A KnowBe4 Threat Lab publication
Authors: Martin Kraemer, Jeewan Singh Jalal, Anand Bodke, and James Dyer

EXECUTIVE SUMMARY: We observed a 98% rise in phishing campaigns hosted on Russian (.ru) top-level domains (TLDs) from December 2024 to January 2025, primarily used for credential harvesting.