In schools in Moscow, a program was found on interactive panels that activates the microphone itself, records sound in the classroom and sends the file to the DIT servers. Mikhail Bogdanov writes: "The network-agent-lesson-log package was discovered in interactive panels in classrooms in schools in Moscow - a system daemon that records sound in the classroom and sends the recordings outside. There is no such package in the public MOS repository: it is distributed by installing a local RPM file, including from the cloud service mostech-cloud.mos.ru, which belongs to mostech-cloud.mos.ru. Judging by the update history on the three tested boards, the package is installed and updated en masse and centrally: all three machines have the same version chain with the same dates, the installation is done by script through files in /tmp, not manually. The emergence of history (repeated installations of the same versions) is typical for deployment in the entire school network using the DIT remote management system. The package installs a daemon that starts automatically (the startup preset is part of the package) and acts as the network agent user with the audio group. The daemon requests tasks from the server: in version 0.1.3 - every 30 seconds via open HTTP at the IP address of the server of the hosting provider Selectel; In version 1.1.0 - every 10 minutes via HTTPS at an address recording audio from the audience using arecord, encoding it to Opus using ffmpeg. Version 1.1.0 additionally removes the microphone mute during recording. Sends records to SMB share MEDIASTG - download server located in the school building and controlled by DIT, after which it deletes them from the local disk. In addition to the sound, it collects information about the device, the network interfaces and the MAC address of the gateway.

In schools in Moscow, a program was found on interactive panels that activates the microphone itself, records sound in the classroom and sends the file to the DIT servers. Mikhail Bogdanov writes: "The network-agent-lesson-log package was discovered in interactive panels in classrooms in schools in Moscow - a system daemon that records sound in the classroom and sends the recordings outside. There is no such package in the public MOS repository: it is distributed by installing a local RPM file, including from the cloud service mostech-cloud.mos.ru, which belongs to mostech-cloud.mos.ru. Judging by the update history on the three tested boards, the package is installed and updated en masse and centrally: all three machines have the same version chain with the same dates, the installation is done by script through files in /tmp, not manually. The emergence of history (repeated installations of the same versions) is typical for deployment in the entire school network using the DIT remote management system. The package installs a daemon that starts automatically (the startup preset is part of the package) and acts as the network agent user with the audio group. The daemon requests tasks from the server: in version 0.1.3 - every 30 seconds via open HTTP at the IP address of the server of the hosting provider Selectel; In version 1.1.0 - every 10 minutes via HTTPS at an address recording audio from the audience using arecord, encoding it to Opus using ffmpeg. Version 1.1.0 additionally removes the microphone mute during recording. Sends records to SMB share MEDIASTG - download server located in the school building and controlled by DIT, after which it deletes them from the local disk. In addition to the sound, it collects information about the device, the network interfaces and the MAC address of the gateway.

The package is assembled in the DIT infrastructure ("Mos. hub", hub.mos.ru), version 0.1.3 signed with the signing key.