A threat actor has conducted several large credential phishing campaigns targeting ukr.net users; UkrNet is a Ukrainian media company.  In two recent campaigns, the attackers used newly created Blogspot domains as the initial landing page, which then redirected targets to credential phishing pages.