Credentials gathering campaign: large clusters of malicious infrastructure targeting government bodies and other strategic entities

ANSSI discovered multiple clusters of malicious domains and subdomains (many resolving to 157.7.184.0/24) used in a widespread credential‑harvesting phishing campaign targeting ministries, diplomatic missions, think tanks and other strategic entities; the report maps registrant emails to domain clusters, lists likely targets and indicators of compromise, and notes technical links to reported APT activity (Kimsuky, Group123) as well as associated malware/C2 artifacts.