Google Threat Intelligence Group published new research on three suspected Russian cyber espionage clusters abusing legitimate authentication flows to target people in academia, aerospace and defense, government, think tanks, nonprofits, and diplomatic communities.
The important part for defenders is not just the Russia attribution. It is the technique. These campaigns do not always need a browser zero-day, a malicious attachment, or a classic fake login page. They abuse real workflows that users already recognize: app passwords, OAuth consent, device-code login, WhatsApp device linking, conference registration pages, and captive portals at hotels or event venues.
What Google reported
GTIG described three clusters: UNC6293, UNC7005, and UNC5976. The activity overlaps with Russian state interests and includes targeting of individuals connected to governments, defense, aerospace, academia, diplomacy, and Russia-focused research.
Across the campaigns, Google observed several recurring tradecraft patterns:
- App password phishing: attackers coached targets into creating app-specific passwords, then used those passwords to access accounts outside the normal MFA path.
- OAuth phishing: targets were pushed through legitimate authentication screens and then tricked into granting access to attacker-controlled applications or sharing verification material.
- Device-code phishing: Microsoft device login flows were abused so the victim’s valid login completed the attacker’s session.
- WhatsApp device linking: phishing pages displayed legitimate WhatsApp linking prompts so an attacker-controlled device could be attached to the victim’s account.
- Hospitality captive portal abuse: infrastructure tied to UNC7005 overlapped with campaigns that redirected hotel and conference network users toward Microsoft-themed phishing and malware delivery pages.
- Malware delivery when useful: in at least one broader wave, Windows users were served VIDAR and macOS users were served AtomicStealer based on their user agent.
Google also noted operational adaptation: phishing pages fingerprinted visitors, reused event-themed templates, changed wording and designs after discovery, and built lures around diplomatic conferences, secure calls, document sharing, and Ukraine-related events.
Why this matters for SMBs and government contractors
This is exactly the kind of identity attack that can land below the threshold of many small security programs. The login page may be real. The QR code may be real. The device-code page may be hosted by Microsoft. The OAuth prompt may come from Google. The user may not see a password theft form at all.
That makes the attack harder to explain with generic “don’t click suspicious links” training. The better framing is: attackers are abusing delegated trust. They are trying to make the victim authorize the attacker’s access through workflows that were designed for convenience, mobile login, third-party apps, and legacy compatibility.
For government contractors, consultants, researchers, and executives, personal accounts also matter. A compromised personal Gmail, WhatsApp, or travel device can expose relationship maps, meeting context, MFA recovery paths, document links, and social proof for follow-on phishing into the business environment.
Defensive takeaways
1. Treat app passwords as high-risk exceptions
If app passwords are enabled, inventory who can create them and why. Disable them where possible. Where they must remain available, alert on new app-password creation, suspicious naming, and use from unusual geographies or devices.
2. Lock down OAuth consent
Do not allow users to freely approve high-risk OAuth permissions. Require admin consent for sensitive scopes, review new enterprise applications, and alert when a user grants mailbox, file, offline access, or broad profile permissions to an unfamiliar app.
3. Monitor device-code authentication
Device-code login is useful, but it is also phishable. Watch for device-code authentication from unusual IPs, impossible travel, unmanaged devices, or sessions that do not match the user’s normal device patterns.
4. Add travel and conference identity guidance
Hotel Wi-Fi, conference portals, and event registration flows should be treated as elevated-risk environments for executives, sales teams, researchers, and cleared or clearance-adjacent personnel. Encourage cellular hotspot use, VPN where appropriate, and verification of event links through known channels.
5. Protect personal collaboration accounts used for work context
If WhatsApp, personal Gmail, or other non-managed accounts are used for business-adjacent communication, assume they can become part of the attack path. Provide practical guidance on linked-device review, account recovery hardening, phishing-resistant MFA, and separation between personal and client/project access.
6. Investigate authorization events, not only failed logins
These campaigns often succeed by making the victim complete a legitimate action. Security teams should review successful consent grants, new app passwords, new linked devices, successful device-code logins, and fresh sessions after suspicious email or travel activity.
Bulwark Black assessment
The core lesson is uncomfortable but useful: MFA is not a finish line. MFA blocks many credential-theft paths, but attackers are increasingly targeting the workflows around MFA—delegated app access, device enrollment, app passwords, OAuth consent, and legitimate login handoffs.
For SMBs and government contractors, the right move is not to abandon these workflows. It is to make them visible and governed. Know who can approve OAuth apps, who can create app passwords, which accounts can link new devices, what device-code sign-ins look like, and how fast your team can revoke sessions when something looks wrong.
Bottom line: if an attacker can convince a user to authorize access, they may not need to steal the password. Defenders need controls around the authorization layer, not just the login box.
Original source: Google Cloud / Google Threat Intelligence Group — Distinct Clusters Target Individuals of Interest to Russia.