Researchers at Recorded Future warn that BlueDelta, a threat actor tied to Russia’s GRU, is launching spear phishing attacks against European defense and transportation entities.
The threat actor is abusing legitimate services to avoid detection, and some of its phishing pages can bypass multi-factor authentication.
“BlueDelta’s tactics, which primarily involve credential capture for initial access, are engineered to mimic regular network traffic, making detection difficult,” the researchers write.
“Some of BlueDelta’s credential harvesting pages can bypass two-factor authentication by relaying requests between legitimate services and compromised Ubiquiti routers, increasing their effectiveness.
The abuse of LIS, such as GitHub, to host redirection scripts also complicates the identification of malicious activity. Throughout these campaigns, BlueDelta has continuously refined its operations, demonstrating notable sophistication and adaptability.”
The threat actor has targeted the defense sector in Ukraine and railway infrastructure across Europe, as well as a think tank based in Azerbaijan.
“Successfully infiltrating networks associated with Ukraine’s Ministry of Defence and European railway systems could allow BlueDelta to gather intelligence that potentially shapes battlefield tactics and broader military strategies,” the researchers explain. “Moreover, BlueDelta’s interest in the Azerbaijan Center for Economic and Social Development suggests an agenda to understand and possibly influence regional policies.”
Recorded Future says organizations should implement a defense-in-depth strategy that includes security training in order to thwart these attacks.
“For organizations within government, military, defense, and related sectors, the rise of BlueDelta’s activities is a call to bolster cybersecurity measures: prioritizing the detection of sophisticated phishing attempts, restricting access to non-essential internet services, and enhancing surveillance of critical network infrastructure,” the researchers write. “Continuous cybersecurity training to recognize and respond to advanced threats is essential to defend against such state-level adversaries.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Recorded Future has the story.
