Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia
Suspected Russian clusters abuse OAuth and authentication flows to phish academia, defense, government, and think tank targets across Europe and the US.
Google Threat Intelligence Group (GTIG) is tracking three distinct suspected Russian cyber espionage clusters abusing legitimate authentication flows. Newly detailed clusters UNC7005 and UNC5976 conduct phishing, abuse OAuth flows, and/or deploy malware, alongside previously reported UNC6293 phishing operations. Targets include individuals in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks in the United States.
- New clusters tracked: UNC7005 and UNC5976, alongside previously reported UNC6293
- Targets span academia, aerospace, defense, government, and think tanks in Europe and the US
- Clusters use phishing, OAuth flow abuse, and malware deployment
- Tactics focus on abusing legitimate authentication flows for espionage
- Vendors
- Organizations
- Google Threat Intelligence Group
- Countries
- RussiaUnited States
From the original article
Written by: Gabby Roncone, Wesley Shields Overview Google Threat Intelligence Group (GTIG) is tracking three distinct suspected Russian cyber espionage threat clusters abusing legitimate authentication flows to target individuals working in academia, aerospace and defense, governments and think tanks across Europe, as well as academia and think tanks within the United States.
By Google Threat Intelligence Group · cloud.google.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.