Loading story…
Google said it warned more than 14,000 Gmail users that they were targeted in a late-September spear-phishing campaign attributed to APT28—also known as Fancy Bear—a state-sponsored group previously linked by the FBI and NSA to Russia’s GRU and military unit 26165. According to Google Threat Analysis Group director Shane Huntley, the operation accounted for 86% of the company’s warning notifications for that month, and Google said it blocked all emails used in the campaign.
The alerts are part of Google’s long-running warning system for suspected state-sponsored attacks, which the company says is based on internal monitoring, detailed analysis, and victim reports. Google emphasized that such notices indicate suspected targeting rather than confirmed account compromise, and advised affected users to harden defenses by using unique passwords, enabling 2-step verification, keeping software updated, and confirming sign-ins occur through https://accounts.google.com/.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Google detected a spear-phishing campaign in late September that it attributed to APT28, also known as Fancy Bear. The operation targeted Gmail users across a wide variety of industries, and Google said it blocked all emails used in the campaign.
Google announced a new warning shown to a subset of users it believed might be targets of state-sponsored attacks. The company said the alert indicated suspected targeting, such as phishing or malware, rather than necessarily a confirmed account compromise.
Google sent warning notifications to more than 14,000 Gmail users that they had been targeted by the APT28 spear-phishing campaign. Google said the alerts reflected targeting rather than confirmed compromise, and that the campaign accounted for 86% of that month's warnings.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcesecurity.googleblog.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Threat Intelligence published a report detailing the cyber-espionage operations of **APT28**, the Russia-linked threat group also tracked as **Fancy Bear**. The report describes how the group has conducted long-running intelligence collection campaigns aligned with Russian state interests, targeting governments, military organizations, defense sectors, media, and other high-value entities. The activity is presented as a window into how a mature state-backed actor selects victims, sustains access, and supports broader geopolitical objectives through cyber operations. The report highlights APT28 as a persistent espionage actor known for credential theft, phishing, malware deployment, and post-compromise tradecraft designed to collect sensitive information from targeted networks. By outlining the group’s operational patterns and targeting behavior, Google’s analysis gives defenders updated context on a prominent Russian intrusion set and reinforces the need for stronger monitoring of phishing activity, account compromise, and unauthorized access across organizations exposed to nation-state threats.
Jul 12, 2026
CERT Polska warned that the Belarus-linked **GhostWriter** group, also tracked as `UNC1151` and `Storm-0257`, has intensified phishing against Gmail users in Poland after previously focusing on local providers such as Onet, Wirtualna Polska, and Interia. Since March, the campaign has increasingly targeted people involved in political and public life, including government officials, journalists, researchers, public administration staff, law enforcement personnel, and in many cases their relatives, personal contacts, and other socially connected individuals. The attackers are sending Polish-language emails masquerading as Gmail security or administrator alerts and directing victims to fake login pages designed to steal usernames, passwords, and two-factor authentication codes, including SMS and authenticator-app codes. CERT Polska said the group deploys new phishing domains and infrastructure almost daily, including attacker-registered domains, abused Netlify subdomains, and fake panels hosted on compromised Polish websites, while repeatedly pressuring the same targets with follow-up messages; successful account access can expose contacts and sensitive documents and enable further compromise of linked services such as social media.
Aug 14, 2026
Cybercriminals have launched a sophisticated phishing campaign that exploits Google Cloud's Application Integration service to send emails that closely mimic legitimate Google notifications. By leveraging the service's "Send Email" task, attackers are able to distribute messages from the trusted `noreply-application-integration@google.com` address, effectively bypassing traditional email security measures such as DMARC and SPF. The phishing emails are crafted to resemble routine enterprise communications, including voicemail alerts and file access requests, increasing the likelihood that recipients will trust and interact with them. Over a two-week period, nearly 9,400 phishing emails targeted approximately 3,200 organizations across the U.S., Asia-Pacific, Europe, Canada, and Latin America. The attack chain employs a multi-stage redirection process to evade detection and maximize credential theft. Initial links in the emails direct users to legitimate Google Cloud URLs (`storage.cloud.google.com`), followed by a redirection to `googleusercontent.com` where a fake CAPTCHA is presented to bypass automated scanners. The final stage leads victims to a counterfeit Microsoft login page hosted on a non-Microsoft domain, designed to harvest user credentials. This campaign demonstrates the increasing abuse of trusted cloud infrastructure for phishing, highlighting the need for organizations to scrutinize even seemingly authentic emails originating from reputable domains.
Jun 29, 2026