Threat Group-4127 Targets Hillary Clinton Presidential Campaign

SecureWorks CTU observed Threat Group-4127 (aka APT28/Sofacy) running a spearphishing campaign (Oct 2015–May 2016) that used Bitly-shortened URLs to redirect victims to spoofed Google Account login pages to harvest Gmail credentials from targets including Hillary for America, the DNC, and related personnel; the report documents scope (e.g., 8,909 Bitly links targeting 3,907 Gmail accounts and 213 links targeting 108 hillaryclinton.com addresses), observed click counts, suspected Russian government intelligence objectives, and recommended mitigations.