APT28__2017__Russian_Cyber_Operations_On_Steroids.pdf

ThreatConnect research links credential-harvesting phishing domains (wada-awa.org, wada-arna.org, tas-cass.org) and associated infrastructure (81.95.5.166, 149.154.157.171) to tactics, techniques, and procedures used by the Russian APT FANCY BEAR (APT28). The report documents WHOIS/registrant evidence ([email protected], [email protected]), passive DNS and name-server patterns (ITitch, Domains4bitcoins), the compromise of WADA/CAS accounts (including Yuliya Stepanova), and considers timing and motive tied to WADA recommendations to ban Russian athletes; it also questions whether a claimed hacktivist group (Anonymous Poland) might be a platform used to obscure state involvement.