Russia’s Military Intelligence Service Launches Spear Phishing Attacks
Researchers at Recorded Future warn that BlueDelta, a threat actor tied to Russia’s GRU, is launching spear phishing attacks against European defense and transportation entities.
The threat actor is abusing legitimate services to avoid detection, and some of its phishing pages can bypass multi-factor authentication.
“BlueDelta’s tactics, which primarily involve credential capture for initial access, are engineered to mimic regular network traffic, making detection difficult,” the researchers write.
“Some of BlueDelta’s credential harvesting pages can bypass two-factor authentication by relaying requests between legitimate services and compromised Ubiquiti routers, increasing their effectiveness.
The abuse of LIS, such as GitHub, to host redirection scripts also complicates the identification of malicious activity. Throughout these campaigns, BlueDelta has continuously refined its operations, demonstrating notable sophistication and adaptability.”
The threat actor has targeted the defense sector in Ukraine and railway infrastructure across Europe, as well as a think tank based in Azerbaijan.
“Successfully infiltrating networks associated with Ukraine’s Ministry of Defence and European railway systems could allow BlueDelta to gather intelligence that potentially shapes battlefield tactics and broader military strategies,” the researchers explain. “Moreover, BlueDelta’s interest in the Azerbaijan Center for Economic and Social Development suggests an agenda to understand and possibly influence regional policies.”
Recorded Future says organizations should implement a defense-in-depth strategy that includes security training in order to thwart these attacks.
“For organizations within government, military, defense, and related sectors, the rise of BlueDelta’s activities is a call to bolster cybersecurity measures: prioritizing the detection of sophisticated phishing attempts, restricting access to non-essential internet services, and enhancing surveillance of critical network infrastructure,” the researchers write. “Continuous cybersecurity training to recognize and respond to advanced threats is essential to defend against such state-level adversaries.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Recorded Future has the story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW