Notorious Russian APT Nabs Credentials From Global Targets

The article, published on 9 January 2026, profiles Fancy Bear as a highly capable Russian APT whose credential-harvesting attacks have focused on targeted organisations in the Balkans, the Middle East and Central Asia. It notes that Fancy Bear’s recent activity has largely consisted of standard spearphishing and the use of borrowed login pages to harvest credentials for services such as Sophos VPN, Google and Microsoft Outlook.

It adds that, according to Recorded Future, from February to September 2025 the APT tracked as BlueDelta targeted credentials from a handful of organisations across the center of the world map, using simple phishing pages and off‑the‑shelf infrastructure. The known targets of this campaign include an IT integrator in Uzbekistan, a European think tank, a military organisation in North Macedonia, and researchers connected with a Turkish energy and nuclear research organisation.

The piece stresses that these operations rely on cheap, replaceable components, frequently use commercial VPNs, and are designed to maximise persistence, scalability and deniability while minimising technical fingerprints.