Recordedfuture BlueDelta's Credential-Harvesting Campaigns Targeting Ukraine
Article Content
Browse articles 
Between February and September 2025, BlueDelta, a Russian state-sponsored group, conducted multiple credential-harvesting campaigns. These operations targeted users of UKR.NET, a popular Ukrainian webmail and news service, building on earlier activities from June 2024 to April 2025. The campaigns are part of BlueDelta's ongoing efforts to expand its credential-theft operations.
Ask AI about this cluster
Answers cite the sources they use
Updated 227d ago How this analysis works
More articles in this cluster (4)
Following this threat?
Track APT28 and Google in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
APT28 Targets NATO Defense Firms with New Hookedge Backdoor The Russian espionage group APT28, also known as Swallowtail, has targeted defense contractors in two NATO countries, including a naval shipbuilder, a military aircraft engine manufacturer, and a law enforcement agency. The attacks utilized a new backdoor called Hookedge, which was first documented in August 2026.… 
Cyber Espionage Escalates in Europe Amid Geopolitical Tensions Cyberattacks on the public sector have surged by 114% in Europe over the past 30 months, with an average of 2,563 attacks per week per organization. This increase is attributed to rising geopolitical tensions, particularly related to the ongoing conflict between Russia and Ukraine. Check Point Research reports that…