellitenbild soll brennende Öl-Infrastruktur unter anderem in Saudi-Arabien und Kuwait zeigen. Doch die Aufnahme ist mit Hilfe von Künstlicher Intelligenz gefälscht.
https://t.co/HveW3KXLuQ

[Malfors @MalforsHQ]

We are observing a targeted campaign delivering DarkSword RCE (GHOSTBLADE) via fake Atlantic Council "discussion invitation" emails.

IOCs:

siekeltd[.]com
escofiringbijou[.]com -- payload & C2

[Mari Saito @saitomri]

New: We looked at how Russia is remaking occupied territories in Ukraine, pouring hundreds of millions of dollars into roads, railways and ports to try and inexorably tie the region into their own, part of Putin's grand vision for so-called "Novorossiya" https://t.co/w9V6ZAALkH

[Max Bernhard | @mxbernhard.bsky.social @mxbernhard]

New: We looked into the large-scale phishing campaign that's targeting Signal users and found digital evidence pointing to Russian involvement – and a connection to previous attacks in Ukraine and Moldova.

[Mari Saito @saitomri]

The US is making its offer of security guarantees for a peace deal conditional on Kyiv ceding all of Donbas to Russia, Zelenskiy told Reuters. Trump is applying pressure to Ukraine in an effort to bring a quick end to the four-year war, he said. https://t.co/L7ztonffCY

[Max Bernhard | @mxbernhard.bsky.social @mxbernhard]

@wearetlpblack @Billbrowder @alexejhock @correctiv_org Thanks for spotting! Just fixed it

[Max Bernhard | @mxbernhard.bsky.social @mxbernhard]

New: We looked into the large-scale phishing campaign that's targeting Signal users and found digital evidence pointing to Russian involvement – and a connection to previous attacks in Ukraine and Moldova.

[Max Bernhard | @mxbernhard.bsky.social @mxbernhard]

@Billbrowder Story with @alexejhock for @correctiv_org https://t.co/rZdv7lagLM

You can find a list of the domains and corresponding IPs we found here https://t.co/7BrpEcBGYX

[Max Bernhard | @mxbernhard.bsky.social @mxbernhard]

@Billbrowder This tool was being advertised on Russian hacker forums for less than 700 USD. We also found evidence that it was used in previous phishing campaigns targeting users in Ukraine and Moldova.

[Christiaan Triebert @trbrtc]

“Made in USA” and Department of Defense codes: new photos of weapon debris allegedly recovered from Feb. 28 school strike in Minab show remnants consistent with a U.S.-made Tomahawk cruise missile. w/ @malachybrowne @johnismay https://t.co/q8zQ0peJpd