Security AffairsPierluigi Paganini
Credential-harvesting attacks by APT28 hit Turkish, European, and Central Asian organizations
According to a report by Recorded Future’s Insikt Group, the Russia-linked APT28 carried out credential-harvesting campaigns between February and September 2025, targeting Turkish energy and nuclear agency staff, European think tank personnel, and organisations in North Macedonia and Uzbekistan.
The group used regionally tailored lures and credential-stealing pages that spoofed Outlook, Google and Sophos VPN login portals, with campaigns conducted at low cost using free hosting and tunneling services such as Webhook[.]site, InfinityFree, Byet Internet Services, and ngrok.
In February 2025, BlueDelta expanded its credential-harvesting operations, deploying spoofed Microsoft OWA login pages delivered through shortened links and Webhook[.]site; victims were shown authentic PDF lures before being redirected to fake login pages that captured emails, passwords, IPs and user agents. On 4 June 2025, a Sophos VPN password-reset spoof page hosted on InfinityFree exfiltrated credentials via JavaScript before redirecting to a legitimate VPN portal.
In September, similar techniques targeted OWA expired-password pages hosted on InfinityFree, redirecting to legitimate login pages of a North Macedonian military organisation and an IT firm in Uzbekistan. The report notes persistent reuse of low-cost, disposable infrastructure and hints at overlap with BlueDelta's campaigns, as well as the broader GRU-linked operations of APT28.
Story timeline APT28
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Mon 12 Jan · 10:30 UTC | Security Affairs | Credential-harvesting attacks by APT28 hit Turkish, European, and Central Asian organizations (this article) |
| Sun 26 Jul · 14:08 UTC | Security Affairs | Hotel WiFi attacks hijack Microsoft 365 logins, linked to APT28 |
| Thu 27 Aug · 20:46 UTC | dti.domaintools.com | Leak shows Moscow university training cyber troops for Russia |
| Fri 28 Aug · 09:06 UTC | The Hacker News | APT28 Uses HOOKEDGE Backdoor to Spy on European Govt Networks |
| Fri 28 Aug · 12:29 UTC | Security Affairs | BlueDelta APT deploys HOOKEDGE backdoor via malicious Word macros |
| Wed 2 Sep · 08:28 UTC | SecurityOnline | HOOKEDGE Malware: BlueDelta Hits EU Diplomatic Targets |
| Tue 20 Oct · 12:31 UTC | The Hacker News | APT28 Breaches NATO Naval Shipbuilder and Steals Credentials in Week-Long Intrusion |
| Thu 22 Oct · 09:22 UTC | SecurityOnline | Fancy Bear Used Webhook.site to Breach European Defence Targets |