Three suspected Russian cyber espionage clusters, UNC6293, UNC5976, and UNC7005, have been using legitimate authentication flows and social engineering to target academia, defense, governments, and think tanks across Europe and the U.S. Their campaigns span app password, OAuth, device code, and WhatsApp phishing, along with malware and token theft to hijack accounts and expand access. #UNC6293 #UNC5976 #UNC7005 #IceRelic #CozyBear #MidnightBlizzard #APT29 #HEADRUSH #CornFlakeRAT #ChocoShell #SPIKEDWINE #CaptiveCrunch #FruitStone
Keypoints
- UNC6293, UNC5976, and UNC7005 are targeting high-value individuals in academia, defense, governments, and think tanks.
- The groups abuse legitimate authentication flows such as app passwords, OAuth, and device linking.
- UNC5976 used fake file-sharing pages and cloud infrastructure to steal authentication tokens.
- UNC7005 ran WhatsApp, Microsoft, and Google phishing campaigns and used infostealers like Vidar and Atomic.
- Related activity such as CaptiveCrunch and FruitStone enabled token theft, DNS hijacking, and endpoint control.
Read More: https://thehackernews.com/2026/08/suspected-russian-hackers-abuse-google.html