Country

RU

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 21, 2026 · last 25d ago

Timeline2 articles

Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts

Google tracked three suspected Russian espionage clusters abusing OAuth flows, app passwords, and WhatsApp linking to hijack accounts of diplomats and defense targets.

Google Threat Intelligence Group detailed three suspected Russian espionage clusters, UNC6293, UNC7005 (Storm-2945), and UNC5976, targeting academia, aerospace, defense, governments, and think tanks in Europe, the US, Ukraine, and Armenia. UNC6293, assessed as a sub-cluster of APT29/Ice Relic, conducted OAuth and application-specific password phishing while impersonating State Department officials. UNC5976 registered file-sharing-themed domains hosting fake OAuth login pages and deployed a malicious Excel plugin codenamed HEADRUSH, while UNC7005 abused WhatsApp device linking to hijack accounts and record victims' audio and video.

The Hacker NewsAug 21, 14:54 UTC · 25d agoThreat actor in the wild

Russian network monitoring firm confirms cyberattack claimed by pro

Russian firm Microolap confirmed hackers hit non-critical systems, disputing pro-Ukraine group Black Spark's claims of access to core platform and customer data.

Russian network monitoring software developer Microolap confirmed hackers compromised several rarely used development systems, an outdated website, and an old Bitrix24 customer management system, but denied claims that attackers reached its EtherSensor platform or stole data from customers like Russian Railways, Goznak, and VTB Bank. The pro-Ukraine group Black Spark claimed a month-long intrusion with data extraction and deletion, publishing screenshots Microolap disputes. The company isolated affected systems and engaged an unnamed major Russian cybersecurity firm for investigation.

The RecordAug 21, 13:58 UTC · 25d agoData breach in the wild1

Appears with

threat actor APT29 1 threat actor Black Spark 1 threat actor Storm-2945 1 threat actor UNC5976 1 threat actor UNC6293 1 threat actor UNC7005 1 malware HEADRUSH 1 organization Citizen Lab 1 organization Google Threat Intelligence Group 1 organization Volexity 1 organization Zscaler 1 product Bitrix24 1 product EtherSensor 1 product Google Cloud 1 product Google OAuth 1 product WhatsApp 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.