Russian websites could soon be easy pickings for hackers as security certificates expire banks, emails, and government systems all potentially at risk

Date:
Mon, 17 Aug 2026 19:35:00 +0000

Description:
Russia's websites lost their trusted certificates, and the fix Moscow is offering asks users to install a state root that can vouch for any site on
the internet.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Japanese certificate authority GlobalSign revoked TLS certificates for thousands of Russian domains in June 2026 as it implemented US and EU sanctions As a result, seven major Russian banks now serve certificates from a state root that no mainstream browser trusts, forcing users to manually install them Ukraine's Foreign Intelligence Service says the losses turn Russian banking, email, and internal systems
into easier targets Russian companies are finding themselves in an extremely tricky situation as US OFAC and EU sanctions now affect international
security certificates issued by third-party providers.

A statement issued by Ukraine's Foreign Intelligence Service on August 12
said the certificate withdrawals essentially left the country's internal systems, email, and banking exposed to attack because no internationally recognized certificates were issued for their domains. It noted Russian state services, including the Federal Tax Service, increasingly fail to load in Chrome, Firefox, and Safari, and estimated that roughly 90% of the Russian market still depends on foreign-issued certificates, and that wide implementation of these sanctions could make it harder for users to access affected sites. Latest Videos From TechRadar Watch full video here: Web trust certificates sanctioned away? The move began on June 13 2026 when Japanese certificate authority GlobalSign, which controls much of Russia's commercial foreign certificate market, force-revoked TLS certificates it had previously issued to Russian companies.

Its local arm said that it could not influence the parent company's decision, which came due to new CA/Browser Forum rules, starting May 4. The rules effectively made screening applicants against the US OFAC and BIS lists, and European sanctions lists, mandatory for certificate authorities rather than optional, essentially tying the certificate provider's hands. You may like US and security allies warn Russian attacks on critical infrastructure are ramping up 'The situation isnt looking good' Russia halts VPN fees, but the Kremlin's war against censorship circumvention tools doubles down Russians need a VPN to access Google and Apple as unexplained nationwide outages hit

The move was implemented in two waves; the first affected an estimated 15,000-20,000 domains, and the second affected a more specific 310 domains across 44 companies, including large domestic names such as Rosneft, Gazprombank, Alrosa, and Positive Technologies.

The Ukrainian side insists that Russian internal systems, messengers, email, and banking APIs have become "ideal targets for hacker attacks," and there is some truth to it, even if mitigation is already underway on the Russian end. It estimates that reconfiguring infrastructure could cost larger corporations as much as 10 to 50 million rubles and take up to six months, and it is an error-prone process. Are you a pro? Subscribe to our newsletter Sign up to
the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners
or sponsors By submitting your information you agree to the Terms &
Conditions and Privacy Policy and are aged 16 or over.

The move saw Russian domain owners, including its banks and tax services,
turn elsewhere, with some moving first to a Greek academic certificate authority, HARICA, before turning to China's TrustAsia, which currently provides its state entities with certificates.

A more complicated play from the Russian end is a homegrown alternative the government continues pushing: state-issued trust root certificates that users must install manually. While the Ministry of Digital Development describes manual installation of its root certificate as "safe" and as having no effect on device function, security researchers have previously warned in 2022 and again in 2026 that a state-controlled root could be abused for "HTTPS traffic interception and man-in-the-middle attacks".

Moscow's other recommendation is that users switch to Yandex Browser, which ships with the domestic root built in. Ukraine's narrative dismisses that as an alternative prone to freezing and cache failures and offering no
meaningful data protection, an assessment it attributes to "experts inside Russia."

Whatever the short-term outcomes result in here for .RU domains, a move like this could further disconnect Russia from the rest of the world, with Russian services working smoothly only for users running Russian software with a
state root installed.

This might already be the trajectory for a Russia reeling from cyberattacks and sanctions, but one can assume the certificate revocations will only compress the timeline to that point, whether by design or an unintended consequence. Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/russian-websites-could-soon-be-easy-pic kings-for-hackers-as-security-certificates-expire-banks-emails-and-government- systems-all-potentially-at-risk


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)