Loading story…
Recorded Future’s Insikt Group reported sustained credential-harvesting operations by Russia-linked APT28 (aka BlueDelta/Fancy Bear) targeting individuals tied to a Turkish energy and nuclear research agency, European think tanks, and organizations in North Macedonia and Uzbekistan. Activity observed from February to September 2025 used regionally tailored lures aligned with Russian intelligence priorities around energy, defense, and policy, with victims redirected to legitimate sites after credential theft to reduce suspicion.
The campaigns relied on fake login portals impersonating Microsoft Outlook/OWA, Google, and Sophos VPN to capture credentials, and used low-cost, resilient infrastructure including free hosting and tunneling services (e.g., ngrok, Webhook[.]site, InfinityFree, and Byet Internet Services) to host pages and exfiltrate data. Multiple operations incorporated legitimate PDF lure documents (e.g., think tank and foundation publications) to increase authenticity and bypass email security controls, reflecting continued emphasis on scalable credential theft rather than novel malware deployment.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-01-12, multiple outlets reported Recorded Future Insikt Group's findings that APT28 had conducted credential-harvesting campaigns from February through September 2025 against Turkish energy and nuclear agency staff, European think tanks, and organizations in North Macedonia and Uzbekistan. The report detailed the use of spoofed OWA, Google, and Sophos VPN portals, PDF lures, and disposable infrastructure including InfinityFree, Webhook.site, and ngrok.
In September 2025, APT28 used expired-password themed Outlook Web Access phishing pages that redirected victims to legitimate portals associated with a North Macedonian military organization and an IT firm in Uzbekistan. This wave highlighted the campaign's continued regional tailoring and focus on defense- and government-linked targets.
On 2025-06-04, APT28 used a spoofed Sophos VPN password-reset page as part of its credential-harvesting operations. The tactic targeted users in sensitive sectors and reflected the group's continued adaptation of familiar enterprise login themes.
In April 2025, the campaign expanded to include Portuguese-language phishing themed as Google password resets. The lures were tailored to regional targets and continued APT28's use of fake login pages to capture credentials.
Recorded Future's Insikt Group observed Russia-linked APT28 launching credential-harvesting activity in February 2025 against Turkish, European, and Central Asian organizations aligned with Russian intelligence interests. Early activity used spoofed Microsoft Outlook Web Access login pages, legitimate-looking PDF lures, and low-cost infrastructure to steal credentials and redirect victims to real sites.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcescworld.com
Open sourcehackread.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are continuing to prioritize **credential theft** while using defensive and trusted services to evade detection. DomainTools reported a Microsoft 365 phishing operation that **weaponizes Cloudflare protections** (including *Turnstile* human verification) to block automated analysis and security crawlers, then selectively serves a credential-harvesting flow only to “clean” visitors. The infrastructure used additional gatekeeping such as IP reputation checks (including lookups via `api.ipify.org`), hardcoded blocks for security-vendor and cloud-provider ranges, and user-agent filtering that returns a fake `404` page to bots, with the theft logic hidden behind heavy obfuscation. Separately, Hunt.io documented **Operation Roundish**, assessed with medium-high confidence as aligned to **APT28 (Fancy Bear)**, after discovering an exposed open directory hosting a Roundcube exploitation toolkit used against Ukrainian targets (including `mail.dmsu.gov.ua`). The toolkit included XSS payloads, a Flask-based C2, and modules for credential harvesting, mail forwarding persistence, bulk email exfiltration, address book theft, and 2FA secret extraction, plus a Go-based Linux implant (`httd`) found on a compromised Ukrainian web application. In parallel reporting on credential-access tradecraft, Flashpoint analysis highlighted the low-cost **DarkCloud infostealer** (sold for about **$30**) that steals browser logins/cookies and other data and exfiltrates via common channels (email/FTP/Telegram/HTTP), while Aryaka Threat Labs described the **BlackSanta** campaign using steganographic lures and **BYOVD** techniques to disable EDR and enable stealthy data theft over HTTPS—underscoring that credential access and defense evasion remain common precursors to broader enterprise compromise.
Jul 1, 2026
Ukrainian officials warned that Russia-linked hackers are revisiting earlier compromises to regain access to government and defense networks, testing whether old footholds, unpatched vulnerabilities, and previously stolen credentials still work. CERT-UA said the activity reflects a broader shift from smash-and-grab credential theft toward persistent access, with initial intrusion methods also evolving beyond phishing to more tailored social engineering, including phone calls and video chats in fluent Ukrainian before malicious files are delivered through messaging apps. Agencies tied the activity to groups including **APT28** and **Void Blizzard**, with the security and defense sector remaining the top target because disruptions there could affect the war effort. Ukraine also confirmed a long-running cyber-espionage campaign, tracked since 2023 and attributed by Western researchers to **APT28** (`Fancy Bear`, `BlueDelta`, `Forest Blizzard`), that targeted prosecutors, anti-corruption bodies, and other local government entities through **Roundcube** webmail vulnerabilities enabling code execution when a victim opened an email. Reuters reported that more than 170 email accounts belonging to prosecutors and investigators were compromised in recent months, and CERT-UA identified three waves of related attacks. Officials said some allegedly stolen material was later published online, though reviews indicated the leaks likely did not include confidential data, and warned the operation could still be used to fuel disinformation aimed at eroding trust in Ukrainian institutions.
Jun 29, 2026
Russian state-sponsored threat group BlueDelta (also known as APT28, Fancy Bear, and Forest Blizzard) conducted a persistent credential-harvesting campaign against users of UKR.NET, a popular Ukrainian webmail and news service, between June 2024 and April 2025. The campaign involved the use of phishing emails containing PDF lures with embedded links to fake UKR.NET login pages, designed to steal usernames, passwords, and two-factor authentication codes. BlueDelta leveraged free web services such as Mocky, DNS EXIT, ngrok, and Serveo to host these credential-harvesting pages, and used URL shorteners and Blogger subdomains to obfuscate the phishing infrastructure and redirect victims. The operation reflects BlueDelta's adaptive tactics in response to Western-led infrastructure takedowns, with the group continuing to abuse free hosting and anonymized tunneling platforms. While specific targets were not disclosed, the campaign is assessed as part of Russia's broader intelligence-gathering efforts against Ukrainian users, supporting GRU objectives. The tools, infrastructure, and bespoke JavaScript used in this campaign are consistent with BlueDelta's established tradecraft and have not been observed in use by other Russian threat groups.
Jun 29, 2026