UNC1151 phishing campaign: what do the infrastructure pivots show?

TL;DR: A Gmail lure targeting Belarusian politician Yury Hubarevich was part of a wider UNC1151 credential-phishing campaign that also used fake Ukrainian portal pages, websocket relays, and CDN masking to hide infrastructure and capture credentials in real time, according to Censys. The pattern shows that infrastructure pivots, not just email lures, are now central to hunting phishing operations.

Editorial analysis by NHI Mgmt Group, based on content published by Censys: “UNC1151 Phishing Email Targeting Belarusian Politician Points to Multi-National Campaign”.

Key questions

Q: What breaks when phishing sites relay credentials in real time?

A: Real-time relay collapses the gap between theft and use.

Q: Why do phishing campaigns use CDN masking and certificate reuse?

A: CDN masking makes origin attribution harder, while certificate reuse and repeated host patterns expose the operator behind the lure.

Q: What are the signs that a phishing campaign is part of a larger multi-stage malware operation rather than a one-off lure?

A: Look for repeated lure themes, shared sender infrastructure, consistent macro logic, staged payload delivery, and follow-on files that unpack into later modules.

Practitioner guidance

• Hunt for infrastructure siblings Search certificate transparency, origin IPs, and hostname patterns for domains that share naming conventions, CDN masking, or repeated hosting behaviour with a known phishing page.
• Prioritise phishing-resistant authentication Move high-risk users and external-facing accounts toward FIDO2 or equivalent phishing-resistant methods, especially where live credential relay can defeat OTP-based flows.
• Correlate identity telemetry with web intel Tie unusual sign-in events, token reuse, and impossible-travel alerts to observed phishing infrastructure so that suspicious authentication attempts are investigated as a campaign, not a single login.

Bottom line: The article shows that credential phishing can be built as a reusable infrastructure pattern, not just a one-off lure.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →