Blurred Deception: Russian APT Targets Transnistria and NATO with High-Pressure Phishing Lures

According to StrikeReady Labs, a Russian APT group launched a targeted credential harvesting campaign against Transnistria’s governing body, beginning on 5 December 2025. The attackers spoofed the Presidential Administration, emailing employees with the subject “Order of the President of the PMR… No. 441rp” and presenting a malicious HTML attachment named Распоряжение № 441рп.pdf.html that displays a document from the Pridnestrovian Moldavian Republic but keeps the content blurred.

The blurring is achieved with a CSS filter: blur(5.5px), and victims are then invited to interact with a login modal to view the “protected” file. The page uses unusual JavaScript logic, including a function named checkP(str) that tests passwords against a complex regular expression, and, as reported, if the password matches the regex it is posted to formcarry[.]com, but even if it does not match, data is still stolen.

StrikeReady Labs also notes broader activity linked to the campaign across Europe and NATO-aligned targets, with external infrastructure such as the domain timesyncwindows[.]com used to load malicious scripts.