Only ru_RU? It doesn't get disabled with, say, zh_CN, ko_KR, or anything else where the script is outside of the Basic Multilingual Plane (AKA ASCII)?
Re:Arch Linux disables AUR package adoption
by inigyou on Saturday August 01, 2026 @11:59AM
(#49135528)
> the Basic Multilingual Plane (AKA ASCII)
Incorrect. ASCII is 0000-007F and the BMP is 0000-FFFF
Re:Arch Linux disables AUR package adoption
by tmtvl on Saturday August 01, 2026 @05:26PM
(#49138659)
You're right, I'm wrong, my bad. Still I wonder if the software fails to work when paths contain unexpected characters.
Re:Arch Linux disables AUR package adoption
by inigyou on Saturday August 01, 2026 @11:59AM
(#49135522)
This is also very common with malware groups that want you to think they are Russian.
Re:Arch Linux disables AUR package adoption
by cookiengineer on Sunday August 02, 2026 @12:23AM
(#49141079)
The comment length is too small to write a thorough malware analysis.
That is why I linked my blogposts, the tool, and the whitepaper that I published about it. You have to read it first to come to your own conclusions.
If you come to conclusions without reading either of it, there's no point in arguing with you because you made up your mind anyways, and are not interested in learning about malware reversing :)
The answer is: Russians
Source: I'm the guy that built the antimiasma mitigation tool [1] and tracked their malware campaign iterations very closely.
Set LANG to ru_RU.* and the malware implant stops spreading itself, as with all APT28/29 malware.
[1] https://github.com/cookiengineer/antimiasma
[2] https://cookie.engineer/projects/cyber-defense/antimiasma.ht...