Belling the BEAR

ThreatConnect documents sustained targeting of Bellingcat by Russian-linked actors: a FANCY BEAR (APT28) spearphishing and credential-harvesting campaign (multiple Gmail‑spoofing messages, Bitly/TinyURL redirects, target-specific base64 strings) and a CyberBerkut defacement/leak that exposed a contributor's personal data; the report provides timelines, attributed infrastructure (domains, name servers, IPs, sender emails), screenshots of phishing lures, and an assessment of possible coordination between the groups while advising defensive measures such as ubiquitous two‑factor authentication.