Cyber Threat: APT28's Targeted Attacks in Energy and Policy Sectors

A recent cybersecurity alert has been issued for North East India and the broader Indian context, as Russian state-sponsored hackers, known as APT28 or BlueDelta, have been engaged in a series of credential-stealing attacks. These attacks have targeted individuals associated with energy and policy organizations across Turkey, Europe, North Macedonia, and Uzbekistan.

Geographically Tailored Attacks

The attacks have been characterized by the use of Turkish-language and regionally targeted lure material. This strategy was designed to increase credibility among specific professional and geographic audiences, particularly those connected to energy research, defense cooperation, and government communication networks.

Phishing Tactics and Legitimate PDF Lures

The cybersecurity company Recorded Future's Insikt Group reported that the attacks leveraged fake login pages resembling popular services like Microsoft Outlook Web Access (OWA), Google, and Sophos VPN portals. To lend legitimacy to these phishing attempts, the threat actors used legitimate PDF lure documents, including a publication from the Gulf Research Center and a policy briefing from a climate change think tank.

Relevance to North East India and India

While the attacks have been primarily focused on organizations outside India, the tactics and strategies employed by APT28 are a concern for cybersecurity experts in the region. The use of phishing emails and fake login pages can potentially be used against Indian organizations, especially those in the energy and policy sectors.

Multiple Campaigns and Disposable Services

APT28 has been observed conducting at least four other campaigns using similar tactics. These campaigns have utilized services like Webhook[.site], InfinityFree, Byet Internet Services, and ngrok to host phishing pages, exfiltrate stolen data, and enable redirections.

Implications and Future Concerns

The consistent abuse of legitimate internet service infrastructure by APT28 demonstrates the group's reliance on disposable services to host and relay credential data. These campaigns underscore the GRU's sustained commitment to credential harvesting as a low-cost, high-yield method of collecting information that supports Russian intelligence objectives.

As cyber threats continue to evolve, it is crucial for organizations in North East India and across India to stay vigilant and implement robust cybersecurity measures to protect their sensitive data.