Russian GRU-backed threat actor APT28 is behind campaigns targeting networks across Europe with HeadLace malware and credential-harvesting web pages.