Russian Clusters UNC6293, UNC5976, UNC7005 Pivot OAuth Phishing to Target Ukraine Defense and Academia
Russian espionage clusters refined OAuth phishing against narrow defense and academic targets using domain infrastructure and token exfiltration scripts. Official attribution to Ice Relic sub-groups rests on behavioral overlap while independent confirmation remains limited to observed domains and lures. Campaigns demonstrate persistent adaptation after infrastructure takedowns.
GTIG documented UNC6293, a Cozy Bear sub-cluster, shifting from app password lures impersonating State Department officials to requesting full OAuth URLs or codes after legitimate logins. UNC5976 built at least 12 file-sharing themed domains since March 2026, hosting fake pages that redirected to Google Cloud projects to exfiltrate tokens via malicious scripts. Both groups disrupted infrastructure prompted pivots to non-Google hosts. Evidence from domain registrations and cloud project artifacts shows automation of token staging rather than manual collection.
UNC7005, active since February 2026, layered WhatsApp linking with HEADRUSH Excel plugins delivering HTA payloads via domains impersonating Ukrainian research institutes. Targeting maps to military, aerospace, and NGOs in Ukraine and Armenia, overlapping prior Ice Relic operations reported by Citizen Lab in June 2025 and Volexity in December 2025. No independent technical attribution confirms state direction beyond infrastructure patterns and lure themes.
Operational significance lies in the low-volume, high-precision social engineering that bypasses MFA by hijacking legitimate auth flows. Google disruptions forced infrastructure churn but did not halt campaigns. Next phase likely involves expanded use of non-Google OAuth providers and continued focus on Ukrainian defense contractors.
GTIG: UNC5976 will register 15+ new domains on alternative providers by December 2026
Sources (2)
- [1]Primary Source(https://blog.google/threat-analysis-group/2026/08/russian-oauth-campaigns)
- [2]Supporting Source(https://www.volexity.com/blog/2025/12/app-password-phishing)