THE Google Threat Intelligence Group (GTIG) reports on three Russian cyber espionage clusters: UNC6293, UNC7005, and UNC5976, focused on targeting individuals in academia, government, and defense sectors in Europe and the U.S. These clusters employ sophisticated phishing tactics, abusing authentication flows to compromise accounts. UNC6293 is linked to initial access operations and uses targeted phishing methods, while UNC7005 operates with lower sophistication and includes malware deployment.
UNC5976 specializes in OAuth phishing using cloud infrastructure. Across these groups, malwares such as VIDAR and ATOMIC are utilized, highlighting a critical threat landscape where legitimate services are exploited to facilitate attacks. Recommendations include enhanced user awareness and security practices.