Threat Group 4127 Targets Hillary Clinton Presidential Campaign | SecureWorks

SecureWorks CTU reports that TG-4127 (APT28/Sofacy) conducted a targeted spearphishing campaign from Oct 2015–May 2016 using Bitly-shortened URLs that redirected to spoofed Google login pages to harvest credentials from Hillary for America staff, DNC personnel, and related personal Gmail accounts; the report details counts of links and clicks, targeted roles, likely Russian attribution, and recommends user education and caution with shortened URLs and spoofed login prompts.