BlueDelta Espionage: Russian Hackers Abuse Free Apps to Target Energy Sector

A new report from Recorded Future’s Insikt Group details how BlueDelta, a Russian state-sponsored hacking group linked to the GRU, launched a credential-harvesting campaign aimed at energy researchers and government networks across Europe and the Middle East between February and September 2025.

The operation stood out for its heavy reliance on legitimate, free internet infrastructure to hide activity, with attackers impersonating webmail and VPN portals and hosting fake login pages on services such as Webhook[.]site, InfinityFree and ngrok. Victims were presented with genuine documents—ranging from a Gulf Research Center report to an EcoClimate Foundation climate study—before being redirected to fake login screens used to harvest credentials.

BlueDelta reportedly used customised JavaScript to automate credential theft, sending a page-opened beacon and capturing IP addresses and user agents before passwords were entered, then redirecting to legitimate portals. According to Recorded Future’s Insikt Group, this approach, leveraging disposable infrastructure, makes the attacks difficult to block without disrupting normal operations, and the group is expected to continue this pattern.

The article notes the campaign as a refinement of BlueDelta’s methods, expanding its focus to energy-sector targets in line with Russian geopolitical interests.