APT28__2016__Russia_Hacks_Bellingcat_MH17_Investigation_ThreatConnect.pdf

ThreatConnect analyzes targeted operations against Bellingcat between 2015–2016, attributing a prolonged spearphishing and credential-harvesting campaign to FANCY BEAR (with related disruptive defacements and leaks by CyberBerkut). The report documents phishing templates spoofing Google, use of URL shorteners to obfuscate malicious landing pages, SMS/2FA interception or account-server access, and enumerates domain, mailserver, and IP indicators used in the attacks, concluding the activity is consistent with state-backed Russian actors aiming to compromise journalists and their contacts.