Three Russian Clusters, One Playbook: How Moscow's Spies Turned Login Screens Into Listening Posts- 340

August 22, 2026

Google's Threat Intelligence Group has spent the past year quietly tracking three separate Russia-linked espionage operations that share a single insight: the easiest way past modern account security is not to break it, but to ask the victim to open the door themselves. Rather than deploying novel exploits, the clusters GTIG designates UNC6293, UNC7005 and UNC5976 have converged on abusing the legitimate authentication mechanics — app passwords, OAuth consent screens, device-linking codes — that platforms built to protect their users, turning each into a channel for handing over account access without the target ever realizing they had been phished.

UNC6293 is the oldest and most confidently attributed of the three: GTIG assesses with moderate confidence that it is a sub-cluster of ICE RELIC, the group more widely known as APT29 or Cozy Bear and linked by Western governments to Russia's Foreign Intelligence Service. Documented since June 2025, its operations are narrow by design, rarely targeting more than five people at a time, built around impersonation of US State Department officials and lures referencing the domain ms.state.gov. Its core technique is deceptively simple: the attacker convinces a target to set a specific app password on their account — one the attacker already knows — and then logs in with it, bypassing two-factor authentication entirely because the login itself uses a legitimate credential. The group was still recycling screenshots from its original June 2025 lure as late as October, changing only the surrounding text, before adding OAuth phishing in June 2026: after a target completes a genuine login to an external provider, UNC6293 asks them to share the resulting URL or "verification code," which is enough to hand over a valid access token. Targets have included prominent critics of Russia, among them British Russia-information-operations expert Keir Giles.

UNC7005 — tracked by Microsoft as Storm-2945 — is a related but distinct cluster first identified in February 2026, one GTIG links to the same ICE RELIC lineage but treats separately because of its lower technical sophistication, weaker operational security and broader toolkit. Where UNC6293 specializes, UNC7005 diversifies: app-password phishing, device-code phishing against both Microsoft and WhatsApp accounts, malware distribution and OAuth phishing, sometimes all in the same month. Its GLOBSEC forum spoof in May 2026 illustrates the tradecraft well — a landing page mimicking the real GLOBSEC security conference collected detailed registration information, including, in a recurring ICE RELIC-linked flourish, a wine selection for a fictitious dinner, before presenting victims with a Microsoft device code to enter; a leftover reference to "Embassy security policy" from an earlier lure template gave away the reused infrastructure, and the group patched its own error within days, blaming "technical difficulties" for anyone still watching. Its WhatsApp operations followed a similar logic: fake pages invited targets to join a call, open an encrypted chat or download a file, and choosing the call option triggered malicious JavaScript that silently recorded audio and video and uploaded it to attacker infrastructure while displaying a fake "call failed" message. A broader wave in late May 2026 targeted US-based academics, diplomats and Russia researchers with a fictitious "Summit Companion App" tied to a Ukraine-support resolution; victims who downloaded it received VIDAR, a commodity Windows infostealer, or ATOMIC (AtomicStealer) on macOS, both sold as malware-as-a-service rather than custom-built. GTIG also connects the cluster to ENGINELIGHT, a Go-based malware strain, and to CHERRYPIE (also known as ChocoShell), a PowerShell infostealer whose code contains comments and structure consistent with large-language-model-assisted development — a detail researchers read as early evidence of Russian operators using AI tools to write malware rather than only to accelerate reconnaissance. The same cluster's infrastructure traces back to the hotel and conference-center captive-portal campaign previously attributed by Reliaquest and Microsoft to Midnight Blizzard, in which domains spoofing Microsoft authentication pages began appearing in April 2026 and were, by mid-July, receiving redirects from public Wi-Fi login pages at hospitality venues.

UNC5976 is the outlier of the three, and GTIG treats it as potentially reporting to a different arm of Russian intelligence altogether, citing "differing strategic mandates" from the ICE RELIC-linked pair. Active since at least March 2026, it concentrates on military, aerospace, defense-industrial-base and NGO targets in Ukraine and Armenia, and relies on dedicated attacker infrastructure rather than the residential proxies UNC6293 and UNC7005 favor for post-compromise access. Its OAuth phishing is the most automated of the three: the group registers file-sharing-themed domains, stands up a Google Cloud project behind each one, and uses a fake "Continue with Google" prompt to route victims through a genuine Google sign-in screen before redirecting the authenticated session to a cloud-hosted script that captures the access token. In April 2026 it distributed HEADRUSH, a malicious Excel plugin, through a domain impersonating a Ukrainian research institute, apparently aimed at a Ukrainian aerospace and imaging company; the plugin leads to an HTA downloader, though Google was unable to fully reconstruct the infection chain. After Google disrupted the group's infrastructure — adding domains to Safe Browsing and disabling the associated cloud projects — UNC5976 registered roughly a dozen new domains within three months and has begun migrating away from Google-hosted infrastructure altogether.

Numerically, none of this looks like mass-market cybercrime: Google told The Register that individual campaigns run to fewer than one hundred targets and under ten actual victims. But the choice of target — academics, diplomats, defense and aerospace personnel, government officials, think-tank analysts — signals intelligence collection rather than financial gain, and the consistency of technique across three otherwise-independent clusters points to a shared institutional playbook rather than three groups improvising in parallel. That playbook exploits a structural blind spot GTIG names explicitly: because the accounts being targeted are personal rather than corporate and domain-joined, security teams watching enterprise email and endpoint telemetry see nothing of the initial compromise, and the growing reliance on encrypted messaging apps like WhatsApp for first contact removes the operation from email-based defenses entirely. By the time a compromised personal account is being used to phish its owner's own contacts, GTIG notes, the original intrusion is already cold. Google's guidance to individuals is correspondingly narrow and behavioral rather than technical: never set an app password at someone else's request, review and revoke unrecognized ones, check WhatsApp's linked-devices list regularly, and treat any OAuth consent screen arriving from an unsolicited message as suspicious regardless of how legitimate the underlying page looks — with its Advanced Protection Program, which blocks app-password creation outright, recommended for the highest-risk users.