Russian APT28 Runs Credential-Stealing Campaign Targeting Energy and Policy Organizations

"Russian state-sponsored threat actors have been linked to a fresh set of credential harvesting attacks targeting individuals associated with a Turkish energy and nuclear research agency, as well as staff affiliated with a European think tank and organizations in North Macedonia and Uzbekistan. The activity has been attributed to APT28 (aka BlueDelta), which was attributed to a "sustained" credential-harvesting campaign targeting users of UKR[.]net last month. APT28 is associated with the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU)."

"The cybersecurity company described the attacks as targeting a small but distinct set of victims in February and September 2025, with the campaign leveraging fake login pages that were styled to resemble popular services like Microsoft Outlook Web Access (OWA), Google, and Sophos VPN portals. The efforts are noteworthy for the fact that unsuspecting users are redirected to the legitimate sites after the credentials are entered on the bogus landing pages, thereby avoiding raising any red flags. The campaigns have also been found to lean heavily on services like Webhook[.]site, InfinityFree, Byet Internet Services, and ngrok to host the phishing pages, exfiltrate stolen data, and enable redirections."

APT28 (BlueDelta) executed targeted credential-harvesting campaigns against personnel linked to a Turkish energy and nuclear research agency, staff at a European think tank, and organizations in North Macedonia and Uzbekistan. The campaigns used Turkish-language and regionally tailored lure material to enhance credibility among specific professional and geographic audiences. Activity occurred in February and September 2025 and used fake login pages impersonating Microsoft Outlook Web Access, Google, and Sophos VPN portals. Victims who submitted credentials were redirected to the legitimate sites to avoid detection. Phishing pages and data exfiltration relied on services such as Webhook[.]site, InfinityFree, Byet Internet Services, and ngrok. Legitimate PDF documents were used as lures.

Read at The Hacker News