Back Gbhackers

FancyBear Server Leak Exposes Stolen Credentials, 2FA Secrets, NATO Targets

Gbhackers •Mayura Kathir • March 18, 2026

FancyBear’s latest operational security failure has exposed a live Russian espionage server packed with stolen credentials, 2FA secrets, and detailed insight into the ongoing targeting of European government and military networks. The exposed infrastructure, tied to APT28/FancyBear and previously reported by CERT‑UA and Hunt.io, reveals both the scale of the compromises and the carelessness of […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

FancyBear Server Leak Exposes NATO Targets and Stolen Credentials On March 11, 2026, a significant operational security failure by the Russian state-linked hacking group FancyBear led to the exposure of a server containing stolen credentials, two-factor authentication (2FA) secrets, and insights into espionage activities targeting European government and military organizations. This incident, tracked as Operation Roundish by Hunt.io, reveals the scale of compromises and the careless handling of sensitive information by the group. The exposed infrastructure includes details on NATO targets, indicating a broad scope of impact across multiple nations. Security researchers have expressed concern over the implications of this leak for ongoing cybersecurity efforts in Europe. The incident highlights vulnerabilities in the operational security of state-sponsored hacking groups. Current status remains active as researchers analyze the leaked data for further insights. 2 sources 75

Extracted Entities

FancyBear Server Leak Exposes Stolen Credentials, 2FA Secrets, NATO Targets

The full story

Extracted Entities

APT Groups (2)

Attack Types (1)

Industries (1)

MITRE ATT&CK (1)