Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts
Google tracked three suspected Russian espionage clusters abusing OAuth flows, app passwords, and WhatsApp linking to hijack accounts of diplomats and defense targets.
Google Threat Intelligence Group detailed three suspected Russian espionage clusters, UNC6293, UNC7005 (Storm-2945), and UNC5976, targeting academia, aerospace, defense, governments, and think tanks in Europe, the US, Ukraine, and Armenia. UNC6293, assessed as a sub-cluster of APT29/Ice Relic, conducted OAuth and application-specific password phishing while impersonating State Department officials. UNC5976 registered file-sharing-themed domains hosting fake OAuth login pages and deployed a malicious Excel plugin codenamed HEADRUSH, while UNC7005 abused WhatsApp device linking to hijack accounts and record victims' audio and video.
- Three clusters tracked: UNC6293, UNC7005/Storm-2945, and UNC5976
- UNC6293 tied to APT29/Ice Relic, impersonated State Department officials
- UNC5976 used fake file-sharing pages with Google OAuth and HEADRUSH Excel plugin
- UNC7005 abused WhatsApp device linking to hijack accounts, record calls
- Wine-themed diplomatic lures recur in Ice Relic attacks since 2023
- ATT&CK
- T1566.002 Phishing: Spearphishing LinkT1078 Valid AccountsT1528 Steal Application Access TokenT1113 Screen Capture
- Vendors
- Products
- WhatsAppGoogle OAuthGoogle Cloud
- Threat actors
- APT29UNC6293UNC7005UNC5976Storm-2945
- Malware
- HEADRUSH
From the original article
9 min read at thehackernews.com
Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U. S.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.