Recordedfuture

BlueDelta's Credential-Harvesting Campaigns Targeting Ukraine

First seen 7 Jan 2026, 16:46 UTC • Recordedfuture

•28.1

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Between February and September 2025, BlueDelta, a Russian state-sponsored group, conducted multiple credential-harvesting campaigns. These operations targeted users of UKR.NET, a popular Ukrainian webmail and news service, building on earlier activities from June 2024 to April 2025. The campaigns are part of BlueDelta's ongoing efforts to expand its credential-theft operations.

How this analysis works

Attack Flow

22 entities, 48 inferred relationships (STIX 2.1).

Threat Actor (4)

Apt28
BlueDelta
Fancy Bear
Forest Blizzard

Technique (2)

Phishing
T1566 - Spearphishing

Campaign (2)

GRU’s BlueDelta Targets Key Networks In Europe With Multi-Phase Espionage Campaigns
Persistent Campaign Against Ukr.net

Organization (1)

Google

Indicator (2)

ukr.net
5ae39a1b39d45d08f947bdf0ee0452ae

Affected Platform (2)

Amazon EC2
Sophos VPN

Tool (9)

Byet Internet Services
DNS EXIT
HTTPBin
InfinityFree
Mocky
Ngrok
Serveo
ShortURL
Ubiquiti Routers

Relationships

Apt28 uses Byet Internet Services
Apt28 uses DNS EXIT
Apt28 uses HTTPBin
Apt28 uses InfinityFree
Apt28 uses Mocky
BlueDelta uses Byet Internet Services
BlueDelta uses DNS EXIT
BlueDelta uses HTTPBin
BlueDelta uses InfinityFree
BlueDelta uses Mocky
Fancy Bear uses Byet Internet Services
Fancy Bear uses DNS EXIT
Fancy Bear uses HTTPBin
Fancy Bear uses InfinityFree
Fancy Bear uses Mocky
Forest Blizzard uses Byet Internet Services
Forest Blizzard uses DNS EXIT
Forest Blizzard uses HTTPBin
Forest Blizzard uses InfinityFree
Forest Blizzard uses Mocky
Apt28 uses Phishing
Apt28 uses T1566 - Spearphishing
BlueDelta uses Phishing
BlueDelta uses T1566 - Spearphishing
Fancy Bear uses Phishing
Fancy Bear uses T1566 - Spearphishing
Forest Blizzard uses Phishing
Forest Blizzard uses T1566 - Spearphishing
GRU’s BlueDelta Targets Key Networks In Europe With Multi-Phase Espionage Campaigns attributed to Apt28
GRU’s BlueDelta Targets Key Networks In Europe With Multi-Phase Espionage Campaigns attributed to BlueDelta
GRU’s BlueDelta Targets Key Networks In Europe With Multi-Phase Espionage Campaigns attributed to Fancy Bear
GRU’s BlueDelta Targets Key Networks In Europe With Multi-Phase Espionage Campaigns attributed to Forest Blizzard
Persistent Campaign Against Ukr.net attributed to Apt28
Persistent Campaign Against Ukr.net attributed to BlueDelta
Persistent Campaign Against Ukr.net attributed to Fancy Bear
Persistent Campaign Against Ukr.net attributed to Forest Blizzard
Apt28 targets Google
BlueDelta targets Google
Fancy Bear targets Google
Forest Blizzard targets Google
Apt28 related to ukr.net
Apt28 related to 5ae39a1b39d45d08f947bdf0ee0452ae
Apt28 related to Amazon EC2
Apt28 related to Sophos VPN
Apt28 related to Ngrok
Apt28 related to Serveo
Apt28 related to ShortURL
Apt28 related to Ubiquiti Routers

Continue Reading

APT28 Exploits MSHTML Zero-Day Vulnerability in Windows APT28 Exploits Zimbra Vulnerability in Ongoing Attacks Against Ukraine GRU Compromises Home Routers in 23 States to Steal Outlook Credentials Russian Hackers Exploit Zimbra Zero-Day for Espionage Campaign Critical RCE Vulnerability in Zimbra Exploited by Attackers Widespread DNS Poisoning Campaign Targets Hotel Wi-Fi to Steal Credentials

BlueDelta's Credential-Harvesting Campaigns Targeting Ukraine

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading