Russian APT28 Runs Credential-Stealing Campaign Targeting Energy and Policy Organizations

Russian APT28 has been linked to a credential-harvesting campaign aimed at individuals connected to a Turkish energy and nuclear research agency, a European think tank, and organisations in North Macedonia and Uzbekistan. The activity is attributed to APT28 (aka BlueDelta), a group associated with the GRU, with Insikt Group of Recorded Future describing the operation as a “credential-harvesting campaign” and noting the continued focus on energy research and government networks.

The attackers reportedly used Turkish-language lure material tailored to regional audiences, with phishing pages designed to resemble services such as Microsoft Outlook Web Access, Google, and a Sophos VPN portal, in campaigns conducted in February and September 2025.

Victims are redirected from fake landing pages to legitimate sites after entering credentials, and the operation relied on disposable hosting services like Webhook[.]site, InfinityFree, Byet Internet Services and ngrok to host pages and exfiltrate data. Additional campaigns in June, September and April 2025 used similar credential-harvesting pages pretending to warn of expired passwords or to reset passwords, reinforcing the group’s reliance on credential theft to support Russian intelligence objectives.