Loading story…
Norway's Police Security Service (PST) said the intrusion into the Norwegian Parliament (Stortinget) was likely carried out by APT28—also tracked as Fancy Bear and Microsoft's STRONTIUM—a threat group linked to Russia's GRU. Attackers gained access to email inboxes belonging to parliamentary employees and elected officials, while attempts to move from those accounts into internal parliamentary networks were unsuccessful. Norwegian authorities said the case was fully investigated and publicly attributed the operation to APT28, although PST said the evidence did not support a formal indictment.
The compromise was tied to weak email passwords and the lack of multi-factor authentication on affected accounts. Norwegian officials said the incident fit a broader APT28 campaign that began in 2019 and targeted organizations in Norway and other countries, aligning with Microsoft's reporting on STRONTIUM's evolving credential-harvesting activity, including large-scale brute-force and password-spraying attacks against cloud email services such as Office 365.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
Microsoft published a report describing new STRONTIUM/APT28 credential-harvesting patterns, including large-scale brute-force activity and targeting of cloud email accounts. The report aligned with later Norwegian assessments of the Parliament intrusion.
A referenced Microsoft report said that from September 2019, APT28 began using brute-force and credential-harvesting attacks at larger scale, including targeting Office 365 accounts at more than 200 private and government organizations.
PST said the Norwegian Parliament intrusion was part of a broader APT28 campaign that began in 2019 and targeted organizations in Norway and abroad. The activity was described as consistent with APT28's shift toward large-scale credential-harvesting and Office 365-focused attacks.
Norway's Police Security Service said APT28, also known as Fancy Bear and linked to Russia's GRU, was most likely responsible for hacking the Norwegian Parliament's email accounts. PST said it did not have enough evidence to bring a formal indictment.
Foreign Minister Ine Eriksen Søreide said in October that initial clues suggested Russian hackers were most likely behind the attack on the Stortinget.
The Norwegian Parliament hack was disclosed on September 1. Public reporting said the incident involved unauthorized access to parliamentary email accounts.
Attackers gained access to the Norwegian Parliament's email system, including inboxes of employees and elected officials, and attempted unsuccessfully to pivot into internal parliamentary networks. Investigators said weak passwords and lack of two-factor authentication contributed to the intrusion.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
microsoft.com
Open sourcezdnet.com
Open sourcepst.no
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ukrainian officials warned that Russia-linked hackers are revisiting earlier compromises to regain access to government and defense networks, testing whether old footholds, unpatched vulnerabilities, and previously stolen credentials still work. CERT-UA said the activity reflects a broader shift from smash-and-grab credential theft toward persistent access, with initial intrusion methods also evolving beyond phishing to more tailored social engineering, including phone calls and video chats in fluent Ukrainian before malicious files are delivered through messaging apps. Agencies tied the activity to groups including **APT28** and **Void Blizzard**, with the security and defense sector remaining the top target because disruptions there could affect the war effort. Ukraine also confirmed a long-running cyber-espionage campaign, tracked since 2023 and attributed by Western researchers to **APT28** (`Fancy Bear`, `BlueDelta`, `Forest Blizzard`), that targeted prosecutors, anti-corruption bodies, and other local government entities through **Roundcube** webmail vulnerabilities enabling code execution when a victim opened an email. Reuters reported that more than 170 email accounts belonging to prosecutors and investigators were compromised in recent months, and CERT-UA identified three waves of related attacks. Officials said some allegedly stolen material was later published online, though reviews indicated the leaks likely did not include confidential data, and warned the operation could still be used to fuel disinformation aimed at eroding trust in Ukrainian institutions.
Jun 29, 2026
Researchers and government agencies reported that the Russia-linked **APT28** espionage cluster has continued and expanded **Operation RoundPress**, a campaign that compromises vulnerable webmail platforms when targets open specially crafted phishing emails. ESET said the operation began against **Roundcube** and later spread to **Horde, MDaemon, and Zimbra**, using cross-site scripting flaws to inject malicious JavaScript into active mail sessions and steal credentials, emails, contacts, and in some cases **2FA secrets** and app passwords. Proofpoint said the activity persisted into 2026 with a new “half-click” zero-day in **SOGo** tracked as `CVE-2026-8496`, while also noting exploitation against **Zimbra, MDaemon, Kerio, and Roundcube** and a modified SpyPress chain that paired a Roundcube XSS vector with `CVE-2025-49113` to pursue server-side code execution and longer-term access. The victim set has centered on **government, military, diplomatic, and defense-related organizations**, especially in **Ukraine and Eastern Europe**, but reporting also identified targets in **France, Africa, Europe, and South America**. ANSSI said French entities have faced repeated APT28 intrusions since 2021 using phishing, webmail brute force, edge-device compromise, and exploitation of flaws including `CVE-2023-23397`, with recurring Roundcube-focused operations and credential theft infrastructure. CERT-UA separately linked a phishing campaign against Ukrainian local government bodies to **UAC-0001/APT28** with medium confidence, citing infrastructure overlap with an earlier **Roundcube** compromise involving `CVE-2023-43770` that stole mailbox credentials and created malicious mail-forwarding rules. Across the reporting, the campaign is described as a strategic intelligence-collection effort tied to Russian state interests and the war in Ukraine.
Aug 13, 2026
Recorded Future’s Insikt Group reported sustained **credential-harvesting operations by Russia-linked APT28** (aka **BlueDelta/Fancy Bear**) targeting individuals tied to a Turkish energy and nuclear research agency, European think tanks, and organizations in **North Macedonia and Uzbekistan**. Activity observed from **February to September 2025** used regionally tailored lures aligned with Russian intelligence priorities around energy, defense, and policy, with victims redirected to legitimate sites after credential theft to reduce suspicion. The campaigns relied on **fake login portals** impersonating *Microsoft Outlook/OWA*, *Google*, and *Sophos VPN* to capture credentials, and used low-cost, resilient infrastructure including free hosting and tunneling services (e.g., `ngrok`, Webhook[.]site, InfinityFree, and Byet Internet Services) to host pages and exfiltrate data. Multiple operations incorporated **legitimate PDF lure documents** (e.g., think tank and foundation publications) to increase authenticity and bypass email security controls, reflecting continued emphasis on scalable credential theft rather than novel malware deployment.
Jun 29, 2026