Cybersecurity researchers have uncovered significant activities by suspected Russian cyber espionage groups abusing legitimate authentication processes to target professionals in academia, aerospace, defense, and government sectors across Europe and the United States. These groups, identified as UNC6293, UNC7005, and UNC5976, have been exploiting platforms such as Google and WhatsApp to execute their sophisticated phishing operations.
UNC6293’s Phishing Tactics
UNC6293, believed to be a subset of the group known as Ice Relic, also referred to as APT29, has been employing precise phishing strategies since June 2025. This group targets a small number of users by impersonating officials from the State Department. Their phishing messages often revolve around diplomatic themes and significant meetings, a tactic first reported by Volexity.
Their methods include phishing for app passwords by requesting URLs or codes from victims after they log in to external services. This enables them to take over accounts by acquiring the necessary verification codes.
UNC5976’s Use of OAuth
Active since March 2026, UNC5976 relies heavily on OAuth phishing techniques. They have created fake domains under the guise of file-sharing services to deceive targets into granting access to their accounts. By setting up pop-up login dialogs with a ‘Continue with Google’ button, they direct victims to provide authentication tokens unknowingly.
Google’s efforts have disrupted several of these domains, forcing UNC5976 to shift its infrastructure away from Google to continue its phishing activities.
UNC7005’s Multi-faceted Approach
UNC7005, identified in February 2026, has been especially active in targeting academic and diplomatic personnel in Ukraine, Western Europe, and the U.S. This group employs a variety of tactics, including app password phishing and device code phishing, targeting platforms such as Microsoft and WhatsApp.
In May 2026, UNC7005 began spoofing WhatsApp accounts, tricking users into linking their accounts to attacker-controlled devices. This method allows them to record audio and video or extract sensitive information during fake WhatsApp calls.
The group’s operations have extended to using infostealers like Vidar and Atomic to exfiltrate data from compromised devices. They have also initiated OAuth phishing campaigns targeting European defense industry professionals.
Their recent campaigns have included spoofing domains related to the Finnish Operations Center, aligning with a broader strategy of targeting defense sectors.
Broader Implications and Future Threats
These cyber espionage activities highlight the evolving strategies of Russian threat actors who exploit legitimate authentication methods to compromise targeted accounts. Their ability to blend legitimate and malicious accesses complicates tracking and mitigation efforts.
As these groups continue to adapt and evolve, cybersecurity experts emphasize the need for heightened vigilance and robust security measures to protect sensitive information from such sophisticated threats.
