Russia’s APT28 Targeting Energy Research, Defense Collaboration Entities

According to Recorded Future, Russia’s state-sponsored group APT28 has been targeting organisations connected with energy research, defence collaboration entities, and government communications. APT28, also known as BlueDelta, Fancy Bear, Forest Blizzard, Sednit, and Sofacy, has a long track record of targeting energy, government, military and media sectors in the US and Europe.

In a credential-harvesting campaign, the group used phishing pages impersonating Microsoft Outlook Web Access, Google and Sophos VPN portals, redirecting victims to legitimate domains after credentials were entered. The campaign relied heavily on free hosting and tunneling services such as Webhook[.]site, InfinityFree, Byet Internet Services, and Ngrok to host content, capture data, and manage redirections.

In February 2025, APT28 deployed a Microsoft OWA phishing page with a ShortURL-based first-stage redirection, and in June and September, spoofed pages targeting OWA and Google credentials appeared on InfinityFree domains. The analysis notes the group’s ability to adapt infrastructure and rebrand credential-harvesting pages to reduce costs and obscure attribution.