Russian-Backed Cyber Clusters Employ Evolving Tactics to Target Individuals of Interest
Google's Threat Intelligence Group (GTIG) has identified distinct clusters of Russian-state backed attackers, UNC6293, UNC7005, and UNC5976, employing evolving tactics in authentication-focused cyber espionage operations. These groups are targeting individuals of interest to Russia across various sectors, including academia, NGOs, diplomacy, defense, military, and aerospace. Their methods involve sophisticated phishing operations, often abusing legitimate features and infrastructure, such as Google OAuth login pages and Microsoft OAuth URLs, to steal authentication tokens and gain access to target accounts. UNC6293 and UNC7005, linked to older ICE RELIC operations, share operational methodologies and target industries, frequently using themes like diplomatic event invitations. UNC5976, however, operates distinctly with a heavier malware footprint and focuses geographically on Ukraine and Armenia, utilizing dedicated infrastructure for post-compromise activity rather than residential proxies. These attacker... 
