Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

Bleeping Computer

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Between June 2024 and April 2025, a sustained credential-harvesting campaign targeting UKR.NET users was identified, attributed to the Russian state-sponsored threat group BlueDelta. The group deployed multiple credential-harvesting pages themed as UKR.NET login portals, leveraging free web services and proxy tunneling platforms to collect user credentials. BlueDelta distributed PDF lures with embedded links to evade detection. The campaign demonstrates the group's adaptability and persistent focus on Ukrainian user credentials for intelligence purposes. Infrastructure changes, including the transition to ngrok and Serveo, reflect responses to takedown efforts. The activity highlights the GRU's continued interest in compromising Ukrainian credentials amid ongoing conflict.

Between June 2024 and April 2025, the Russian state-sponsored group BlueDelta executed a sustained credential-harvesting campaign against users of UKR.NET, a major Ukrainian webmail provider. The adversary deployed multiple phishing pages mimicking the legitimate UKR.NET login portal, hosted on free web hosting platforms and leveraging proxy tunneling services such as ngrok and Serveo to circumvent takedown efforts and maintain operational persistence. The campaign utilized PDF lures embedding malicious links to evade detection by traditional email security tools and increase the likelihood of user interaction. BlueDelta’s infrastructure adaptations, including switching proxy services, indicate a high level of operational security and responsiveness to defensive actions. The campaign’s primary objective is to collect user credentials for intelligence purposes, consistent with the GRU’s ongoing interest in Ukrainian digital assets amid the conflict. Techniques employed include phishing (T1566.002), use of proxy tunneling (T1102), credential harvesting (T1056.003), and use of webmail compromise (T1132.001). Although the campaign targets Ukrainian users specifically, the use of free web services and proxy platforms means that collateral impact on European organizations connected to Ukraine or using similar services is possible. No known exploits or CVEs are associated with this campaign, and it relies on social engineering and infrastructure resilience rather than software vulnerabilities.

Detailed information about BlueDelta’s Persistent Campaign Against UKR.NET. Get real-time updates, technical details, and mitigation strategies.

BlueDelta’s Persistent Campaign Against UKR.NET - Live Threat Intelligence - Threat Radar | OffSeq.com

BlueDelta’s Persistent Campaign Against UKR.NET

Threats Tagged 'webmail compromise'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'webmail compromise'

Lead Pen Test Professional