Russian developers behind the custom firmware, 1001, used to convert consumer drones for military use in Ukraine, reported a cyberattack on their infrastructure. The attack disrupted the system that distributes the software, displaying false messages on operator terminals and disabling the system. While the firmware itself was not compromised, drone operators were advised to disconnect their terminals as a precaution. The attack targeted the server responsible for distributing updates, potentially limiting Russia's ability to deploy modified drones on the battlefield.
Source: https://therecord.media/cyberattack-russia-firmware-blow-hackers
TPRM report: https://scoringcyber.rankiteo.com/company/sigma-software-group
"id": "sig349070825",
"linkid": "sigma-software-group",
"type": "Cyber Attack",
"date": "7/2025",
"severity": "100",
"impact": "8",
"explanation": "Attack that could bring to a war"{'affected_entities': [{'customers_affected': ['Drone operators'],
'industry': 'Military Technology',
'location': 'Russia',
'name': 'Russian developers of 1001 firmware',
'type': 'Technology Developer'}],
'attack_vector': ['Server breach', 'Display false messages', 'Disable system'],
'description': 'Russian developers behind a custom firmware used to convert '
'consumer drones for military use in Ukraine reported a '
'cyberattack on their infrastructure, disrupting the system '
'that distributes the software.',
'impact': {'operational_impact': ['Disruption of drone firmware updates'],
'systems_affected': ['1001 firmware distribution system']},
'initial_access_broker': {'entry_point': ['Remote server'],
'high_value_targets': ['1001 firmware distribution '
'server']},
'motivation': 'Disruption of military drone operations',
'references': [{'source': 'Telegram channel Russian Hackers – To the Front'},
{'source': 'Independent Russian cybersecurity expert Oleg '
'Shakirov'}],
'response': {'communication_strategy': ['Statement posted on Telegram'],
'containment_measures': ['Advised operators to disconnect '
'terminals']},
'threat_actor': 'Unidentified hackers',
'title': 'Cyberattack on Russian Drone Firmware Infrastructure',
'type': 'Cyberattack'}