US Probes How American Electronics Wound Up in Russian Military Equipment in Ukraine

America's federal agents "have begun questioning U.S. technology companies on how their computer chips ended up in Russian military equipment recovered in Ukraine," reports the Washington Post:

Commerce Department agents who enforce export controls are conducting the inquiries together with the FBI, paying joint visits to companies to ask about Western chips and components found in Russian radar systems, drones, tanks, ground-control equipment and littoral ships, according to people familiar with the matter, who spoke on the condition of anonymity to discuss sensitive investigations. "Our goal is to actually try to track that back, all the way back to the U.S. supplier" to determine "how did it find its way into that weapons system," one Commerce Department official said of the probes....

It isn't clear which specific components are being probed. But investigators from a variety of countries have identified Western electronics in Russian weaponry found in Ukraine. Many of those components appear to have been manufactured years ago, before the United States tightened export restrictions after Russia seized Crimea in 2014. But others were manufactured as recently as 2020, according to Conflict Armament Research (CAR), a research group in London that has examined some of the parts....

CAR last month sent investigators to Ukraine to examine Russian weaponry and communications equipment, and reported finding components from 70 companies based in the United States and Europe. They found the parts in military radios, airborne defense systems and in remnants of cruise missiles that the Ukrainians recovered in various towns and villages, Damien Spleeters, one of the CAR investigators, said in an interview.

An associate professor of electrical/computer engineering at Purdue tells the Post "Most of the items they are listing are available through any commercial computer parts supplier or digital parts supplier."

But the Post spoke to a lawyer representing one of the contacted technology companies. "Among the questions federal agents are asking: whether tech companies sold their products to a specific list of companies, including middlemen, that may have been involved in the supply chain."

Read more of this story at Slashdot.

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

find /var/www -type f -name "*.php" -mmin -120

ss -tunp | grep -E ":(4444|1337|8080|9001)"

apt update && apt --only-upgrade install <pkg>

title: Detect Exploitation - US Probes How American Electronics Wound Up in Russian Military Equipment in Ukraine
id: 96b086e8-c1fc-4165-a300-63edd5d24990
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "US Probes How American Electro" ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("US Probes How American Electronics Wound")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

message: "*US Probes How American Electronics Wound*"

CommonSecurityLog
| where Message has "US Probes How American Electronics Wound"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc