Russian military tech company, NPO Mars, had hundreds of gigabytes of sensitive and likely defense-related data stolen from its systems, attackers say. Data samples investigated by the Cybernews research team indicate that at least some of the files are as recent as March of this year.
-
The breach compromises naval systems including SIGMA command controls and DIEZ minesweeper coordination.
-
Attackers created videos allegedly showing manipulation of Russian naval data.
-
Hackers claim to have stolen 250GB of data with files as recent as March.
Attackers announced the alleged breach on a popular data leak forum, saying they’ve obtained 250GB of data from NPO Mars, a major Russian defense contractor. Stolen details allegedly include software used by the Russian navy.
While attackers say NPO Mars provides command and control (C2) systems for the Russian navy, the company does much more than that.
The company is a “Federal research and production center” providing automated control systems for the Russian military, combat information and control systems for its ships, armored personnel carriers, tanks, and other units.
After Moscow launched its invasion of Ukraine in February 2022, NPO Mars was sanctioned by the US, European Union, Canada, Japan, and other nations.
The Cybernews research team investigated parts of the data sample that attackers attached to the post, concluding that some PDF scans come from 2017-2018, while most of the technical manuals are dated last year. Some files indicate they were updated or created as recently as March 2025.
However, it’s unclear how fresh the information that’s not included in the sample is.
Cyberspace is undoubtedly one of the key battlefronts, the team believes, adding that hacktivists and state-sponsored attackers do everything they can to inflict the most damage on the opposing side.
“Leaks like these could reveal sensitive military information for the opposing side, and they can start from a mere phishing campaign targeting politicians, technical support workers, or simple employees,” researchers said.
What Russian military data is involved?
The data sample reveals numerous PDFs and technical manuals for what look like NPO Mars systems used by the Russian military. Several files whose names imply they’re agreements, certificates, and other details. Other files appear to be named using military technical jargon.
Meanwhile, attackers themselves created what looks like a video advert for the leak, saying they got their hands on several systems used by the Russian navy. One of the systems attackers got their hands on is called “SIGMA.” According to Russian military outlet TopWar, SIGMA-20385 is the combat information and control system responsible for “maneuvering, control of anti-submarine defense (ASD) and missile weapons, communications.”
Attackers also claim they have access to the TRASSA system. Vladimir Maklaev, the CEO of NPO Mars, told the Russian news agency Ria Novosti back in 2016 that SIGMA and TRASSA are developed for the Russian navy’s patrol ships, missile ships, corvettes, large landing ships, and nuclear missile cruisers.
Another naval system that NPO Mars data breach allegedly exposed is DIEZ, an automated control system for minesweepers. A separate attacker video shows what looks like attackers attempting to change what data Russian Naval officers receive about the speed and coordinates of Russian minesweepers.
“That unfriendly submarine might not be as slow as the system indicates. And it might be closer than you think,” the video ominously warns, with part of the screen dedicated to what’s allegedly the innards of the DIEZ system.
Attackers claim they accessed several other naval systems used by the Russian navy, although no data was provided to support such claims.
NPO Mars is a major Russian defense contractor whose origins date back to 1961, when the Moscow Marine Research Institute was created. Currently, the organization has over 1,100 staff.
We have reached out to the company for comment and will update the article once we receive a reply.
Your email address will not be published. Required fields are markedmarked