The GRU’s Silent Shift: How BlueDelta Hijacks Ukrainian Webmail Using ngrok and Mocky

A new Insikt Group report details BlueDelta, a Russian state‑sponsored group tied to the GRU (also known as APT28 or Fancy Bear), shifting to ephemeral cloud infrastructure to harvest Ukrainian webmail credentials. From June 2024 to April 2025, researchers tracked BlueDelta stealing usernames, passwords and 2FA codes from UKR[.]NET users by abusing free services such as Mocky, DNS EXIT and later proxy tunnelling platforms like ngrok and Serveo.

The operation begins with malicious PDF lures that link to credential‑harvesting pages, bypassing some email sandboxes, before victims are routed through a redirection chain to a fake UKR[.]NET login portal. Notably, the attackers manipulated ngrok to hide the browser warning page by injecting a ngrok-skip-browser-warning header, creating a seamless experience for victims.

The campaign’s aim appears to be credential theft to enable intelligence collection for GRU requirements, with Insikt Group predicting continued use of free hosting and redirection tools into 2026.