Loading story…
Russian state-sponsored threat group BlueDelta (also known as APT28, Fancy Bear, and Forest Blizzard) conducted a persistent credential-harvesting campaign against users of UKR.NET, a popular Ukrainian webmail and news service, between June 2024 and April 2025. The campaign involved the use of phishing emails containing PDF lures with embedded links to fake UKR.NET login pages, designed to steal usernames, passwords, and two-factor authentication codes. BlueDelta leveraged free web services such as Mocky, DNS EXIT, ngrok, and Serveo to host these credential-harvesting pages, and used URL shorteners and Blogger subdomains to obfuscate the phishing infrastructure and redirect victims.
The operation reflects BlueDelta's adaptive tactics in response to Western-led infrastructure takedowns, with the group continuing to abuse free hosting and anonymized tunneling platforms. While specific targets were not disclosed, the campaign is assessed as part of Russia's broader intelligence-gathering efforts against Ukrainian users, supporting GRU objectives. The tools, infrastructure, and bespoke JavaScript used in this campaign are consistent with BlueDelta's established tradecraft and have not been observed in use by other Russian threat groups.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
On December 17, 2025, Recorded Future published research attributing the June 2024-April 2025 UKR.NET credential-harvesting campaign to BlueDelta/APT28 and describing its phishing lures, infrastructure, and adaptation to takedowns. The report tied the activity to Russian GRU intelligence objectives in the war against Ukraine.
In May 2025, BlueDelta was also reported exploiting cross-site scripting vulnerabilities to target webmail servers in Ukraine, Bulgaria, and Romania. This marked a related expansion beyond phishing of UKR.NET users to direct exploitation of webmail platforms.
Recorded Future observed the UKR.NET credential-harvesting campaign remain active through April 2025, with more than 42 distinct harvesting chains identified. The operation showed continued refinement of multi-tiered infrastructure and phishing techniques in support of Russian intelligence collection.
After Western law enforcement and allied disruptions affected earlier GRU proxy infrastructure, BlueDelta adapted by moving from compromised routers and botnet-backed relays to anonymized tunneling services such as ngrok and Serveo. This change helped the group continue relaying stolen credentials and bypassing defenses.
During the campaign, the group distributed at least 20 malicious PDF lures containing links to fake UKR.NET login portals. The infrastructure relied on link shorteners, redirection chains, and legitimate services such as Mocky to evade detection and capture credentials.
In June 2024, BlueDelta/APT28 began a prolonged credential-harvesting operation targeting users of the Ukrainian webmail and news service UKR.NET. The campaign used phishing emails and fake login pages to steal usernames, passwords, and two-factor authentication codes.
Similar credential-phishing activity targeting ukr.net users had been observed as early as March 2022, indicating BlueDelta/APT28 interest in the platform predates the later sustained campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcethehackernews.com
Open sourcetherecord.media
Open sourcerecordedfuture.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recorded Future’s Insikt Group reported sustained **credential-harvesting operations by Russia-linked APT28** (aka **BlueDelta/Fancy Bear**) targeting individuals tied to a Turkish energy and nuclear research agency, European think tanks, and organizations in **North Macedonia and Uzbekistan**. Activity observed from **February to September 2025** used regionally tailored lures aligned with Russian intelligence priorities around energy, defense, and policy, with victims redirected to legitimate sites after credential theft to reduce suspicion. The campaigns relied on **fake login portals** impersonating *Microsoft Outlook/OWA*, *Google*, and *Sophos VPN* to capture credentials, and used low-cost, resilient infrastructure including free hosting and tunneling services (e.g., `ngrok`, Webhook[.]site, InfinityFree, and Byet Internet Services) to host pages and exfiltrate data. Multiple operations incorporated **legitimate PDF lure documents** (e.g., think tank and foundation publications) to increase authenticity and bypass email security controls, reflecting continued emphasis on scalable credential theft rather than novel malware deployment.
Jun 29, 2026
Ukrainian officials warned that Russia-linked hackers are revisiting earlier compromises to regain access to government and defense networks, testing whether old footholds, unpatched vulnerabilities, and previously stolen credentials still work. CERT-UA said the activity reflects a broader shift from smash-and-grab credential theft toward persistent access, with initial intrusion methods also evolving beyond phishing to more tailored social engineering, including phone calls and video chats in fluent Ukrainian before malicious files are delivered through messaging apps. Agencies tied the activity to groups including **APT28** and **Void Blizzard**, with the security and defense sector remaining the top target because disruptions there could affect the war effort. Ukraine also confirmed a long-running cyber-espionage campaign, tracked since 2023 and attributed by Western researchers to **APT28** (`Fancy Bear`, `BlueDelta`, `Forest Blizzard`), that targeted prosecutors, anti-corruption bodies, and other local government entities through **Roundcube** webmail vulnerabilities enabling code execution when a victim opened an email. Reuters reported that more than 170 email accounts belonging to prosecutors and investigators were compromised in recent months, and CERT-UA identified three waves of related attacks. Officials said some allegedly stolen material was later published online, though reviews indicated the leaks likely did not include confidential data, and warned the operation could still be used to fuel disinformation aimed at eroding trust in Ukrainian institutions.
Jun 29, 2026
Citizen Lab and Access Now documented a sophisticated spear-phishing campaign targeting Russian opposition figures, Belarusian and Russian civil society groups, independent media, international NGOs active in Eastern Europe, policy experts, funders, journalists, and at least one former U.S. ambassador. Researchers attributed one cluster to **COLDRIVER**—also tracked as **Star Blizzard**, **Callisto**, **TA446**, **Blue Charlie**, and **UNC4057**—a Russia-linked threat actor that multiple governments have associated with the FSB’s Centre 18, while identifying a separate but related phishing cluster as **COLDWASTREL**. The operations used highly personalized impersonation emails sent from compromised or lookalike accounts, along with fake encrypted or protected PDF lures that redirected victims through fingerprinting infrastructure to credential-harvesting pages spoofing services such as Gmail and ProtonMail. Investigators found overlaps with known COLDRIVER tradecraft, including Hostinger-registered domains, Let’s Encrypt or ZeroSSL certificates, LibreOffice 7.0 PDF metadata, randomized author names, and occasional HubSpot links, while COLDWASTREL showed distinct metadata, infrastructure, and domain patterns. The groups sought passwords, two-factor authentication codes, and session cookies, raising the risk of exposing sensitive identities, communications, relationships, and locations of organizations already facing Russian government repression.
Jul 12, 2026