Russia-Linked Cyber Espionage Tactics Exploit Authentication Features

Google’s Threat Intelligence Group has tracked three separate suspected Russia-linked cyber espionage clusters, all of which focus on abusing authentication features intended to protect accounts. These threat actors primarily target researchers, academics, government officials, think-tank analysts, and personnel in the defense sector across Europe and the United States. The clusters are identified as UNC6293, UNC7005, and UNC5976, each operating with distinct methods and tools, yet published together due to their shared objectives.

According to the report, these clusters engage in persistent and adaptive phishing campaigns, utilizing sophisticated social engineering tactics to compromise personal accounts across various platforms. Google emphasizes the need for awareness regarding these social engineering campaigns, as the operations often exploit legitimate authentication flows that may not immediately appear as phishing attempts to users.

UNC6293 is noted as the oldest and most precisely attributed of the three clusters. Google assesses with moderate confidence that it is a sub-cluster of ICE RELIC, also known as APT29, which is responsible for initial access operations. By October 2025, UNC6293 was still using screenshots from its June phishing lures, only altering the surrounding text. By June 2026, the group had incorporated OAuth phishing, where victims logging into legitimate services were prompted to share a URL or verification code, allowing attackers to obtain valid access tokens.

UNC7005, tracked by Microsoft as STORM-2945, is a related but distinct cluster first identified in February 2026. Google believes it is also connected to ICE RELIC but operates with lower technical sophistication and poorer operational security compared to UNC6293. This cluster employs a broader toolkit, conducting app password phishing, device code phishing against Microsoft and WhatsApp, malware distribution, and OAuth phishing operations, sometimes simultaneously.

An example of UNC7005's tactics includes a spoofed invitation to the GLOBSEC conference in May 2026, where the actor created a landing page to collect detailed registration information from targets. This included a fictional dinner wine selection and a Microsoft device code for the target to enter. When Google flagged the page, UNC7005 quickly revised the template, citing technical difficulties.

Additionally, UNC7005 has utilized WhatsApp phishing pages to deceive victims into linking their accounts to an attacker-controlled device. These fake pages offered options to join a call, open an encrypted chat, or download a file. If victims selected the call option, malicious JavaScript would request microphone and camera access, recording and sending the footage to the attackers.

In late May 2026, UNC7005 launched a broader phishing wave targeting U.S.-based academics, diplomats, and researchers focused on Russia. The lure involved a fake “Summit Companion App” designed to read a document supporting Ukraine.

The report also details how Windows users who downloaded the phishing content received VIDAR, an infostealer that extracts saved credentials, cookies, and payment data from browsers, while Mac users received ATOMIC, a similar infostealer for macOS. Neither tool is custom-made, and the email address used in this operation closely resembled one used by UNC6293 a year prior.

The hospitality captive portal campaign, previously reported by Reliaquest and Microsoft and attributed to Midnight Blizzard, is directly linked to UNC7005. Google traces the infrastructure back to April 2026, identifying domains that spoof Microsoft authentication resources, which were subsequently added to Safe Browsing blocklists. By mid-July 2026, these domains were receiving redirects from captive portals at hotels and conference centers, linking them to the GLOBSEC device code phishing operation.

Another notable detail is the CHERRYPIE infostealer, also known as ChocoShell, which Google suspects may have been developed using AI-generated code. This malware targets data overlapping with commercial infostealers already utilized by UNC7005, leading to speculation that CHERRYPIE could be a customized version of a malware-as-a-service tool.

In April 2026, UNC5976 distributed HEADRUSH, a malicious Excel plugin, through a domain impersonating a Ukrainian research institute, potentially targeting a Ukrainian aerospace and imaging company. HEADRUSH eventually leads to an HTA downloader, although Google was unable to recover the full infection chain.

The overarching challenge for defenders is that these groups often target personal accounts rather than corporate domain-joined accounts, creating a visibility gap for monitoring compromises from an organizational perspective. The use of encrypted messenger applications for initial outreach further complicates tracking and remediation efforts.

Google advises individuals to refrain from setting app passwords for anyone who requests them, revoke any existing ones that are unrecognized, check WhatsApp’s linked devices list, and treat any unsolicited OAuth authorization prompts as suspicious, regardless of the page's appearance. High-risk individuals are encouraged to consider Google’s Advanced Protection Program, which prevents the creation of app passwords altogether.