Fake Conferences, OAuth and WhatsApp: Inside Russia’s New Espionage Tactics
Google tracks three Russia-linked espionage clusters abusing OAuth, app passwords, and device code phishing against Western researchers and diplomats.
Google's Threat Intelligence Group documented three suspected Russia-linked clusters, UNC6293, UNC7005, and UNC5976, abusing legitimate authentication flows. UNC6293, a likely APT29/ICE RELIC sub-cluster, impersonates US State Department officials in app password and OAuth phishing targeting fewer than five victims at a time. UNC7005, tracked by Microsoft as STORM-2945, spoofs the GLOBSEC conference, runs device code phishing against Microsoft and WhatsApp accounts, and deploys VIDAR and AtomicStealer infostealers. Targets include researchers, academics, diplomats, think-tank analysts, and defense personnel in Europe and the United States.
- UNC6293 is assessed with moderate confidence as an APT29/ICE RELIC sub-cluster
- UNC7005 (STORM-2945) uses GLOBSEC conference spoofing and device code phishing
- WhatsApp phishing pages link victim accounts to attacker devices and record calls
- Infostealers VIDAR and AtomicStealer delivered to Windows and Mac victims
- Hotel captive portal campaign connected to Midnight Blizzard infrastructure
- ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid AccountsT1528 Steal Application Access TokenT1621 MFA Request GenerationT1555 Credentials from Password Stores
- Products
- WhatsAppMicrosoft 365
- Organizations
- Google Threat Intelligence GroupMicrosoft
- Countries
- RussiaUnited StatesEurope
From the original article
6 min read at securityaffairs.com
Google tracks three Russia-linked espionage clusters using phishing and legitimate authentication tools to target researchers, diplomats and defense staff. Google’s Threat Intelligence Group tracked three separate suspected Russia-linked cyber espionage clusters. All three focus on the same thing: abusing authentication features that are supposed to protect accounts to access them instead.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.