Full Report
Insikt Group reveals how GRU-linked BlueDelta evolved credential-harvesting campaigns targeting government, energy, and research organizations across Europe and Eurasia.
Analysis Summary
# Threat Actor: BlueDelta
## Attribution & Identity
**Attribution:** Russian state-sponsored threat group associated with the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU).
**Known Aliases and Associated Groups:** APT28, Fancy Bear, Forest Blizzard.
## Activity Summary
Between February and September 2025, BlueDelta conducted expanded credential-harvesting campaigns. These operations focused on collecting credentials by impersonating common login services like Microsoft Outlook Web Access (OWA), Google, and Sophos VPN portals. The group tailored lure materials, including Turkish-language content, suggesting a focus on specific regional and professional audiences. The activity demonstrates a continued, low-cost approach to intelligence gathering supporting Russian strategic interests.
## Tactics, Techniques & Procedures
- **Credential Harvesting:** Deployed phishing pages impersonating OWA, Google, and Sophos VPN login interfaces.
- **Infrastructure Abuse:** Heavily relied on free hosting and tunneling services to host phishing content and capture data.
- **Lure Sophistication:** Incorporated legitimate PDF lure documents (e.g., from Gulf Research Center, EcoClimate Foundation) to evade detection and increase realism.
- **Automation:** Used customized JavaScript functions to capture credentials, track activity, and automate redirection to legitimate websites post-submission.
- **Stealth:** Redirected victims to authentic login portals after credential submission to reduce suspicion.
**MITRE ATT&CK Techniques:**
* **Reconnaissance:** Search Open Websites/Domains (T1593)
* **Resource Development:** Acquire Infrastructure: Web Services (T1583.006)
* **Credential Access:** Input Capture: GUI Input Capture (T1056.002)
* **Command and Control:** Application Layer Protocol: Web Protocols (T1071.001)
* **Command and Control:** Web Service (T1102)
## Targeting
**Sectors:** Government, Energy (including nuclear research), Research organizations, Policy Think Tanks.
**Geography:** Europe and Eurasia, with specific targeting noted for Türkiye, North Macedonia, and Uzbekistan.
**Victims:** Individuals linked to a Turkish energy and nuclear research agency, staff affiliated with a European think tank, and organizations in North Macedonia and Uzbekistan.
## Tools & Infrastructure
**Malware Families Used:** N/A (Focus is on credential harvesting infrastructure, not specific malware implants.)
**Infrastructure (C2, domains, IPs):**
* **Hosting/Tunneling Services Abused:** Webhook[.]site, InfinityFree, Byet Internet Services, ngrok.
* **Domains Observed:** `account-security-googie[.]my-board[.]org`, `account-security-googie[.]rf[.]gd`, `account-settings-shsvchx[.]wuaze[.]com`, `config-settings[.]kesug[.]com`.
* **IP Addresses Observed:** `172[.]111[.]206[.]103`, `185[.]27[.]134[.]125`.
* **URLs Observed:** Various URLs using the above domains and tunneling services like `ngrok-free[.]app`.
## Implications
BlueDelta continues to prioritize credential theft as a low-cost, high-yield means of supporting Russian intelligence objectives. Their ongoing evolution, including the use of localized language lures and legitimate document embedding, suggests a sustained focus on improving phishing success rates against strategic targets in critical sectors (energy, government research) in Europe and neighboring regions. The sustained abuse of disposable, free infrastructure makes attribution difficult while maintaining operational security.
## Mitigations
- Organizations should prioritize user awareness training that specifically addresses multi-stage phishing campaigns utilizing redirects and impersonating common services (OWA, VPN portals).
- Implement controls to restrict access to free hosting or tunneling services for high-value users, if possible, and monitor outbound connections to known disposable C2 infrastructure.
- Verify the authenticity of login requests, especially those preceded by unexpected links or emails containing lures from security or research bodies.
- Review logging for JavaScript execution on web forms related to authentication, as the actor used custom scripts for input capture.