BlueDelta Hackers Target Ukrainian Webmail Users in Credential-Harvesting Campaign

First seen 19 Dec 2025, 21:58 UTC • Gbhackers

•24

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

BlueDelta, a Russian state-sponsored hacker group, is conducting a credential-harvesting campaign targeting users of UKR.NET, a widely used Ukrainian webmail and news service. The group, also known as APT28 and Fancy Bear, has been active for over a decade, focusing on stealing login credentials from government and private sector users.

How this analysis works

Attack Flow

Continue Reading

APT28 Exploits MSHTML Zero-Day Vulnerability in Windows APT28 Exploits Zimbra Vulnerability in Ongoing Attacks Against Ukraine GRU Compromises Home Routers in 23 States to Steal Outlook Credentials Russian Hackers Exploit Zimbra Zero-Day for Espionage Campaign Critical RCE Vulnerability in Zimbra Exploited by Attackers Widespread DNS Poisoning Campaign Targets Hotel Wi-Fi to Steal Credentials

BlueDelta Hackers Target Ukrainian Webmail Users in Credential-Harvesting Campaign

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading