APT28 Targets Ukrainian UKR-net Users in Long-Running Credential Phishing Campaign

According to Recorded Future's Insikt Group, the Russian state-sponsored threat actor known as APT28 has been attributed to a sustained credential-harvesting campaign targeting UKR[.]net users, with activity observed between June 2024 and April 2025. The attackers are described as deploying UKR[.]net-themed login pages on legitimate services such as Mocky to harvest credentials and 2FA codes, with links embedded in phishing PDFs and shortened via services like tiny[.]cc or tinyurl[.]com.

In some cases, they have used Blogger subdomains to support a two-tier redirection chain leading to the credential harvesting pages. The campaign builds on prior findings and is linked to a broader set of phishing and credential theft operations associated with GRU, a Russian military intelligence agency, under various aliases including BlueDelta, Sofacy, and FIles such as TA422.

Mastercard-owned Recorded Future notes that the transition from compromised routers to proxy tunneling infrastructure reflects an adaptive response to infrastructure takedowns and indicates continued GRU interest in Ukrainian user credentials to support intelligence efforts amid Russia’s war in Ukraine.