Web Management Interfaces as the Most Common Exposed Surface

The Moscow Department of Health breach gave the operators administrator-level access, according to the Cyber Partisans. Administrative access has to be exercised through something, and on most networks that something is a web interface.
ZoomEye was queried on 13 October 2026 in Russia.
| Query | Matching assets |
| --- | ---: |
| country="RU" && service="http" | 25,229,702 |
| country="RU" && service="https" | 6,714,165 |
| industry="healthcare" && service="https" | 26,886 |
HTTP is the largest single service class in the Russian index at 25.2 million assets, and HTTPS adds another 6.7 million. The third row is the useful one for this incident: 26,886 healthcare-tagged assets served over HTTPS worldwide.

What the gap between the first two rows shows

Plain HTTP outnumbers HTTPS by roughly 3.8 to 1 in this index. Encryption adoption in Russia, as visible from outside, is incomplete. For a defender this is a transport question rather than a compromise question, but it affects what an observer can see and what an attacker can modify in transit.

Reducing the web interface to a manageable list

An interface list is only useful if it names the interfaces that grant administration. Query composition matters more than raw counts.

country="RU" && industry="healthcare" && http.header.server="nginx"
cidr="<organization range>" && (title="login" || title="admin")
ssl.cert.subject.cn="<organization domain>"

The third query is the strongest of the three for a single organisation, because a certificate issued to that organisation's own name is hard to fake and easy to enumerate. It turns an unbounded web surface into a bounded certificate list.

Limits

A web service responding on HTTP or HTTPS does not indicate what application sits behind it. The healthcare-tagged HTTPS count covers the whole world, not Russia alone, and the earlier article in this series gives the Russia-restricted sector figures. No indexed asset is claimed to be part of the intrusion. The Cyber Partisans have not published the access path they used.