Russian APT28 Runs Credential-Stealing Campaign Targeting Defense and Telecom Organizations

Key Findings

• Russian state-sponsored threat group APT28 (aka BlueDelta) linked to a fresh wave of credential harvesting attacks

• Targeting individuals associated with a Turkish energy and nuclear research agency, a European think tank, and organizations in North Macedonia and Uzbekistan

• Campaign leverages sophisticated phishing techniques to compromise accounts and steal user credentials

Background

• APT28 is associated with the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU)

• The group is known for its persistent cyber espionage activities

Attack Details

• Attackers use fake login pages mimicking popular services like Microsoft Outlook Web Access (OWA), Google, and Sophos VPN portals

• Victims are redirected to legitimate sites after entering credentials, avoiding raising red flags

• Campaign utilizes disposable internet services like Webhook[.]site, InfinityFree, Byet Internet Services, and ngrok to host phishing pages, exfiltrate data, and enable redirections

• Legitimate-looking lure documents, such as a publication from the Gulf Research Center and a policy briefing from climate change think tank ECCO, are used to increase credibility

Ongoing Campaigns

• June 2025 campaign: Credential-harvesting page mimicking Sophos VPN password reset

• September 2025 campaign: Credential-harvesting pages warning of expired passwords

• April 2025 campaign: Fake Google password reset page

Significance

• APT28's sustained interest in organizations connected to energy research, defense cooperation, and government communication networks reflects its intelligence priorities

• The group's consistent abuse of legitimate internet infrastructure demonstrates its reliance on disposable services to host and relay credential data

• The campaigns underscore the GRU's continued commitment to credential harvesting as a low-cost, high-yield method of collecting valuable information

Defense Recommendations

• Implement robust multi-factor authentication (MFA) across all services

• Conduct continuous security awareness training to enhance personnel's ability to detect and report phishing attempts

Sources

• https://thehackernews.com/2026/01/russian-apt28-runs-credential-stealing.html

• https://www.reddit.com/r/SecOpsDaily/comments/1q8dscw/russian_apt28_runs_credentialstealing_campaign/

• https://x.com/TheCyberSecHub/status/2009660253429022731