BlueDelta Hackers Target 20 Million UKR.NET Users in Massive Russian Intelligence Operation (2025 Campaign)

BlueDelta Hackers Target UKR.NET Users in Large-Scale Russian Intelligence Operation (2024-2025)

 What Happened

Between June 2024 and April 2025, the Russian state-linked threat group BlueDelta — also known by tracked aliases APT28, Fancy Bear, Forest Blizzard — conducted a sustained credential-harvesting campaign against users of UKR.NET, one of Ukraine’s most widely used webmail and news platforms. recordedfuture.com+1

This activity reflects a strategic intelligence collection campaign rather than a conventional data breach:

• The operation focused on stealing login credentials and multi-factor codes from real users.

• Phishing emails carrying malicious PDFs impersonated UKR.NET security notices to lure victims.

• Clicking those links redirected victims to fraudulent UKR.NET login portals, owned or controlled by the attackers. recordedfuture.com+1

These stolen credentials could be used to infiltrate email accounts, pivot to other services, or support broader intelligence objectives during the ongoing geopolitical conflict in the region. recordedfuture.com

Techniques & Tradecraft

 Phishing Infrastructure

BlueDelta demonstrated advanced operational tradecraft, including:

• Use of fake UKR.NET login pages hosted on free API/hosting platforms such as Mocky, DNS EXIT and tunneling services like ngrok and Serveo to obfuscate real infrastructure.

• Multi-tier hosting architecture to evade detection, blending free hosting, proxy tunnels, and redirect domains.

• PDF lures designed to bypass automated email scanning and sandbox defenses by embedding obscure URLs. recordedfuture.com+1

 Credential Capture

The malicious pages were engineered to:

• Capture usernames, passwords, and two-factor authentication codes,

• Relay CAPTCHA responses back to attacker-controlled infrastructure,

• Collect victim IP addresses using external API services. recordedfuture.com

This level of sophistication highlights BlueDelta’s ability to adapt and evolve in response to law enforcement activity, switching from compromised routers to reverse-proxy tunnels for covert credential collection. recordedfuture.com

Attribution and Motive

🇷🇺 Russian State Sponsorship

BlueDelta is widely attributed to Russia’s Main Directorate of the General Staff (GRU) — the Russian military intelligence agency. The group has been active for over a decade, engaging in espionage, influence operations, and credential theft globally. The Record from Recorded Future

 Strategic Aims

Analysts assess that the operation’s motive was intelligence collection in support of Russian strategic objectives during its conflict with Ukraine. Stealing credentials from widely used email services enables:

• Access to sensitive communications,

• Pivoting into linked online services,

• Long-term access for monitoring or exploitation. recordedfuture.com

Scale & Impact

While exact numbers of impacted UKR.NET users have not been publicly confirmed in official counts, security reporting indicates the campaign targeted a very large user population, potentially involving millions of users given UKR.NET’s broad market reach — which media outlets frame as a massive operation against users of one of Ukraine’s largest online systems. The Record from Recorded Future

What This Means for Cyber Defense

 Recommended Mitigations

Defenders and organizations can reduce exposure to similar campaigns by implementing:

Identity-centric protections

• Enforce strong, unique passwords and phishing-resistant MFA (e.g., FIDO hardware keys).

• Monitor and block indicators tied to known infrastructure abuse (e.g., ngrok, Mocky, DNS EXIT). recordedfuture.com

Email & user awareness

• Train users to recognize malicious PDFs and phishing patterns.

• Harden email filtering rules and block PDF attachments with embedded external links.

Threat intelligence

• Subscribe to updated RIsk Lists to detect new domains/IPs associated with credential harvesters. recordedfuture.com

Outlook

Security analysts warn that BlueDelta’s operations are ongoing and likely to continue through late 2025 and into 2026, adapting to defender efforts and leveraging novel infrastructure tactics to sustain credential theft campaigns. recordedfuture.com

#CyberThreat #BlueDelta #APT28 #FancyBear #CredentialHarvesting #UKRNET #CyberEspionage #RussianCyberOperations #ThreatIntel #NationStateAttack #CyberSecurity