APT28 Targets Ukrainian UKR-net Users in Long-Running Credential Phishing Campaign
APT28 ran a sustained phishing campaign from June 2024 to April 2025, using fake UKR.net login pages to steal credentials and 2FA codes.
More info