CampaignPublished 8 Jan 2026Updated 7 Feb 2026

BlueDelta Evolves Credential Harvesting

Source AlienVault OTX General

Description

Between February and September 2025, BlueDelta, a Russian state-sponsored threat group linked to the GRU, conducted multiple credential-harvesting campaigns. The group targeted individuals associated with energy research, defense cooperation, and government communication networks in Turkey, Europe, North Macedonia, and Uzbekistan. BlueDelta impersonated legitimate webmail and VPN services, using free hosting and tunneling services to host phishing content and capture user data. The campaigns incorporated PDF lures and customized JavaScript to increase authenticity and operational efficiency. This activity demonstrates BlueDelta's continued focus on low-cost, high-yield methods for collecting information supporting Russian intelligence objectives.

Impact

The BlueDelta campaigns pose a significant threat to European organizations involved in critical infrastructure sectors such as energy research and defense cooperation, as well as government communication networks. Successful credential harvesting can lead to unauthorized access to sensitive systems, enabling espionage, data exfiltration, and potential disruption of critical services. Compromised credentials may facilitate lateral movement within networks, increasing the risk of further intrusions or sabotage. The use of legitimate-looking phishing lures and customized JavaScript increases the likelihood of user compromise, potentially affecting a wide range of personnel from technical staff to senior officials. For European organizations, this could result in loss of intellectual property, exposure of classified information, and undermining of national security interests. The involvement of UK-hosted infrastructure in the campaign also raises concerns about supply chain and cloud service provider risks. The medium severity indicates a moderate but credible threat that could escalate if combined with other attack vectors or exploited in targeted operations.

Defensive guidance

European organizations should implement targeted anti-phishing training focused on recognizing sophisticated lures such as PDF attachments and fake VPN or webmail login pages. Deploy advanced email filtering solutions capable of detecting and blocking phishing domains and malicious attachments. Network defenders should monitor and block known malicious domains and IP addresses associated with BlueDelta campaigns, including those listed in the indicators. Employ DNS filtering and web proxy controls to prevent access to suspicious hosting and tunneling services. Multi-factor authentication (MFA) must be enforced on all critical systems, especially for remote access and email accounts, to reduce the risk of credential misuse. Regularly audit and monitor authentication logs for anomalous access patterns indicative of compromised credentials. Collaborate with cloud service providers to ensure rapid takedown of malicious infrastructure hosted on their platforms. Incident response teams should prepare to investigate potential credential compromise and conduct threat hunting focused on lateral movement indicators. Sharing threat intelligence within European cybersecurity communities can enhance collective defense against this actor.

Indicators of compromise

Domains 6

account-security-googie.my-board.org
enmrgkf41bifd.x.pipedream.net
account-security-googie.rf.gd
enmrgkf41bifd.x.pipedream.net
account-settings-shsvchx.wuaze.com
config-settings.kesug.com

IP addresses 2

185.27.134.125
172.111.206.103CC=GB ASN=AS20860 iomart cloud services limited

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 8 Jan 2026, 12:50 UTC

MITRE ATT&CK techniques5 from threat tags

Technical details

Indicators of compromise

Domains 6

IP addresses 2

Community reviews

Related threats