Russian government agencies are buying VPNs. CISA and its partners warn about the Karakurt extortion group. Clipminer is out in the wild. GootLoader expands its payloads and targeting. Carole Theriault has the latest on fraudsters imitating law enforcement. Kevin Magee from Microsoft on security incentives by way of insurance. And leak brokers and booters shut down.\n\nFor links to all of today's stories check out our CyberWire daily news briefing:\nhttps://thecyberwire.com/newsletters/daily-briefing/11/106\n\nSelected reading.\nWhite House: cyber activity not against Russia policy (Reuters)\xa0\nSome see cyberwar in Ukraine. Others see just thwarted attacks. (Washington Post)\xa0\nESET Threat Report details targeted attacks connected to the Russian invasion of Ukraine and how the war changed the threat landscape (ESET)\xa0\nUkraine - 100 days of war in cyberspace (CyberPeace Institute)\xa0\nRussian VPN Spending (Top 10 VPN)\nKarakurt Data Extortion Group (CISA)\nKarakurt Data Extortion Group (CISA)\xa0\nUS Agencies: Karakurt extortion group demanding up to $13 million in attacks (The Record by Recorded Future)\nClipminer Botnet Makes Operators at Least $1.7 Million (Symantec Enterprise Blog)\nGootLoader Expands its Payloads Infecting a Law Firm with IcedID (eSentire)\xa0\nWeLeakInfo.to and Related Domain Names Seized (US Department of Justice)\nLearn more about your ad choices. Visit megaphone.fm/adchoices