98% Spike in Phishing Campaigns Leveraging Russian (.ru) Domains

KnowBe4 Threat Lab observed a rapid surge in credential-harvesting phishing campaigns hosted on Russian (.ru) domains—reporting a 98% increase from Dec 2024 to Jan 2025, ~1,500 unique .ru domains (377 registered via R01-RU), and over 13,000 malicious emails—where attackers leverage "bullet-proof" hosting, fast-flux DNS, QR codes, multi-layered HTML attachments, polymorphic and dynamic URLs to evade email security gateways; the report details affected industries, domain age trends and provides mitigation guidance including blocking .ru TLDs where feasible, enforcing DMARC/SPF/DKIM, enhanced filtering/monitoring, user training, and contextual/linguistic detection methods.