Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia

What it is

Google Threat Intelligence Group (GTIG) describes three suspected Russian espionage clusters that target academics, diplomats, think tanks and defense-industry staff in Europe and the US. UNC6293 and UNC7005 are tied to ICE RELIC (formerly APT29) with moderate confidence. UNC5976 is tracked as separate, possibly aligned with a different Russian service. Most targeted accounts are personal, not corporate, which leaves a monitoring gap for employers.

How it works

• UNC6293: App password phishing posing as the US State Department. Lures are PDFs telling the target to create an app password named ms.state.gov. In October 2025 the victim entered it into a web form instead of emailing it back. By June 2026 it also ran OAuth phishing that asks for a "verification code" or full URL after a real login (page seen at foreignrelations[.]us). Campaigns usually hit fewer than five people.
• UNC7005 (aka STORM-2945): Active since at least February 2026, with weaker operational security. Its methods:
• App passwords unique per target.
• Microsoft device code phishing through spoofed conference pages (GLOBSEC, "embassy invite"). Pages fingerprint the visitor and blank themselves if headless-browser checks (navigator.webdriver, missing languages, missing window.chrome) trip.
• WhatsApp device linking in May and June 2026. The page creates a real link request from the victim's phone number, shows the genuine QR and code, then offers a fake voice call that records audio and video and uploads it to /api/code/<session id>/recording, or a fake "encrypted chat" with credentials.
• A late May 2026 email wave serving VIDAR (Windows, Go binary, C2 107.189.18[.]7) or ATOMIC (macOS) by User Agent.
• Google and Microsoft OAuth phishing in August 2026, including spoofs of the Finnish Operations Center. Google victims are redirected to an unverified, testing-mode attacker cloud project that captures tokens.
• Captive portal campaign: GTIG links the hotel and conference-center portal redirects, reported by Reliaquest (23 July 2026) and Microsoft (31 July 2026), to UNC7005 through shared registrant emails and IP resolution. GTIG also suspects the CHERRYPIE PowerShell stealer is built on a purchased MaaS stealer, and sees signs it was LLM-generated.
• UNC5976: Since March 2026 it has bought file-sharing-themed domains, attached a cloud project to each, and used scripts there to pull the token from the redirect URL. It registered at least twelve new domains within about three months of disruption and is moving to other providers. It also used a malicious Excel plugin, HEADRUSH, leading to an HTA downloader (April 2026). Post-compromise it uses dedicated infrastructure, not the residential proxies the other two clusters rely on.

What to do

Hunting pivots stated in the text:

• Domains: owa-ms365[.]com, m365-owa[.]com, ms365-device[.]com, ms365-live.com, my-invite[.]org, statistic-ms[.]live (ENGINELIGHT C2), wa-connect[.]eu, verify-drive[.]com.
• IP: 104.194.159[.]150.
• Sender and registrant emails: bounce@chamber-ua.org, chikolimdrid@gmail.com, keyereaonkendrick4@gmail.com.
• App password labels such as ms.state.gov.
• SHA-256 for VIDAR: 1d9299799a7b8da67c44ebec064d64542c27645f8e84de4a22ca3f6cbc843e3c.
• SHA-256 for ATOMIC: c5826032207d623a7f6caec8465af7364eccc355f9a48897da2a54f3e4420265.
• SHA-256 for HEADRUSH: 2c7f4165967d6f7737b3fef87959846920b57a5368b531ad1427c7214d4c41a2.
• The full IOC set is in a GTI Collection for registered users. Google SecOps Enterprise Plus customers get matching alerts in the Applied Threat Intelligence rule pack.

Controls the page recommends:

• Do not use or share app passwords, and revoke legacy ones. Enroll high-risk users in the Advanced Protection Program, which blocks app passwords. Google Cloud enterprise customers can disable them by restricting 2-Step Verification to "Only Security Keys".
• For WhatsApp and similar apps, enforce registration lock and two-factor authentication, audit "linked devices" routinely, and verify contacts with safety numbers over another channel.
• Verify invitations through contact details found outside the invitation. Check the URL before authenticating.

Caveats

• The ICE RELIC link for UNC6293 and UNC7005 is moderate confidence. The Russian nexus for all three is high confidence.
• GTIG could not determine the file offered after WhatsApp linking, or the full HEADRUSH infection chain.
• The unverified-app warning for testing-mode cloud projects applies only in specific scenarios, and Google's account takedowns do not cover the same actors' non-Google infrastructure.