Full Report
Don't click on that State Department meeting invite
Analysis Summary
# Threat Actor: UNC6293, UNC7005, and UNC5976
## Attribution & Identity
* **Primary Attribution:** Likely linked to Russian Intelligence Services (SVR).
* **Associated Groups:**
* **UNC6293:** Suspected phishing squad for **APT29** (Cozy Bear / Midnight Blizzard). Tracked by Microsoft as **Storm-2945**.
* **UNC7005:** Linked to **APT29 / Ice Relic**. Characterized by lower sophistication and poorer operational security compared to other SVR clusters.
* **UNC5976:** Suspected Russian cyberespionage group; potentially aligned with alternative Russian intelligence services due to distinct infrastructure and mandates.
## Activity Summary
Google's Threat Intelligence Group (GTIG) is tracking these three distinct clusters conducting highly targeted operations (fewer than 100 targets per campaign) against Western interests. Activity has been ongoing since 2025, with a significant surge in **OAuth abuse** and **device-code phishing** in mid-2026. Key operations include impersonating the US State Department, spoofing the GLOBSEC forum, and compromising hospitality Wi-Fi networks to deploy infostealers.
## Tactics, Techniques & Procedures
* **OAuth Abuse:** Requesting targets share full URLs or "verification codes" after legitimate logins to external providers to gain long-term account access.
* **Social Engineering:** Impersonating US State Department personnel and diplomatic event organizers.
* **Device-Code Phishing:** Targeted attacks against Microsoft and WhatsApp accounts.
* **Infrastructure Manipulation:** Compromising captive portal networks (public Wi-Fi) at hotels and conference centers.
* **Watering Hole / Fake Sites:** Reusing website templates for "Embassy Invites" and conferences to fingerprint systems.
* **Malicious Scripting:** Using JavaScript to record audio/video via browser-based "voice calls."
* **Lure Customization:** Using elaborate themes, including "epicurean wine selections" and specific policy resolutions regarding Ukraine.
## Targeting
* **Sectors:** Academia, Aerospace, Defense, Government Agencies, Think Tanks, NGOs, and the Hospitality sector (for initial access).
* **Geography:** United States, Ukraine, and Western Europe.
* **Victims:** Individuals critical of Russia, prominent diplomats, researchers focused on former Soviet states, and attendees of the GLOBSEC forum.
## Tools & Infrastructure
* **Malware:** Infostealers (targeting macOS and Windows), Keyloggers, and custom malicious JavaScript for media recording.
* **Infrastructure:**
* **C2/Domains:** Domain names themed around file-sharing and diplomatic summits (e.g., spoofed "Summit Companion App").
* **Cloud Services:** Google Cloud project URLs used to capture redirected authentication tokens.
* **Proxies:** UNC5976 notably uses dedicated post-compromise infrastructure rather than residential proxies.
## Implications
These campaigns represent an evolution in Russian state-sponsored activity, moving away from traditional credential harvesting toward **OAuth token theft**. By abusing legitimate authentication flows, the actors bypass multi-factor authentication (MFA) and maintain persistent access without needing the victim's password. The use of audio/video recording capabilities suggests a high interest in gathering material for secondary social engineering or "kompromat."
## Mitigations
* **OAuth Scrutiny:** Educate users to never share "verification codes" or full redirect URLs with third parties.
* **App Governance:** Audit and restrict the ability of users to grant permissions to unverified third-party applications within Google Workspace and Microsoft 365.
* **Network Security:** Use VPNs when accessing public Wi-Fi in hotels or conference centers to avoid captive portal injection attacks.
* **Identity Protection:** Implement FIDO2-compliant hardware security keys which are more resilient against OAuth and device-code phishing.
* **Vigilance:** Verify any "Summit" or "Embassy" apps through official channels before downloading software to personal or work devices.