Belarus Bans Most Citizens from Going Abroad

Belarus has temporarily banned most of its citizens from leaving, including many foreign residency permit holders. From a report:
There are some exceptions, such as for Belarusian civil servants on official trips and state transport staff. The State Border Committee's tightening of the rules follows international outrage over Belarus's recent diversion of a Ryanair flight and arrest of a top dissident and his girlfriend on board. Many dissidents have left Belarus since a disputed election last year. In its statement on the Telegram messaging service, the border committee says it has received "many requests to leave Belarus on the strength of residence permits [issued] by foreign countries."

Only those with permanent residence in foreign countries -- not temporary -- are allowed to leave Belarus now, it says. The border committee blamed the measures on the coronavirus pandemic.
President Alexander Lukashenko's harsh crackdown on opponents since his disputed 9 August election victory has sent many into exile or to jail. His main rival, Svetlana Tikhanovskaya, who insists that she won, moved to neighbouring Lithuania with her team. Poland also hosts many Belarusians. Her foreign affairs adviser, Valery Kovalevsky, posted an angry tweet, saying President Lukashenko had "severely limited the right of Belarusians to travel, asserting that certain grounds (residency abroad) aren't sufficient to leave Belarus."

Read more of this story at Slashdot.

nmap -sV --script vuln -p- <target-network>

tail -f /var/log/suricata/fast.log | grep <cve>

Check Vendor Security Advisory Bulletin

title: Detect Exploitation - Belarus Bans Most Citizens from Going Abroad
id: 8bceb16d-d96c-44b8-8664-9107cb32edff
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "Belarus Bans Most Citizens fro" ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Belarus Bans Most Citizens from Going Ab")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

message: "*Belarus Bans Most Citizens from Going Ab*"

CommonSecurityLog
| where Message has "Belarus Bans Most Citizens from Going Ab"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc