GOOGLE'S Threat Intelligence Group has identified three Russian-linked cyber espionage clusters—UNC6293, UNC7005, and UNC5976—that target researchers, diplomats, and defense personnel. They exploit legitimate authentication tools through phishing and social engineering. UNC6293, closely tied to APT29, uses app password phishing and OAuth phishing techniques, often impersonating US State Department officials.
UNC7005 employs device code phishing and targets individuals with fake invitations to events, while UNC5976 focuses on military and NGO targets in Ukraine and Armenia using automated OAuth phishing. All groups leverage personal accounts for attacks, complicating detection efforts. Google advises individuals to be vigilant about app passwords and suspicious OAuth prompts.