APT28 Targets Ukrainian UKR-net Users in Credential Phishing Campaign

APT28 attack cybersecurity concept — Photo by Pranav Kumar Jain on Unsplash

The Russian state-sponsored threat actor known as APT28 has launched a sustained credential-harvesting campaign specifically targeting users of UKR[.]net, a popular webmail and news service in Ukraine. This APT28 attack has been observed by Recorded Future’s Insikt Group from June 2024 to April 2025, revealing a systematic effort to compromise user credentials and exploit vulnerabilities within the platform. This campaign builds upon prior findings from the cybersecurity company in May 2024, highlighting the persistent threat posed by APT28 and similar actors.

Details of the APT28 Attack

The APT28 attack leverages sophisticated phishing techniques to deceive users into revealing their login credentials. The campaign employs various tactics, including the use of fake login pages that closely mimic the legitimate UKR[.]net interface. Once users enter their credentials, the attackers gain unauthorized access to their accounts, leading to potential data breaches and further exploitation. The long-running nature of this campaign indicates a well-planned strategy by APT28, which is known for its ties to the Russian government and its focus on espionage and cyber warfare.

This phishing campaign not only targets individual users but also poses a broader risk to organizations and governmental entities that rely on UKR[.]net for communication and information dissemination. The ability of APT28 to successfully harvest credentials can lead to significant disruptions in operations and may facilitate further cyber-attacks against Ukrainian infrastructure.

Impact on Users and Privacy

The impact of the APT28 attack on UKR[.]net users is profound, as compromised accounts can lead to unauthorized access to sensitive information, identity theft, and potential financial loss. Users may find themselves vulnerable to additional phishing attempts, as attackers can use stolen information to craft more targeted and convincing scams. Furthermore, the breach of personal data can have lasting effects on user privacy and trust in the platform.

For VPN users, the APT28 attack serves as a reminder of the importance of securing internet traffic and maintaining privacy online. Cybersecurity vulnerabilities can compromise not only individual user accounts but also the integrity of entire networks. As state-sponsored attacks become more sophisticated, the need for robust security measures, including the use of VPNs, becomes increasingly critical. A reliable VPN can help protect internet traffic from interception and provide an additional layer of security against phishing attempts.

Context

The APT28 attack is part of a larger trend of state-sponsored cyber operations aimed at destabilizing nations and gaining strategic advantages. The ongoing conflict in Ukraine has heightened the stakes for cyber warfare, with various threat actors, including APT28, seeking to exploit vulnerabilities in Ukrainian infrastructure. This attack underscores the need for heightened vigilance and proactive cybersecurity measures among users and organizations operating in high-risk environments.

What to do

To protect yourself from the APT28 attack and similar threats, consider the following steps:

Update all affected software to the latest versions immediately.
Enable automatic updates where possible to ensure you receive the latest security patches.
Monitor security advisories from affected vendors to stay informed about potential vulnerabilities.
Use a VPN service to protect your internet traffic. Consider using reliable VPNs like ProtonVPN or Surfshark.
Implement additional security measures such as multi-factor authentication to enhance account security.