Russian Espionage Clusters Abuse Authentication Flows to Phish Individuals

Published on September 7, 2026 | By Focused Hunts

Google's threat intelligence team has exposed three Russian-linked groups with an unusual way of breaking into personal accounts. Rather than relying only on stolen passwords, they trick people into approving access themselves through normal sign-in features that email and messaging apps offer. The groups target researchers, diplomats, defense workers, and think tank staff who focus on Russia, Ukraine, and NATO.

Think of it like a con artist who talks a hotel guest into handing over a spare room key instead of breaking down the door. Because the victim performs each step on a real login page, nothing looks obviously wrong, and the usual security warnings never fire. This makes the activity very hard to spot for both the person and their security team.

Once the groups gain access, they can read private email, join encrypted chats, and even secretly record audio and video during fake calls. A single compromised account exposes sensitive research, diplomatic discussions, and defense information, and lets the attacker impersonate the victim to reach other targets. For the organizations these people work with, one tricked login can quietly open the door to months of espionage.

Hunting Controls & Observations

Google Threat Intelligence Group (GTIG) tracks three distinct suspected Russian clusters, UNC6293, UNC7005 (also tracked as STORM-2945), and UNC5976. UNC6293 and UNC7005 are assessed with moderate confidence to be initial-access clusters linked to ICE RELIC (formerly APT29); UNC5976 is assessed as distinct, potentially serving a different Russian intelligence mandate. All three abuse legitimate authentication flows, which means the strongest detection opportunities live in identity and email telemetry rather than in malware signatures alone. Organizations can detect this activity through multiple telemetry sources:

Identity & Access Controls: Microsoft Entra sign-in logs (device code and app authentication), OAuth consent and permission-grant audit events, and Google Workspace login and token audit logs
Endpoint Controls: EDR/XDR, Sysmon (Events 1, 3, and 11), PowerShell Script Block Logging (Event ID 4104), and access to browser credential and cookie stores
Network Controls: DNS query logs, web proxy and TLS inspection, and firewall egress records for connections to newly registered lookalike domains
Cloud & SaaS Controls: OAuth application consent events, cloud project creation, and Office 365 audit logs (mailbox rules, delegation)

Behavioral Indicators of Attack

The following behaviors, drawn from the GTIG analysis, are more durable than any single indicator because the clusters rotate infrastructure quickly:

Phishing emails impersonating diplomatic events, government bodies, or file-sharing invitations that direct the target to an attacker-controlled registration page before any credential is requested.
A user creating an app-specific password shortly after receiving an unsolicited invitation, then emailing it back or entering it into a lookalike form. App passwords bypass two-factor authentication, which is exactly why the clusters request them.
OAuth device code authentications, where a user completes a genuine Microsoft or Google login but the device code was supplied by a third party. Device code sign-ins are rare in most enterprises and stand out.
Successful OAuth consent granted to a newly registered, "testing mode," or unverified cloud application that requests sensitive mail or profile scopes.
Account sign-ins or token use originating from datacenter, VPS, or VPN networks rather than the user's usual location, often minutes after a phishing interaction.
A new device-linking event on a personal messaging application such as WhatsApp, prompted by an external page that first collected the user's phone number.
A non-browser process reading browser credential or cookie stores, followed by outbound connections to newly registered hosting infrastructure. This is the signature behavior of the VIDAR and Atomic infostealers deployed by these clusters.
Web or DNS requests to lookalike authentication domains that typosquat Microsoft Outlook Web Access, Microsoft 365, Google, and file-sharing brands, sometimes reached through captive-portal redirects on hotel or conference networks.

MITRE Enterprise ATT&CK Tactics and Techniques

The campaign maps across the kill chain from resource development through exfiltration:

Resource Development (T1583.001 – Acquire Infrastructure: Domains): The clusters register lookalike domains that spoof Microsoft, Google, and diplomatic brands to host phishing and credential-harvesting pages.
Resource Development (T1583.006 – Acquire Infrastructure: Web Services): Attacker-controlled Google Cloud projects in "testing mode" host OAuth consent screens used to capture authentication tokens.
Initial Access (T1566.001 – Phishing: Spearphishing Attachment): PDF lures with screenshots walk the target through creating an app-specific password with a name the attacker specifies.
Initial Access (T1566.002 – Phishing: Spearphishing Link): Emails carry links to spoofed event, file-sharing, and authentication pages that begin the credential or token theft flow.
Execution (T1204.001 – User Execution: Malicious Link): The compromise depends on the target clicking a link and completing a sign-in or device-linking step on a real provider page.
Execution (T1059.001 – Command and Scripting Interpreter: PowerShell): The CHERRYPIE PowerShell infostealer runs on Windows targets and contains artifacts suggesting it was generated with a large language model.
Defense Evasion (T1036.005 – Masquerading: Match Legitimate Name or Location): Domains and pages closely mimic Microsoft 365, Google Drive, and named diplomatic forums to appear trustworthy.
Defense Evasion (T1027 – Obfuscated Files or Information): Malware ships as obfuscated Go binaries, and phishing pages run JavaScript that blanks the page when an automated scanner or headless browser is detected.
Credential Access (T1528 – Steal Application Access Token): OAuth device code phishing and cloud-project consent flows hand the attacker an access token without needing the victim's password.
Credential Access (T1078.004 – Valid Accounts: Cloud Accounts): App-specific passwords and stolen tokens let the attacker log in as the victim while bypassing two-factor authentication.
Credential Access (T1555.003 – Credentials from Password Stores: Credentials from Web Browsers): VIDAR and Atomic harvest saved credentials, payment data, and cookies directly from browsers.
Collection (T1185 – Browser Session Hijacking): Stolen OAuth tokens and session cookies give the attacker an authenticated session that survives the original login.
Collection (T1123 – Audio Capture): After a fake WhatsApp call is accepted, malicious JavaScript uses the browser media APIs to record audio and video and upload it to the attacker.
Exfiltration (T1041 – Exfiltration Over C2 Channel): Infostealers send harvested browser data to command-and-control servers, in the case of VIDAR in plaintext.

Controls' Observables

Identity & Access Controls

Because the tradecraft targets authentication itself, identity logs carry the highest-value signals.

Device code authentication: Sign-ins that use the device code grant, especially for interactive user mailboxes that have no operational reason to use it.
- Related MITRE Techniques: T1528, T1078.004
- Detection Difficulty: LOW
Consent to unverified applications: OAuth consent or permission grants to newly registered, testing-mode, or publisher-unverified apps requesting mail or profile scopes.
- Related MITRE Techniques: T1528, T1583.006
- Detection Difficulty: MEDIUM
App-specific password creation: Creation or use of an app password on accounts that should rely on phishing-resistant multi-factor authentication.
- Related MITRE Techniques: T1078.004
- Detection Difficulty: MEDIUM
Impossible or hosting-based sign-ins: Successful authentication from datacenter or VPN address space that the user has never logged in from, shortly after an email interaction.
- Related MITRE Techniques: T1078.004, T1185
- Detection Difficulty: MEDIUM

Network Controls

Network telemetry surfaces the lookalike infrastructure that fronts the phishing and infostealer operations.

Lookalike authentication domains: DNS or proxy requests to typosquats of Microsoft 365, Outlook Web Access, Google, and file-sharing brands.
- Related MITRE Techniques: T1583.001, T1036.005
- Detection Difficulty: MEDIUM
Captive-portal redirects: Sign-in prompts served after connecting to hotel or conference networks that redirect to non-provider domains.
- Related MITRE Techniques: T1566.002, T1036.005
- Detection Difficulty: HIGH
Infostealer C2 egress: Outbound connections to newly registered hosting infrastructure on commercial VPS and VPN providers.
- Related MITRE Techniques: T1041
- Detection Difficulty: MEDIUM

Endpoint Controls

On the two clusters that deploy malware, endpoint telemetry captures the credential-theft stage.

Browser credential and cookie access: A non-browser process opening browser profile files such as saved logins or cookies.
- Related MITRE Techniques: T1555.003, T1185
- Detection Difficulty: MEDIUM
Obfuscated Go and PowerShell payloads: Execution of freshly written, obfuscated Go binaries or PowerShell that immediately reaches out to external infrastructure.
- Related MITRE Techniques: T1027, T1059.001
- Detection Difficulty: MEDIUM

Cloud & SaaS Controls

Cloud audit data links the phishing flow to post-compromise account abuse.

New OAuth grants and mailbox rules: Token grants to attacker applications, followed by inbox forwarding rules or delegate permissions that support persistence.
- Related MITRE Techniques: T1528, T1078.004
- Detection Difficulty: MEDIUM
Testing-mode cloud projects: Creation of cloud projects and OAuth consent screens requesting sensitive scopes that are never promoted out of testing.
- Related MITRE Techniques: T1583.006
- Detection Difficulty: HIGH

Insights and Recommendation

Organizations whose people fall victim to these clusters face silent takeover of personal email and messaging accounts, theft of sensitive research and diplomatic correspondence, and exposure of defense and aerospace information. Because the attacker holds a valid token or app password, the access persists through password resets and can be used to impersonate the victim against colleagues and partners. The audio and video capture built into the WhatsApp lure adds a surveillance dimension that reaches beyond stored data into live conversations.

As of 2026-09-07, AlienVault OTX catalogs this campaign's indicators, including the VIDAR command-and-control IP 107.189.18.7 and the UNC5976 Google Drive spoofing domain verify-drive.com, across multiple public pulses tied to the GTIG report. AbuseIPDB shows the VIDAR and Atomic control IPs (107.189.18.7 and 196.251.107.171) carrying zero abuse reports on the same date, hosted on commercial VPS and VPN space (Cloudzy/RouterHosting and PureVPN). Reputation feeds alone will not flag this infrastructure, which is precisely why behavioral hunting matters here.

Security teams should disable app-specific passwords and enforce phishing-resistant multi-factor authentication such as security keys or passkeys, and enroll high-risk staff in an advanced protection program that blocks app-password creation. Restrict user consent so that only administrators can approve applications, and alert on consent to newly registered or unverified apps requesting mail scopes (T1528). Treat device code authentication as high-signal: most enterprises can alert on every device code sign-in with a very low false-positive rate. Audit linked devices on messaging applications, enable registration locks, and validate unexpected contacts out of band. On the endpoint, hunt for non-browser processes touching browser credential stores and beaconing to newly registered infrastructure (T1555.003, T1041), and monitor DNS for the lookalike authentication domains that front these operations.

Source and Credits

This summary is based on Google Threat Intelligence Group's research article "Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia" by Gabby Roncone and Wesley Shields, published on August 20, 2026.

Live-status corroboration for selected indicators was provided by Darknet CTI corroboration (Focused Hunts), drawing on AlienVault OTX and AbuseIPDB as checked on 2026-09-07. This is a secondary source used only to confirm current infrastructure status and public cataloging; all threat behavior and attribution derive from the GTIG report.

Threat Hunting IOCs & Queries

The clusters rotate infrastructure quickly, so treat the indicators below as seeds and rely on the behavioral queries for durable detection. The authoritative and complete indicator set, including all file hashes, is published in the GTIG report and its linked VirusTotal Collection.

Known Indicators of Compromise

Domains (UNC6293): dosportal.app, foreignrelations.us (OAuth phishing; cataloged across multiple AlienVault OTX pulses tied to this report, as of 2026-09-07)
Domains (UNC7005): owa-ms365.com, m365-owa.com, ms365-device.com, ms365-live.com, my-invite.org, globsec.net, wa-connect.eu, wa-connect.net, foc-share.com, share-foc.com, statistic-ms.live (ENGINELIGHT C2)
Domains (UNC5976): verify-drive.com, drive.google.verify-drive.com (Google Drive spoofing OAuth phishing; corroborated in AlienVault OTX and independent Validin infrastructure research, as of 2026-09-07), mail.kiis.co.uk (malware distribution)
IP Addresses: 107.189.18.7 (VIDAR C2; AbuseIPDB 0 reports, hosted on Cloudzy/RouterHosting, as of 2026-09-07), 196.251.107.171 (Atomic/AtomicStealer C2; AbuseIPDB 0 reports, hosted on PureVPN, as of 2026-09-07), 104.194.159.150 (shared resolver linking ms365-live.com and my-invite.org; AbuseIPDB 0 reports, Cloudzy/RouterHosting, as of 2026-09-07)
File Hashes (SHA256, representative per family, as published in the GTIG report):
- 1d9299799a7b8da67c44ebec064d64542c27645f8e84de4a22ca3f6cbc843e3c (VIDAR, Windows)
- c5826032207d623a7f6caec8465af7364eccc355f9a48897da2a54f3e4420265 (Atomic/AtomicStealer, macOS)
- 125752ad7c20d715920a3b2fb0fdde660f07b3f2b053665cf38c2d6d9de86e1e (ENGINELIGHT, Go)
- 403b624e35777cbc07dbe66398b21bba70396a20b859c880732338ce1dd1f41f (CHERRYPIE PowerShell infostealer)
- 2c7f4165967d6f7737b3fef87959846920b57a5368b531ad1427c7214d4c41a2 (HEADRUSH, UNC5976)
Attacker email addresses: chikolimdrid@gmail.com, keyereaonkendrick4@gmail.com, bounce@chamber-ua.org

Notes: Indicators are current as of the GTIG report (August 20, 2026). Live-status annotations reflect AlienVault OTX and AbuseIPDB corroboration on 2026-09-07, a secondary source distinct from the cited report. The command-and-control IPs carrying zero abuse reports on clean commercial hosting underscore why behavioral detection outperforms reputation matching for this activity.

Device Code Authentication Sign-Ins

Behavior Targeted: Detects OAuth device code authentications, the flow abused to phish access tokens for Microsoft accounts without capturing a password.
MITRE ATT&CK: T1528, T1078.004
Expected Results: Interactive user accounts completing device code sign-ins, especially clustered by app or source IP shortly after a phishing email.
False Positive Likelihood: LOW
Tuning Guidance: Allowlist known device code use (smart displays, CLI and IoT enrollment); focus first on human mailboxes and on device codes redeemed from hosting or foreign IP space.

Splunk SPL Query

index=azure sourcetype="azure:aad:signin" authenticationProtocol="deviceCode"
    earliest=-30d
| stats count AS signins values(appDisplayName) AS apps values(ipAddress) AS src_ips
    min(_time) AS first_seen max(_time) AS last_seen by userPrincipalName
| sort - signins
| convert ctime(first_seen) ctime(last_seen)

// TUNING: Restrict to interactive user accounts; exclude service/device enrollment identities
// TUNING: Enrich src_ips against hosting/VPN ASN lists to prioritize non-residential redemptions
// FALSE POSITIVES: Legitimate device code use by smart TVs, CLI tools, and IoT onboarding

Microsoft KQL Query (Defender/Sentinel)

SigninLogs
| where TimeGenerated > ago(30d)
| where AuthenticationProtocol =~ "deviceCode"
| summarize SignIns = count(), Apps = make_set(AppDisplayName),
    SourceIPs = make_set(IPAddress), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by UserPrincipalName
| order by SignIns desc

// TUNING: Allowlist accounts and apps with a known device code use case
// TUNING: Join SourceIPs to a hosting/VPN ASN watchlist to surface non-residential redemptions
// FALSE POSITIVES: Genuine device code enrollment on TVs, CLI, and IoT devices

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

OAuth Consent to Unverified or Newly Registered Applications

Behavior Targeted: Detects users granting OAuth consent or permission to applications that are newly registered, in testing mode, or publisher-unverified, the mechanism used to capture tokens through attacker cloud projects.
MITRE ATT&CK: T1528, T1583.006
Expected Results: Consent events for unfamiliar applications requesting mail, profile, or offline-access scopes.
False Positive Likelihood: MEDIUM
Tuning Guidance: Maintain an allowlist of sanctioned application IDs; prioritize consent to apps first seen in the last 30 days and to any app requesting sensitive mailbox scopes.

Splunk SPL Query

index=azure sourcetype="azure:aad:audit"
    (operationName="Consent to application" OR operationName="Add OAuth2PermissionGrant"
     OR operationName="Add delegated permission grant")
    earliest=-30d
| rename properties.targetResources{}.displayName AS target_app,
    initiatedBy.user.userPrincipalName AS initiator
| stats count values(target_app) AS apps by initiator, result
| sort - count

// TUNING: Allowlist sanctioned enterprise application IDs before alerting
// TUNING: Cross-reference target_app registration date; flag apps newer than 30 days
// FALSE POSITIVES: Legitimate onboarding of new SaaS tools by end users

Microsoft KQL Query (Defender/Sentinel)

AuditLogs
| where TimeGenerated > ago(30d)
| where OperationName in ("Consent to application", "Add OAuth2PermissionGrant",
    "Add delegated permission grant")
| extend TargetApp = tostring(TargetResources[0].displayName)
| extend Initiator = tostring(InitiatedBy.user.userPrincipalName)
| project TimeGenerated, OperationName, Initiator, TargetApp, Result
| order by TimeGenerated desc

// TUNING: Allowlist approved AppIds; alert on consent to apps registered within 30 days
// TUNING: Prioritize grants that include Mail.Read, Mail.Send, or offline_access scopes
// FALSE POSITIVES: Sanctioned self-service app onboarding

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

Successful Sign-In From Hosting or VPN Infrastructure

Behavior Targeted: Detects successful authentications from datacenter, VPS, or VPN address space that the user has not previously used, the pattern seen when an attacker redeems a stolen token or app password.
MITRE ATT&CK: T1078.004, T1185
Expected Results: Successful sign-ins from hosting ASNs or from the campaign's known control IPs, often minutes after a phishing interaction.
False Positive Likelihood: MEDIUM
Tuning Guidance: Baseline each user's normal ASNs; seed the IP list with the campaign indicators and extend it with your own hosting and VPN ASN watchlist.

Splunk SPL Query

index=azure sourcetype="azure:aad:signin" (status.errorCode=0 OR resultType=0)
    earliest=-30d
| eval known_ioc=if(ipAddress IN ("107.189.18.7","104.194.159.150","196.251.107.171"), "yes", "no")
| stats count values(ipAddress) AS src_ips values(appDisplayName) AS apps
    values(known_ioc) AS ioc_hit by userPrincipalName, autonomousSystemNumber
| where ioc_hit="yes" OR autonomousSystemNumber IN (53667)
| sort - count

// TUNING: Replace/extend the ASN list (e.g., 53667 Frantech/Cloudzy) with your hosting+VPN watchlist
// TUNING: Compare autonomousSystemNumber to each user's 90-day baseline of normal ASNs
// FALSE POSITIVES: Corporate VPN egress and legitimate cloud-hosted mail clients

Microsoft KQL Query (Defender/Sentinel)

SigninLogs
| where TimeGenerated > ago(30d)
| where ResultType == 0
| extend IoCHit = iff(IPAddress in ("107.189.18.7","104.194.159.150","196.251.107.171"), true, false)
| where IoCHit or AutonomousSystemNumber in (53667)
| summarize SignIns = count(), Apps = make_set(AppDisplayName),
    IPs = make_set(IPAddress), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by UserPrincipalName, AutonomousSystemNumber
| order by SignIns desc

// TUNING: Extend the ASN list with your own hosting/VPN watchlist; 53667 is Frantech/Cloudzy
// TUNING: Add an anti-join to each user's baseline ASN set to surface first-time hosting logins
// FALSE POSITIVES: Sanctioned VPNs and cloud-hosted mail access

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

Infostealer Credential Access and C2 Egress

Behavior Targeted: Detects a non-browser process reaching out to the campaign's control infrastructure, the endpoint footprint of the VIDAR, Atomic, and ENGINELIGHT infostealers.
MITRE ATT&CK: T1555.003, T1041
Expected Results: A recently written binary or script initiating outbound connections to hosting infrastructure and, on the same host, touching browser credential files.
False Positive Likelihood: LOW for indicator matches; MEDIUM for the behavioral variant.
Tuning Guidance: Replace the seed IP list with your newly registered infrastructure watchlist, and pivot on processes that open browser credential stores such as saved logins or cookies.

Splunk SPL Query

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
    earliest=-30d
    NOT (Image IN ("*\\chrome.exe","*\\msedge.exe","*\\firefox.exe","*\\brave.exe"))
| eval known_ioc=if(DestinationIp IN ("107.189.18.7","104.194.159.150","196.251.107.171"), "yes", "no")
| search known_ioc="yes" OR DestinationHostname="statistic-ms.live"
| stats count values(DestinationIp) AS dst_ips values(DestinationHostname) AS dst_hosts
    by Computer, User, Image
| sort - count

// TUNING: Swap the seed IPs/host for your newly-registered-infra watchlist
// TUNING: Correlate with Sysmon Event 11 for the same Image writing/reading browser profile files
// FALSE POSITIVES: Low for direct IOC hits; validate any non-browser process beaconing to hosting IPs

Microsoft KQL Query (Defender/Sentinel)

DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteIPType == "Public"
| where InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe","brave.exe")
| where RemoteIP in ("107.189.18.7","104.194.159.150","196.251.107.171")
    or RemoteUrl has "statistic-ms.live"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath,
    RemoteIP, RemoteUrl, InitiatingProcessCommandLine
| order by Timestamp desc

// TUNING: Replace the RemoteIP seed list with your newly-registered-infra watchlist
// TUNING: Join DeviceFileEvents for the same DeviceName touching "Login Data" or "Cookies"
// FALSE POSITIVES: Low for IOC matches; investigate any non-browser process reaching hosting IPs

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

Lookalike Authentication Domains in DNS and Proxy Logs

Behavior Targeted: Detects requests to domains that typosquat Microsoft, Google, and file-sharing brands, the front end for the credential and token phishing pages.
MITRE ATT&CK: T1583.001, T1036.005
Expected Results: DNS or proxy hits to spoofed authentication domains, sometimes following a captive-portal redirect on a travel network.
False Positive Likelihood: MEDIUM
Tuning Guidance: Expand the pattern set as GTIG and partners publish new domains; confirm matches against your list of sanctioned Microsoft and Google domains before alerting.

Splunk SPL Query

index=network sourcetype="stream:dns"
    earliest=-30d
| regex query="(?i)(owa-ms365|m365-owa|ms365-(device|live)|wa-(connect|invite|device|meeting)|foc-share|share-foc|internal-share|verify-drive|finishoperations|globsec\.net|my-invite)"
| stats count values(src_ip) AS clients min(_time) AS first_seen max(_time) AS last_seen by query
| sort - count
| convert ctime(first_seen) ctime(last_seen)

// TUNING: Extend the regex as new lookalike domains are published by GTIG and partners
// TUNING: Validate against an allowlist of legitimate Microsoft/Google auth domains
// FALSE POSITIVES: Benign domains that coincidentally match a brand token; review before blocking

Microsoft KQL Query (Defender/Sentinel)

DeviceNetworkEvents
| where Timestamp > ago(30d)
| where isnotempty(RemoteUrl)
| where RemoteUrl matches regex @"(?i)(owa-ms365|m365-owa|ms365-(device|live)|wa-(connect|invite|device|meeting)|foc-share|share-foc|internal-share|verify-drive|finishoperations|globsec\.net|my-invite)"
| summarize Count = count(), Devices = make_set(DeviceName),
    FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by RemoteUrl
| order by Count desc

// TUNING: Grow the regex alternation as new campaign domains are published
// TUNING: Suppress matches that resolve to sanctioned Microsoft/Google infrastructure
// FALSE POSITIVES: Legitimate domains that share a brand token; verify before blocking

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

Back to Hunting off the Red