KnowBe4 Sees 98% Spike in Phishing Campaigns Leveraging Russian (.ru) Domains

 KnowBe4 has observed a 98% rise in phishing campaigns hosted on Russian (.ru) top-level domains (TLDs) from December 2024 to January 2025, primarily used for credential harvesting. 

These Russian .ru domains are run by so-called “bullet-proof” hosting providers, that are known to keep malicious domains running and ignore abuse reports which is ideal for cybercriminals.  

Many of the phishing emails that we identified and investigated had passed through one or more security products including Exchange Online Protection, Barracuda Email Security Gateway, Mimecast, and Cisco Ironport. 

KEY FINDINGS 

  • 98% increase in phishing sites using .ru TLDs from December 2024 to January 2025 
  • 1,500 unique .ru domains identified as part of the campaign 
  • 377 new domains registered with “bulletproof” registrar R01-RU 
  • More than 13,000 malicious emails with the domain were reported 
  • 2.2% of observed emails from .ru domains were phishing emails  
  • 7.4 days average age of a .ru domain 

You can get the full details here.

Leave a Reply

Discover more from The IT Nerd

Subscribe now to keep reading and get access to the full archive.

Continue reading