CampaignPublished 16 Dec 2025

Russian APT actor phishes the Baltics and the Balkans

Source AlienVault OTX General

Description

A Russian APT group has been conducting targeted phishing campaigns against government entities in the Baltic and Balkan regions since at least 2023. The attackers use spoofed email attachments mimicking official documents to trick victims into submitting credentials on sophisticated fake login pages. These phishing pages feature blurred backgrounds and complex password validation, yet stolen credentials are exfiltrated regardless of password strength. The campaign specifically targets countries including Moldova, Ukraine, Lithuania, Bosnia and Herzegovina, Macedonia, Montenegro, Spain, and Bulgaria. The stolen credentials are sent to third-party services, enabling potential unauthorized access to sensitive government systems. This ongoing campaign poses a medium-level threat due to its targeted nature and potential for credential theft leading to further compromise. Defenders should focus on phishing awareness, email filtering, and credential monitoring to mitigate risks. The threat is particularly relevant to European government organizations in the affected regions due to geopolitical tensions and strategic importance.

Impact

For European organizations, especially government entities in the Baltic and Balkan regions, this campaign poses a significant risk of credential compromise leading to unauthorized access to sensitive systems. The theft of government credentials can result in espionage, disruption of governmental functions, exposure of confidential information, and potential manipulation of critical infrastructure. The campaign's focus on multiple countries including Lithuania, Bulgaria, Spain, and others indicates a broad strategic intent to gather intelligence and exert influence in geopolitically sensitive areas. The use of sophisticated phishing techniques increases the likelihood of successful compromise, particularly if user awareness is low. Compromised credentials may also be used to bypass perimeter defenses, escalate privileges, or deploy malware, amplifying the threat's impact. Additionally, the exfiltration of credentials to third-party services complicates attribution and response efforts. European governments must consider the potential for cascading effects on national security, diplomatic relations, and public trust.

Defensive guidance

1. Implement advanced email filtering solutions that can detect and quarantine phishing emails with spoofed attachments and suspicious links. 2. Conduct targeted phishing awareness training for government employees, emphasizing recognition of spoofed documents and fake login pages. 3. Enforce multi-factor authentication (MFA) across all government systems to reduce the impact of credential theft. 4. Deploy endpoint detection and response (EDR) tools capable of identifying suspicious behaviors related to credential dumping and input capture. 5. Monitor network traffic for unusual data exfiltration patterns, especially connections to known third-party services used by attackers. 6. Regularly audit and rotate credentials, and implement strict password policies combined with anomaly detection for login attempts. 7. Utilize threat intelligence feeds to update detection rules with known indicators such as file hashes and phishing URLs. 8. Establish incident response plans specifically addressing phishing and credential theft scenarios, including rapid credential revocation and forensic analysis. 9. Collaborate with regional cybersecurity centers and law enforcement to share intelligence and coordinate defensive measures. 10. Harden web gateways and DNS filtering to block access to known phishing domains and malicious third-party services.

Summary

This threat involves a Russian Advanced Persistent Threat (APT) actor conducting a sustained phishing campaign targeting government entities primarily in the Baltic and Balkan regions. The attackers craft emails with attachments that impersonate official government documents to lure recipients into opening them. Upon interacting with these attachments, victims are directed to highly convincing fake login pages that employ blurred background images and sophisticated password validation mechanisms to appear legitimate. Despite these validation checks, the attackers exfiltrate all entered credentials to a third-party service, even if the passwords do not meet complexity requirements, indicating a focus on quantity of credentials over quality. The campaign has been active since at least 2023 and uses tailored lures specific to each targeted country and government sector, increasing the likelihood of successful credential theft. The stolen credentials can facilitate unauthorized access to government networks, potentially enabling espionage, data theft, or further lateral movement within critical infrastructure. The campaign leverages multiple MITRE ATT&CK techniques including spearphishing (T1566.001), credential dumping (T1003), input capture (T1056.001), and use of third-party services for data exfiltration (T1132). Indicators such as file hashes have been identified to aid detection. No known exploits or CVEs are associated with this campaign, as it relies on social engineering rather than software vulnerabilities. The medium severity rating reflects the targeted nature and potential impact of credential theft on government operations.

Indicators of compromise

Hashes 15

12c8f542da7df0e0ee0e7372bea440a5
569a4aa5e8e3a19c774a5a9f89a13e53
61333afaed8d3d8f339357f58ada3ce1
6569fc4ce09e16cf9ce2f1ca11d93a6f
8f1ffe4812375afc93cb09412ea61c99
a803f4f0faaa784b8c69befc6f9954fd
a8f6020437fe6ff5affa7d0fd79bba58
adb270445426daa8387c829c72d13a2d
c26b9dc342d4afaf45f82fc90800fde7
d261a8ca873f6b56ef219f38d2e9f507

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Dec 2025, 12:55 UTC

MITRE ATT&CK techniques7 from threat tags

Technical details

Indicators of compromise

Hashes 15

Community reviews

Related threats