Russian ruble-backed stablecoin A7A5 processed over $110 billion in transactions despite Western sanctions, according to CertiK. The Russian ruble-backed A7A5 stablecoin continued to grow despite Western sanctions, processing more than $110 billion in cumulative onchain transactions, according to CertiK. CertiK said A7A5 captured about 43% of the global non-US dollar stablecoin market, and that its holder count rose from 13,000 to 29,000 wallets between February 2025 and May 2026. The security company described A7A5 as one of the clearest examples of a sanctions-evasion stablecoin ecosystem, linking it to Russian cross-border settlement companies. Read more
Russia’s central bank is considering scrapping its strict requirements for crypto transactions as sanctions make it hard for Russians to transact internationally. An official from the Bank of Russia suggested easing restrictions on cryptocurrencies in response to the sweeping sanctions imposed on the country. According to a Monday report by local news outlet Kommersant, Bank of Russia First Deputy Governor Vladimir Chistyukhin said the regulator is discussing easing regulations for cryptocurrencies. He explicitly linked the rationale for this effort to the sanctions imposed on Russia by Western countries following its invasion of Ukraine in February 2022. Chistyukhin said that easing the crypto rules is particularly relevant when Russia and Russians are subject to restrictions “on the use of normal currencies for making payments abroad.” Read more
The malware, LOSTKEYS, can steal files from hard-coded extensions and directories, according to Google. Threat group COLDRIVER is using new malware to steal documents from Western targets, according to a May 7 report from Google Threat Intelligence. The malware, called LOSTKEYS, shows the evolution of the group from credential phishing to more sophisticated attacks. According to the Google report, the new malware is installed through four steps. The process involves a “lure website” with a fake CAPTCHA, a PowerShell script downloaded to the user’s clipboard, some device evasion, and retrieval of the final payload. Lastly, the malware is installed. LOSTKEYS is capable of stealing files from extensions and directories. It can also send system information and running processes back to COLDRIVER. The address from which the parts of the attack come is “165.227.148[.]68” according to Google. Read more