Russia Is Tightening Internet Controls, Leading to Operational Risks

Executive Summary

Since mid-2025, the Kremlin has intensified restrictions on digital communications and infrastructure, very likely to suppress the organization of domestic political dissent and conduct digital surveillance within Russia. Increasingly strict measures targeting virtual private networks (VPNs), state-managed internet shutdowns, limitations on civilian communications platforms, and monitoring of domestic and foreign entities very likely represent an escalation from the approaches to censorship and surveillance pursued prior to 2024.

However, despite intensifying internet restrictions, technical and political limitations will likely prevent the Kremlin from achieving its long-held objective of a fully “sovereign internet” in the near term. The most likely scenario is that Moscow exerts extensive censorship and monitoring of online activity with increasingly strict –– though not absolute –– controls on circumvention and anonymizing tools.

Insikt Group assesses that the Kremlin’s primary objectives regarding internet restrictions are twofold: facilitating extensive surveillance of online activity to support control over the domestic information space while maintaining connectivity to the global internet, and developing national internet infrastructure under Kremlin control, enabling isolation from the global internet if the Kremlin so chooses. Efforts in support of these objectives have almost certainly provided the Kremlin with enhanced ability to control and monitor domestic online discourse.

In this environment, individuals and organizations operating in Russia are subject to increasing operational risks, including surveillance and exposure of sensitive data, challenges in conducting emergency communications, disruptions to corporate tools and digital applications, and legal risks. Entities with indirect exposure to Russia face an increased likelihood of supply-chain disruptions and sanctions violations and, over the longer term, face challenges in assessing the political and economic situation in Russia, as restrictions limit the availability of high-quality open sources.

Key Findings

• The Kremlin is very likely using managed internet shutdowns across Russia to test and improve its ability to isolate the Russian internet, though technical and political limitations make it unlikely that it will achieve its objective of establishing a fully “sovereign internet” in the near term.
• In the near- to medium-term, a combination of falling approval ratings for Russian President Vladimir Putin, declining public opinion amid economic strain, and ongoing Ukrainian drone strikes very likely incentivize Moscow to impose further internet restrictions, regardless of reported public dissatisfaction with some of these measures.
• The Kremlin will very likely continue to pursue strategies to deter VPN use by forcing platforms to support VPN blocks and making VPN use more expensive and inconvenient, though likely avoiding direct punitive measures against individual users.

Kremlin Systematically Tightening Internet Restrictions

Since July 2025, the Kremlin has systematically tightened access to widely used civilian communications applications and VPNs, caused regular mobile internet outages across Russia, and instituted requirements that place Russian and foreign individuals and firms under increased government surveillance. The Kremlin likely views these measures as necessary to make it more difficult for Russian elites or the public to coordinate political dissent, and for the Ukrainian government to launch drone strikes against Russian critical infrastructure.

Restrictions Represent Marked Escalation in Control Over Russian Internet

Insikt Group assesses that, since 2012, Russians have seen their ability to operate without restriction on the internet decline in several waves, primarily driven by the Kremlin's calculation that Russians were using the internet to organize anti-government political actions.

Table 1: Russian approaches to internet restrictions from 2000–2024 (Source: Recorded Future)

Kremlin Tightening Restrictions on VPN Usage and Promotion

Since mid-2025, the Kremlin has accelerated its campaign against VPNs and other circumvention tools, deploying legal, economic, and technical measures to systematically block VPNs. In September 2025, the Kremlin prohibited advertising VPNs and the dissemination of material or instructions explaining how to bypass internet blocks. Violating that law carries a fine of up to 500,000 rubles (approximately $6,300–$6,500 USD). In addition, Russian search engines and local application stores are required to scrub content, links, and advertisements promoting anonymization software.

The Kremlin has also expanded the number of VPN services it blocks and enhanced the Russian government’s ability to do so via a centralized mechanism. As of October 2025, Roskomnadzor had blocked 258 VPN services. By early 2026, that number had increased by over 70%, to 460 VPN services. In implementing these blocks, Roskomnadzor has expanded its use of TSPU hardware, which is installed on major internet exchange points. This allows the government to target underlying VPN protocols rather than by flagging known server IP addresses. In March 2026, the Kremlin established a unified state commission to centrally filter traffic, isolate regional nodes, and execute protocol blocks across networks.

In mid-2026, the Kremlin also began moving from blocking VPN traffic at the ISP level to forcing domestic applications to actively block VPN users. In April 2026, the Kremlin ordered major domestic platforms, including state service portal Gosuslugi, major banks, and other applications to reject traffic originating from IP addresses associated with known VPNs. The Kremlin also sought to complicate VPN use by locking out users who use background VPNs from services such as banking, food delivery, and government applications until they disconnected from the VPN.

The Kremlin has fined foreign companies for providing VPN services, highlighting the operational risk these restrictions pose to Western companies operating in Russia. For example, in February 2026, the Kremlin issued a 22 million ruble fine (approximately $288,000 USD) to Google for providing VPN services to Russians on the Google Play app store.

Kremlin Increasing Internet Outages Across Russia, Very Likely to Test the Extent of Its Control

Since May 2025, mobile and broadband outages in Russia have shifted from sporadic events to what Insikt Group assesses are very likely state-managed blackouts and throttling to experiment with state control over systemic internet access. In May 2025, there were an estimated 69 regional disruptions in mobile or broadband access; by June 2025, there were over 655 disruptions. In 2025, there were over 37,000 cumulative hours of blackouts, according to independent trackers, affecting nearly 80% of Russia’s territory.

During a typical blackout, Russian telecommunications regulators force commercial ISPs, mobile network operators, and backbone transit providers into allowlist-only modes, where users lose access to global servers and can only access certain domestic platforms, such as state government provider Gosuslugi, domestic banks, and Russian search engine Yandex. 74 of Russia’s 83 regions have introduced allowlists of government-approved sites, according to independent Russian trackers. In addition, during blackouts, Roskomnadzor blocked foreign content delivery networks (CDNs) such as Amazon Web Services (AWS) and Cloudflare, causing foreign-hosted sites and applications to stall even when not explicitly blocklisted. Regulators have also tested throttling techniques that limit access to foreign IP addresses by allowing websites to load only the first 16 kilobytes of data, effectively rendering modern websites unusable.

The Kremlin has claimed that these blackouts are necessary to prevent the Ukrainian military from using local cell towers to launch drone attacks in Russian territory. While drone attacks do often use local cell towers, the blackouts extend to parts of Russia that are beyond the range of Ukrainian drones, such as eastern Siberia. The broad swath of the outages, combined with the broader trend since mid-2025 of the Kremlin tightening restrictions on internet freedom, indicates that the Kremlin is very likely using these outages to stress-test its ability to sever Russian internet networks from foreign systems.

Figure 1: At least 74 Russian regions had introduced allowlists of approved sites as of April 2026, supporting government-imposed internet shutdowns (Source: Recorded Future)

Kremlin Intensifying Efforts to Throttle Access to Telegram and WhatsApp, Forcing Russians Into Government-Owned Max Application

Beginning in mid-2025, the Kremlin intensified its efforts to restrict Russians’ access to popular civilian communications applications –– most notably Telegram and WhatsApp –– and force Russians to use the state-owned Max application. The Russian government’s motivations behind this campaign are very likely to enhance control over domestic discourse, thereby making it harder for Russians to organize political dissent movements.

The Kremlin has launched this campaign, which Insikt Group assesses has had only limited success, in several phases. In August 2025, the Kremlin restricted voice over internet protocol (VoIP) capabilities on WhatsApp and Telegram, ostensibly to combat fraud on those applications. In October 2025, the Kremlin began blocking SMS verification codes needed for new users to register for the applications. In addition, DPI technology was deployed on domestic ISPs to degrade load times and voice messages on Telegram.

By February 2026, the Kremlin had moved to fully block WhatsApp by scrubbing its domain from the National Domain Name System, thereby cutting off access to the application for its 100 million Russian users. Also by February, the Russian government had used TSPU devices –– installed at nearly every major Russian ISP and mobile network core –– to heavily throttle Telegram, very likely in an effort to render the application unusable.

Concurrently, the Kremlin has sought to force Russians to use Max for texting, calls, and other functions, including government services, electronic document signing, online payments, and digital ID capabilities. In September 2025, a federal mandate took effect that pre-installed the application on all Android and iOS devices sold in Russia and Belarus. Independent security analysts assess that Max lacks end-to-end encryption for chat functions and shares user metadata and identifiers with Russian intelligence and law enforcement agencies.

Kremlin Expands Surveillance of Foreign and Russian Individuals and Companies

Insikt Group assesses that, as the Kremlin works to enforce its expanded restrictions on and state control over digital communications and infrastructure, it has also enhanced surveillance of Russian and foreign individuals and firms. In sum, these measures likely reflect an effort by the Kremlin to merge multiple surveillance functions –– including immigration control, enforcement of telecommunications regulations, and monitoring of political discourse –– into a single system.

One aspect of the Russian government’s enhanced surveillance is expanded digital profiling and monitoring of foreign nationals inside Russia. In July 2025, Putin issued Presidential Decree No. 467, which established a unified database tracking foreign nationals’ entry and exit, property ownership, vehicle registration, tax obligations, and employment history. The Kremlin also expanded its collection of foreign nationals’ biometric data; by mid-2025, all non-citizens entering Russia or living temporarily in Moscow were required to maintain a digital profile registered with the Russian government.

The Russian government also expanded SORM (System for Operative-Investigative Activities) mandates and corporate reporting rules, very likely as part of its effort to enforce new telecommunications and internet regulations. In early 2026, the FSB issued demands to Russian commercial banks, classifying their mobile applications as “Organizers of Information Distribution” and requiring banks to install specialized SORM interception hardware. SORM hardware grants Russian intelligence services direct access to user communication and transaction metadata. Banks that do not comply with these requirements risk being excluded from the state’s official allowlist of services that operate during blackouts. In addition, telecommunications providers, web hosts, and ISPs are required to report individuals who attempt to circumvent blocks or otherwise violate state telecommunications regulations. Failure to comply can lead to domain de-delegation –– revocation of .ru domains at the DNS level –– and multimillion-ruble fines.

Figure 2: References to internet restrictions during the Russian invasion of Ukraine in the Recorded Future Intelligence Platform show a marked uptick since May 2025 (Source: Recorded Future)

Obstacles to “Sovereign RuNet” Remain

The geographic range of internet outages across Russia since May 2025, amid increasing internet restrictions, suggests that the Kremlin is stress-testing its ability to isolate Russia from global networks. However, Insikt Group assesses that the successful implementation of the national internet infrastructure and technical measures required to enable isolation from global networks –– a fully “sovereign RuNet” –– remains unlikely in the near future due to technical limitations, continued reliance on platforms not fully under state control, and domestic pushback, including among elites.

Technical Challenges Impede VPN Detection, Blocking

The use of the National DNS (NDNS) to restrict banned websites has made government efforts to block the use of VPNs more important for the Kremlin, as access to sites removed from the NDNS is primarily possible with a VPN or an external DNS server. However, some measures to restrict VPN use have faced delays due to implementation challenges reported by businesses. In spring 2026, Russian news outlets reported that a proposal to introduce fees for mobile subscribers who use international data traffic –– intended to target VPN users –– had been postponed, at least in part due to the difficulty of accurately defining international traffic. In June 2026, several IT companies reportedly complained that VPN restrictions were preventing software developer access to code repositories and development environments with cloud components, suggesting that the restrictions are impacting both corporate and popular VPNs.

According to a Roskomnadzor document from January 2026, publicly reported in May 2026, the agency aims to be able to restrict access to VPNs with “an average level of effectiveness” of 92% by 2030. However, recent reporting indicates that VPN use remains common, even as Moscow has sought to reduce access to and the functionality of these services (Figure 3). Since early 2026, the share of Russians using a VPN has grown to 39%, up 8.3% from 2025, according to Kommersant, despite a 70% increase in VPN restrictions from October 2025 to mid-January 2026. Similarly, a survey by Russian Field found that 40% of polled individuals know what a VPN is and use VPN services as of April 2026, up from 34% in August 2024.

Figure 3: Google searches for “VPN” in Russia correspond with the escalation of restrictions on VPNs and messaging platforms since 2025, culminating in a sharp spike during spring 2026 discussions of VPN-blocking measures (Source: Google Trends)

The implementation of blocking via TSPU and allowlists intended to preserve access to approved resources during internet shutdowns has also not proceeded without complications. March 2026 reporting suggests that TSPU has “limited capacity,” resulting in sporadic access to ostensibly blocked services. According to mobile network operator Megafon, a wide range of online services are reportedly included on the allowlist for the Moscow area, including government services and state-owned companies; banks and finance applications; online stores and restaurant ordering; television and radio news; VK services, including Odnoklassniki and Max; Yandex services; and health, transport, and travel services. Despite this, in May 2026, Moscow residents were reportedly unable to access allowlisted services (including taxis, ATMs, and banking applications) for several days during mobile internet shutdowns.

Persistent Use of Foreign Platforms

Despite efforts to promote domestic platforms such as VK, RuTube, and Max, a large portion of the Russian population, including government officials, continues to use foreign social media platforms. Telegram remains popular among both the public and among government officials, who continue to use it for official communications and press releases. Moreover, despite requirements for government employees to install Max under a mandate to exclusively use domestic messaging applications for work-related communications by 2030, evidence indicates the platform remains unpopular among the public, very likely hindering its adoption.

While Max reportedly has over 86 million users as of June 2026, approximately 70% of channels belong to government agencies and public institutions, according to a February 2026 analysis, indicating limited popular use. In February 2026, Russian army units in Ukraine reportedly received recommendations not to use Max due to security concerns, despite claims by the FSB that the use of Telegram on the front lines could facilitate Ukrainian signals intelligence and targeting. In June 2026, a comedy show on the state-owned Channel One featured a joke about Max: “‘Why are you writing to me in a private chat: Hey everyone!?’ ‘Well, that’s how it works on Max!’” –– a reference to the widespread perception that communications on Max are subject to government surveillance.

In March 2026, the Liberal Democratic Party of Russia expelled deputy Andrei Svintsov from the party over his vocal support for internet restrictions, particularly Telegram, stating that support for such measures was harming the party’s reputation. In April 2026, Communist Party leader Vyacheslav Markhayev blamed the Ministry of Digital Development for “technological degradation” in the country due to internet outages and Telegram blocks. While remarks from “systemic opposition” leaders almost certainly do not indicate that these parties have either the ability or desire to attempt to block internet restriction legislation more broadly, Insikt Group assesses that such commentary reflects the unpopularity of measures such as Telegram throttling or internet blackouts.

Restrictions Very Likely to Tighten Further

While a fully sovereign internet remains unlikely in the near term, Insikt Group assesses that the Kremlin will very likely continue to strengthen its control over the domestic information space as Putin contends with declining public support and the growing economic impact of Ukrainian drone strikes on Russian oil refinery infrastructure –– factors that very likely create incentives for Moscow to restrict the potential for digitally organized protests and dissent. Future restrictions are most likely to take the form of efforts to deter individual VPN use, punitive actions against platforms that do not comply with data retention or censorship requests, increased internet outages legitimized as security measures, and replacement of Western communications infrastructure with domestically developed or controlled alternatives.

Current Conditions Incentivizing Stricter Digital Control

Escalating Ukrainian drone strikes on targets within Russia, including in areas far from front-line border zones; consequent fuel-rationing measures and damage to critical infrastructure; deteriorating economic conditions; and unpopular restrictions on civilian communications are very likely escalating public pressure on the Kremlin to a level not seen since mass protests between 2011 and 2013. These conditions very likely signal to Moscow the need to exert stronger control over the domestic information environment in order to limit potential avenues for organizing political dissent online, though public pushback against the most unpopular forms of communication restrictions may force authorities to adopt a softer or more incremental approach to censorship.

Recent public criticisms of the government’s economic and fiscal policies, wartime strategy, and censorship –– including direct criticism of Putin himself –– from historically pro-Kremlin constituencies illustrate the impact of these factors. In a notable example, in March 2026, prominent pro-Putin military blogger Ilya Remeslo ––  who previously propagated narratives against dissidents such as Alexei Navalny and served on the Civic Chamber of the Russian Federation, a pro-Kremlin advisory body –– published a post on Telegram condemning the war in Ukraine due to its impact on Russian citizens, the country’s economic situation, and censorship and internet restrictions. The post also called for a new president to replace Putin, whom Remeslo characterized as “a war criminal and a thief.” As of July 19, 2026, Russia’s state polling organization VCIOM’s “trust in politicians” survey reported a 71% approval rating for Putin, the lowest recorded rating since immediately before the February 2022 full-scale invasion of Ukraine, when it stood at 67% (Figure 4). The Kremlin almost certainly closely monitors and approves public opinion results regarding Putin; as a state polling firm, VCIOM’s reporting therefore reflects what the Kremlin is willing to make public. While VCIOM polling almost certainly remains subject to state manipulation, the decline in Putin’s approval rating since late 2025 is notable and likely indicates that the Kremlin is allowing limited airing of discontent within boundaries it deems acceptable.

Figure 4: Putin’s official approval rating from September 2021 to July 2026 (Source: VCIOM)

Further internet restrictions intended to prevent civil unrest would also almost certainly precede any increased military mobilization, should Putin decide to pursue this course of action, given highly negative public sentiment toward mobilization and the protests and emigration that followed the partial mobilization in 2022. Given the critical role of online communications in organizing major mass protests in 2011 over electoral fraud, the Kremlin very likely continues to perceive effective command of digital communications platforms as crucial to maintaining domestic political control. While the Kremlin is likely to allow airing of public and elite discontent to a degree, it will very likely aim to prevent the emergence of anti-Putin or large-scale protests.

Efforts to Deter VPN Use Very Likely, Short of Total Ban

Recent proposals by Russian authorities suggest that future efforts to reduce VPN use will very likely focus on compelling online platforms to support VPN detection and blocking, and on making VPN use inconvenient, unreliable, or perceived as unsafe for consumers. In March 2026, Russian Minister of Digital Development Maksut Shadayev stated that “the introduction of administrative fines for VPN use” was under consideration, but characterized such a measure as a “blunt solution, which we strongly dislike.” Shadayev described alternate measures as “complicated compromises,” likely reflecting a preference for deterring VPN use while avoiding direct punitive measures on individuals.

In March 2026, Kommersant reported that Russian developers that permit VPN users to access their services risk losing their IT accreditation from the Ministry of Digital Development. (The accreditation exempts them from VAT, lowers their corporate income tax rate from 25% to 5%, decreases insurance premiums, and grants a military service deferment for employees.) Companies could also lose the right to pre-install their applications on Russian mobile devices; together, these consequences are very likely intended to force the cooperation of such providers in reducing VPN use.

Efforts to complicate individual VPN use include a March 2026 proposal that would have required telecommunications operators to impose surcharges for customers using more than 15 GB of international traffic per month on mobile networks. The plan would reportedly charge 150 rubles per GB beyond the first 15 GB, a fee unlikely to deter sporadic VPN use but likely prohibitive for those who regularly use VPNs to access blocked resources. By April 1, 2026, all four major telecom operators in Russia reportedly blocked the ability to top up Apple ID balances from mobile phone accounts, ostensibly to prevent the purchase of VPN applications. In April 2026, the Bell reported that FSB officials proposed automatically fining individuals through Gosuslugi if a SIM card in their name was identified using a VPN, though that approach was subsequently rejected. Beginning March 1, 2027, Russian banks will block financial transactions if malware is detected on a client’s device under law No. 210-FZ. While the law is ostensibly intended to prevent fraud, this and similar measures can almost certainly be used to detect and prevent VPN use.

Russian government entities have also portrayed VPNs as ineffective at protecting privacy and facilitating data theft, very likely in an effort to deter users from using VPN services and justify VPN restrictions on security grounds. In April 2026, the Ministry of Digital Development claimed that “most VPNs do not protect privacy and personal data and are often used by criminals to intercept traffic and information.” The Ministry of Internal Affairs similarly stated that using VPN services “increases the risk of data leaks.”

Coercive Measures Targeting Online Platforms Very Likely

Continued efforts to coerce communications platforms –– signaling an increased ability of the FSB and other state security services to conduct digital surveillance and access data from these platforms –– are very likely. However, pushback against the most unpopular restrictions, namely the blocking of Telegram, may prompt the government to adopt a more incremental approach to these measures.

In June 2026, Russia unblocked gaming platform Roblox, which had originally been blocked in December 2025, after the platform reportedly pledged to comply with Russian legislation “to ensure user safety” and “combat the spread of objectionable content.” Kremlin spokesperson Dmitry Peskov stated that the unblocking of Roblox demonstrated that “all services can return if they comply with the law.” This measure likely illustrates two complementary aspects of the Kremlin’s approach toward digital platforms that do not comply with its data retention and censorship requirements: providing incentives to comply by promising a reversal of blocking measures, and portraying itself as seeking a reasonable compromise with banned platforms over legitimate security concerns, thereby offloading the ultimate responsibility for blocking measures onto companies that refuse to meet its requests.

In March 2026, Russia’s Federal Anti-Monopoly Service (FAS) stated that it would introduce a grace period through the end of 2026 for a ban on advertising on Telegram and YouTube. Under the ban, both advertisers and content creators could face legal penalties and fines of up to 500,000 rubles ($5,900) for placing ads on Telegram. FAS linked the ban to Roskomnadzor’s restrictions on Telegram and other services, stating that “if Roskomnadzor takes measures to restrict access to platforms … advertising on such resources is prohibited.” In addition to depriving restricted platforms of advertising revenue –– creating a financial incentive for such platforms to comply with Russian government requests –– this measure poses potential legal risks for entities and individuals placing advertisements on restricted platforms, likely driving those individuals to other online forums. FAS stated that the grace period would give businesses “time to adapt to the new rules and shift to alternative advertising channels.”

Further Shutdowns Likely as Kremlin Tests Control Over Internet

As outlined above, Insikt Group assesses that further internet disruptions are likely as the Kremlin seeks to test and refine its ability to isolate Russian internet networks from foreign systems. Authorities will almost certainly justify such outages on the basis of ensuring security or protecting against foreign election interference.

Official statements prior to the September 2026 State Duma elections sought to justify any internet disruptions as legitimate responses to external security threats. On June 15, 2026, Central Election Commission Chair Ella Pamfilova stated that internet disruptions were possible during the election period, adding that such measures would be “in the interests of ensuring security.” An October 2025 decree formally granted broad powers to Roskomnadzor, the FSB, and the Ministry of Digital Development to disconnect the Russian internet in the event of “threats to its stability, security, and integrity.” First Deputy Chairman of the State Duma Committee on International Affairs Alexei Chepa subsequently stated that terrorist threats or “attempts to influence elections via the internet” could prompt outages during the 2026 elections.

In May 2026, Putin directed Prime Minister Mikhail Mishustin and FSB director Alexander Bortnikov to ensure the “uninterrupted operation of essential services,” including public services, medical care systems, and payment systems, during periods of “restricted operation” of the internet and telecommunications networks. The Ministry of Digital Development noted that online voting resources had been added to the “white list” to enable voting even in the event of “limitations on mobile connections and internet.” This aligns with Insikt Group’s assessment that the Kremlin seeks to use internet outages to disrupt organized dissent, while limiting disruptions to individuals’ daily lives that might spur public backlash.

Kremlin Almost Certain to Prioritize Development of Domestic Alternatives to Western Systems

Beyond introducing restrictions on communications platforms, the Kremlin will almost certainly continue efforts to reduce reliance on Western systems, or systems perceived to be under the control of Western governments, and replace them with domestically developed or controlled alternatives. Putin and other top officials have consistently framed “sovereign internet” initiatives and restrictions on online content as necessary to insulate Russia from foreign threats, very likely reflecting Moscow’s perception that the US and other Western adversaries can leverage their influence over online platforms and communications infrastructure against it.

For example, Law No. 90-FZ, which underpinned the development of a “sovereign internet,” heavily cited the need to protect Russian networks from external threats, and Putin has called for reducing reliance on the US-based Internet Corporation for Assigned Names and Numbers (ICANN) for over a decade. The departure of technology firms from Russia post-February 2022, the removal of Russian applications such as Max and VK from app stores, and reported disruption to Russian military operations in Ukraine following the loss of Starlink access, have all very likely reinforced to the Kremlin the need to develop reliable domestic alternatives to Western services. In June 2026, First Deputy Chair of the State Duma Committee on Information Policy Marina Kim stated that the removal of Russian apps from app stores illustrated the need to quickly establish “our own internet.” In this view, control over critical communications and internet infrastructure –– such as app stores, DNS, and satellite internet –– improves resilience to perceived Western coercion, in addition to supporting domestic surveillance and censorship.

Outlook

Russia’s increasingly restrictive information environment poses significant risks of surveillance and operational disruption to organizations and individuals located in or with interests in the country. Given these risks, Insikt Group recommends that entities with an operational nexus or secondary exposure to Russia adopt the mitigation measures outlined in Table 2.

Beyond the likely near-term internet restrictions and associated risks outlined in this report, offensive cyber activity in support of government-imposed internet restrictions would be a major escalation in the Kremlin’s approach to censorship (see High Impact/Low Probability Scenario, below). In June 2026, Amnezia VPN blamed Roskomnadzor for large-scale distributed denial-of-service (DDoS) attacks that caused connectivity disruptions, though Insikt Group has not identified any further attacks. Similarly, criminal charges or other punitive measures against individual VPN users would represent a significant departure from the status quo, although any such measures would likely target those who deploy VPNs or encrypted messaging applications to publicly criticize the Kremlin or engage in other behavior that authorities deem threatening.

In the long term, the successful development and implementation of a “sovereign RuNet” under Kremlin control would very likely provide a template for internet censorship and digital control that could be applied elsewhere. As such, organizations without primary or secondary exposure to the Russian market but with interests in countries where governments have demonstrated a desire to control the domestic information environment should assess how Russian internet restrictions could set a precedent for similar measures abroad.

Table 2: Risks and recommended mitigations for public and private sector entities (Source: Recorded Future)

High Impact/Low Probability Scenario: Assessing Potential Use of the Kremlin’s Offensive Cyber Capabilities Against Russia-Based Entities

The infrastructure the Kremlin has assembled to monitor and restrict the domestic internet is not exclusively defensive in design. A 2022 study of TSPU architecture found “pervasive deployment” of TSPU hardware across Russian residential networks, positioned in front of more than one million measured endpoints such that all subscriber traffic must pass through the devices. That in-path position creates the technical potential to inject traffic rather than merely block or throttle it — a capability well documented in other authoritarian contexts.

China's experience provides the clearest precedent. Beijing's Great Cannon, first observed in March 2015 (1, 2), was a man-in-the-middle attack tool, distinct from the Great Firewall, that injected malicious JavaScript into traffic sent to Baidu's servers, thereby recruiting ordinary internet users as unwitting participants in DDoS attacks against GreatFire.org and GitHub. The tool's operational deployment represented a significant escalation in state-level information control by weaponizing bystander systems outside of China. Citizen Lab analysts assessed that a technically simple configuration change would have allowed it to deliver malware to targeted individuals communicating with any Chinese server not protected by HTTPS. The key architectural fact for the Russian comparison is the Great Cannon’s in-path position, which enabled the system to drop legitimate content and substitute malicious content undetected. The 2022 study mentioned above found that, compared to the Great Cannon or similar systems, in-path systems deployed close to end users, such as the TSPU, are “better suited for targeted surveillance and machine-in-the-middle attacks.”

The FSB has documented precedent for deploying offensive cyber capabilities against Russian nationals on Russian soil. In 2024, legal rights group Perviy Otdel (“First Department”) reported that the FSB installed Monokle, advanced Android spyware developed by sanctioned Russian defense contractor Special Technology Center, on the phone of systems analyst Kirill Parubets following his detention for donating to Ukrainian organizations. Citizen Lab assessed that the software was likely either an upgraded variant of Monokle or new software created by reusing Monokle code.

Examples such as the Parubets case establish a precedent for Russian security services to target individuals perceived as threats with spyware. However, while spyware like Monokle requires access to an individual’s device, TSPU sits in-path across residential ISP traffic. As such, TSPU provides a structural network-layer capability that could enable collection and potentially injection at scale.

Insikt Group assesses that the primary near-term risk to entities operating in Russia remains passive collection via SORM rather than active injection. Over 80% of websites now use HTTPS encryption, which limits what SORM-3 can access at the content level, though network connection metadata remains fully exposed. The offensive injection scenario is plausible but would represent a doctrinal escalation without clear precedent in the domestic context, and Insikt Group assesses it is unlikely in the near term, absent a significant deterioration in domestic political conditions. Organizations should nonetheless treat the TSPU layer as an adversarial network position: traffic traversing Russian ISP infrastructure that is not end-to-end encrypted should be considered observable and potentially modifiable by Russian state actors.

Related Resources

Explore expert insights, reports, and tools to strengthen your cybersecurity strategy.