BlueDelta (APT28) Credential Phishing via Free Hosting & Ngrok

Summary

BlueDelta, a GRU‑affiliated group also known as APT28/Fancy Bear, ran multiple credential‑harvesting campaigns between February and September 2025. The campaigns used free hosting and tunneling services to host spoofed Outlook, Google and Sophos VPN login pages and exfiltrate captured credentials. Lures included legitimate PDF documents and region‑specific language to increase credibility. The operation targeted energy, nuclear research, government and academic entities in Turkey, North Macedonia and Uzbekistan.

Investigation

Recorded Future’s Insikt Group collected over a dozen phishing pages hosted on services such as Webhook.site, InfinityFree, Byet Internet Services and ngrok. JavaScript on the pages captured usernames, passwords and victim identifiers, sent beacons to attacker‑controlled webhooks, and then redirected victims to authentic portals. Multiple variants reused code and modified variable names to streamline deployment. Infrastructure was short‑lived and leveraged link‑shorteners like ShortURL.at.

Mitigation

Block known free‑hosting and tunneling domains, monitor for outbound traffic to webhook services, and enforce MFA on all external‑facing accounts. Educate users about phishing pages that mimic OWA, Google and VPN portals, especially when PDF lures are attached. Implement network filtering for known malicious URLs and apply email security controls to detect suspicious PDF links.

Response

Alert SOC analysts when HTTP POSTs to known webhook endpoints are observed and when credential‑harvesting pages are loaded. quarantine the malicious page, isolate affected user accounts, force password resets and review logs for lateral movement. Conduct a threat‑hunt for other pages using the same infrastructure and update block lists accordingly.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:

  1. Initial phishing delivery: An attacker sends a phishing email containing a short URL that redirects to the malicious webhook.site page.
  2. Victim interaction: The victim clicks the link; the browser follows the redirect and issues an HTTP GET request to https://webhook.site/e8ae3bbd-ab02-46b7-b84c-f5f4baa5d7c7.
  3. Credential capture page: The page hosts JavaScript that steals entered credentials and POSTs them back to the same webhook URL, but the proxy only logs the initial GET request, which is sufficient to fire the rule.
  4. For the test, we emulate the victim using PowerShell’s Invoke-WebRequest to request the exact malicious URL, reproducing the same proxy log entry.

• Regression Test Script:

  # -------------------------------------------------
  # BlueDelta Webhook Site Access Simulation (TC-20260109-9X3BZ)
  # -------------------------------------------------
  $maliciousUrls = @(
      "https://webhook.site/e8ae3bbd-ab02-46b7-b84c-f5f4baa5d7c7",
      "https://webhook.site/3791f8c0-1308-4c5b-9c82-0dc416aeb9c4"
  )
  
  foreach ($url in $maliciousUrls) {
      try {
          Write-Host "Requesting malicious URL: $url"
          Invoke-WebRequest -Uri $url -UseBasicParsing -Method GET -TimeoutSec 10 | Out-Null
          Write-Host "✅ Request sent."
      } catch {
          Write-Warning "Request to $url failed: $_"
      }
  }

• Cleanup Commands:

  # Flush proxy cache (if applicable) to avoid residual entries
  net stop "Squid Service"
  net start "Squid Service"
  
  # Remove any temporary files created by the script (none in this case)
  Write-Host "Cleanup complete."