{
  "name": "GRU\u2019s BlueDelta Targets Key Networks in Europe with Multi-Phase Espionage Campaigns",
  "slug": "grus-bluedelta-targets-key-networks-in-europe-with-multi-phase-espionage-campaigns",
  "description": "Throughout the three phases, BlueDelta used phishing emails, legitimate internet services LIS, and\nliving off-the-land binaries LOLBins) to extract intelligence from key networks across Europe. They\nhave engaged in credential harvesting campaigns aimed at Yahoo and\nUKR.]net users, as well as\ndedicated victim mail servers. BlueDelta\u2019s recent operations have targeted the Ukrainian Ministry of\nDefence, Ukrainian weapons import and export companies, European railway infrastructure enterprises,\nand a think tank based in Azerbaijan. BlueDelta's espionage activities reflect a broader strategy aimed at gathering intelligence on entities\nwith military significance to Russia in the context of its ongoing aggression against Ukraine. This focus\nis consistent with their objective to uncover operational capabilities and potential vulnerabilities within\nUkraine's defense sector.",
  "published": "2024-05-31T12:17:13+00:00",
  "created_at": "2024-05-31T12:17:13+00:00",
  "modified_at": "2024-05-31T12:34:29+00:00",
  "created_at_opencti": "2024-05-31T12:17:13+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-05-31",
    "bluedelta",
    "headlace"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "73.80.9.137"
      },
      {
        "id": "",
        "name": "174.53.242.108"
      },
      {
        "id": "",
        "name": "37.191.122.186"
      },
      {
        "id": "",
        "name": "68.76.150.97"
      },
      {
        "id": "",
        "name": "xzdgsdfhfgtjdfj.wuaze.com"
      },
      {
        "id": "",
        "name": "xgfdstu6k.frge.io"
      },
      {
        "id": "",
        "name": "ua-consumerpanel.frge.io"
      },
      {
        "id": "",
        "name": "online-drive.infinityfreeapp.com"
      },
      {
        "id": "",
        "name": "opendocuments.infinityfreeapp.com"
      },
      {
        "id": "",
        "name": "online-download.infinityfreeapp.com"
      },
      {
        "id": "",
        "name": "hatdfg-rhgreh684.frge.io"
      },
      {
        "id": "",
        "name": "id-unconfirmeduser.frge.io"
      },
      {
        "id": "",
        "name": "eoytfd39hbrspa3.m.pipedream.net"
      },
      {
        "id": "",
        "name": "eoy6vrzslpn9vu.m.pipedream.net"
      },
      {
        "id": "",
        "name": "eottxji4yk4vg5x.m.pipedream.net"
      },
      {
        "id": "",
        "name": "eos93vb2cwsu3xf.m.pipedream.net"
      },
      {
        "id": "",
        "name": "eomhv6vdu4v5qyt.m.pipedream.net"
      },
      {
        "id": "",
        "name": "eogo85tybrrn2r.m.pipedream.net"
      },
      {
        "id": "",
        "name": "eo1ws2wgj75rdfd.m.pipedream.net"
      },
      {
        "id": "",
        "name": "eo6kgbwpysq0laa.m.pipedream.net"
      },
      {
        "id": "",
        "name": "downloadable.infinityfreeapp.com"
      },
      {
        "id": "",
        "name": "delivery-ukrinmash-service.infinityfreeapp.com"
      },
      {
        "id": "",
        "name": "documents-cloud.infinityfreeapp.com"
      },
      {
        "id": "",
        "name": "consumerpanel0x254a2.frge.io"
      },
      {
        "id": "",
        "name": "file-download.infinityfreeapp.com"
      },
      {
        "id": "",
        "name": "ukrprivacysite.frge.io"
      },
      {
        "id": "",
        "name": "setnewcred.ukr.net.frge.io"
      },
      {
        "id": "",
        "name": "panelunregistertle-348.frge.io"
      },
      {
        "id": "",
        "name": "f9f8ca7fa979766c168d7162df572f3549c7af2e707e5a5ac8e06bd352bb7399"
      },
      {
        "id": "",
        "name": "a0a67412968c10224e04bfbe32e6012b34e4a4ecc36fc72332101b90acec8fa4"
      }
    ],
    "malware": [
      {
        "id": "72ca2ffe-47ec-4f17-bb9b-d39d92e68420",
        "name": "Headlace",
        "slug": "headlace"
      }
    ],
    "intrusion_sets": [
      {
        "id": "eef4d7e5-6df6-4bc0-8e95-4249e6244510",
        "name": "BlueDelta",
        "slug": "bluedelta"
      }
    ],
    "attack_patterns": [
      {
        "id": "28548897-8b18-4095-97e8-1732f52e9316",
        "name": "T1102.003"
      },
      {
        "id": "469ac6f1-45e1-4965-b1fa-0bb3e7def5ae",
        "name": "T1111"
      },
      {
        "id": "e263a16c-ab5b-4196-8194-1906be1fabc4",
        "name": "T1056.003"
      },
      {
        "id": "79525d9e-3824-4347-a471-7dcea20fd864",
        "name": "T1583.006"
      },
      {
        "id": "d3254e3b-07e6-4420-96e0-2e107ce17712",
        "name": "T1102.001"
      },
      {
        "id": "d19f56ca-5ce8-4bd1-af90-7d83e394470c",
        "name": "T1583.001"
      },
      {
        "id": "ef72da1d-2eaa-4d94-8913-06978609cfb4",
        "name": "T1608.001"
      },
      {
        "id": "6f00068c-812c-4e2b-9100-2cfa86b3aed9",
        "name": "T1132.001"
      },
      {
        "id": "9594762e-9e74-466b-a460-3fd2a8aa7e10",
        "name": "T1608.005"
      },
      {
        "id": "dea4e00b-6e38-4223-a0f2-8a44e403019b",
        "name": "T1564.003"
      },
      {
        "id": "9e784d22-5a6c-4da6-968a-5fab2f019efd",
        "name": "T1059.005"
      },
      {
        "id": "05ac27d4-58d0-44b2-a984-cd5aefd1f7f9",
        "name": "T1497.001"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "9322d33b-00c1-4f99-9f1a-a33d93c0dac2",
        "name": "T1059.007"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "5b7c66d1-0466-4ba7-af6f-eb82c2f9d05b",
        "name": "T1033"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Azerbaijan"
      },
      {
        "id": "",
        "name": "Ukraine"
      },
      {
        "id": "",
        "name": "Defense"
      },
      {
        "id": "",
        "name": "NGO"
      },
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://go.recordedfuture.com/hubfs/reports/CTA-RU-2024-0530.pdf",
    "https://otx.alienvault.com/pulse/6659dbeaf7587848d15e6900"
  ]
}