CampaignPublished 17 Dec 2025Updated 16 Jan 2026

BlueDelta’s Persistent Campaign Against UKR.NET

Source AlienVault OTX General

Description

Between June 2024 and April 2025, a sustained credential-harvesting campaign targeting UKR.NET users was identified, attributed to the Russian state-sponsored threat group BlueDelta. The group deployed multiple credential-harvesting pages themed as UKR.NET login portals, leveraging free web services and proxy tunneling platforms to collect user credentials. BlueDelta distributed PDF lures with embedded links to evade detection. The campaign demonstrates the group's adaptability and persistent focus on Ukrainian user credentials for intelligence purposes. Infrastructure changes, including the transition to ngrok and Serveo, reflect responses to takedown efforts. The activity highlights the GRU's continued interest in compromising Ukrainian credentials amid ongoing conflict.

Impact

The primary impact of this campaign is the compromise of user credentials for UKR.NET accounts, which can lead to unauthorized access to sensitive communications, identity theft, and further espionage activities. For European organizations, especially those with business or personnel links to Ukraine, the campaign poses indirect risks such as spear-phishing follow-ups, lateral movement attempts, or exposure of sensitive information through compromised accounts. The use of proxy tunneling services complicates detection and takedown, potentially prolonging exposure. Credential theft undermines confidentiality and can facilitate further attacks, including account takeover and data exfiltration. The campaign’s persistence and adaptability increase the likelihood of successful compromise over time. While the direct operational scope is limited to UKR.NET users, the geopolitical context and targeting of Ukrainian digital infrastructure mean that European allies and partners may face secondary effects, including targeted phishing campaigns leveraging stolen credentials or intelligence gathered from compromised accounts.

Defensive guidance

To mitigate this threat, organizations should implement targeted user awareness training focused on recognizing phishing attempts involving PDF lures and fake login portals, especially those impersonating UKR.NET or related services. Email security solutions should be configured to detect and quarantine emails containing suspicious PDF attachments and links to known proxy tunneling domains such as ngrok and Serveo. Monitoring network traffic for unusual connections to proxy tunneling services can help identify potential phishing infrastructure. Organizations with Ukrainian connections should enforce multi-factor authentication (MFA) on all webmail and critical accounts to reduce the impact of credential theft. Incident response teams should establish rapid takedown procedures and collaborate with hosting providers and law enforcement to disrupt phishing infrastructure promptly. Regular threat intelligence sharing with European cybersecurity centers and Ukrainian partners will enhance situational awareness. Finally, reviewing and restricting the use of free web hosting and proxy services within corporate environments can reduce exposure to similar campaigns.

Indicators of compromise

Domains 25

doads.org
edfuture.com
element.id
linkcuts.com
linkcuts.org
talebco.ir
ukrainnet.com
ukrinet.com
0592cc96ea.serveo.net
232524f51a.serveo.net

IP addresses 1

73.80.9.137

Hashes 34

3d434157d91afd59e26db91483e7a56d
5ae39a1b39d45d08f947bdf0ee0452ae
68053622c5cb645676c534fea7c4642a
8b654832fbcf233f33e3cddef20a473a
267e838ef339db2959c52cdc0bebb7e2e8c04b68
5cc21e044124591cecc6d7ebf020018e894b2c6a
a0dd8dcff49d57cfcb73bd206985f45db1483de4
009440551eb6ea83da1a28361ebf44b3d022f204b99b82b83e266ec4807d18eb
1919d9c67a9ce00382f65b4bc1e1d1f4e4c0b296bc20ca45ba8fef8c188138ec
1a4c609fb75a54c7016736e471b6f92aaed7bb51257f3946e4ece9dd9125500c

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 17 Dec 2025, 23:26 UTC

MITRE ATT&CK techniques8 from threat tags

Technical details

Indicators of compromise

Domains 25

IP addresses 1

Hashes 34

Community reviews

Related threats