# Russian APT29-linked clusters (UNC6293, UNC7005) and UNC5976 — OAuth phishing, device-code phishing, and captive portal compromise targeting academia, defense, and government across Europe and the US

> Google Threat Intelligence Group tracks three distinct suspected Russian cyberespionage clusters — UNC6293, UNC7005, and UNC5976 — conducting targeted phishing campaigns against individuals in academia, aerospace, defense, government, and think tanks across Europe, Ukraine, and the US. UNC6293 and UNC7005 are linked to APT29 (Ice Relic / SVR) with moderate confidence, while UNC5976 is assessed as a distinct Russian intelligence service operation. The threat clusters abuse legitimate authentication flows — including OAuth token theft, application-specific password (ASP) phishing, device-code phishing, and WhatsApp device linking — and deliver commodity infostealers (VIDAR, ATOMIC/AMOS) and custom malware (CornFlake RAT, ChocoShell, ENGINELIGHT, HEADRUSH) via fake event registration pages, captive portal DNS poisoning at hotels and conference centers, and spoofed file-sharing portals.

- **Published:** 2026-08-21T00:00:00Z
- **Last reviewed:** 2026-08-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2091
- **ID:** TL-2026-2091
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** APT29 (Russia)
- **Detections:** 9 · **IOCs:** 43 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Since at least mid-2025, three suspected Russian state-sponsored threat clusters have been conducting targeted phishing operations against individuals of interest to the Kremlin across academia, aerospace, defense, government, think tanks, and NGOs in Europe, Ukraine, and the United States. The operations are characterized by increasing sophistication in the abuse of legitimate authentication flows, including OAuth token theft, application-specific password (ASP) phishing, device-code phishing, and WhatsApp device linking.

UNC6293 (moderate confidence: ICE RELIC/APT29 subcluster) operates small-scale campaigns targeting fewer than five individuals at a time, primarily critics of Russia. The cluster impersonates US State Department officials and has evolved from ASP phishing (June 2025) to OAuth phishing (June 2026), where victims are tricked into sharing verification codes from legitimate login sessions. Infrastructure includes phishing domains dosportal.app and foreignrelations.us, with commercial residential proxies used for post-compromise activity.

UNC7005 (also tracked as STORM-2945 by Microsoft; moderate confidence: ICE RELIC/APT29 subcluster) demonstrates the broadest and most technically diverse toolkit. First identified in February 2026, the cluster targets academia, diplomatic, and nonprofit personnel across Ukraine, Western Europe, and the US. Key TTPs include: (1) ASP phishing with target-unique app passwords; (2) Microsoft device-code phishing using spoofed event registration pages (GLOBSEC forum, embassy invites) with browser fingerprinting and headless browser detection for evasion; (3) WhatsApp device linking phishing (May-June 2026) where victims are lured into linking attacker-controlled devices and subsequently prompted to join fake voice calls that trigger malicious JavaScript recording audio/video via getUserMedia; (4) commodity infostealer delivery via MaaS (VIDAR for Windows, ATOMIC/AtomicStealer for macOS) distributed through spoofed summit companion app downloads; (5) OAuth phishing via cloud projects (August 2026) using domains spoofing the Finnish Operations Center (FOC); and (6) the CaptiveCrunch campaign (July 2026) — DNS poisoning of hotel and conference center captive portal Wi-Fi networks to redirect travelers to attacker-controlled infrastructure for adversary-in-the-middle credential theft and malware delivery.

UNC5976 (distinct suspected Russian intelligence service, not linked to ICE RELIC) targets military, aerospace, defense industrial base, and NGOs/think tanks primarily in Ukraine and Armenia. The cluster has been active since March 2026, conducting OAuth phishing via fake file-sharing websites that redirect victims through legitimate Google OAuth to attacker-controlled Google Cloud projects that harvest authentication tokens. UNC5976 also deploys HEADRUSH, a malicious Excel plugin that ultimately delivers an HTA downloader, distributed via a domain impersonating a Ukrainian research institute. The cluster has created at least 12 domains since March 2026 and is migrating away from Google infrastructure to other providers following Google's disruption efforts.

Microsoft's investigation of the CaptiveCrunch campaign revealed a sophisticated supply chain dimension: the compromises spanned multiple venues using common equipment and management systems, suggesting access to shared services within the captive portal ecosystem rather than isolated venue compromises. The campaign deployed CornFlake RAT (a full-featured Go-based Windows implant with ECDH P-256 encrypted C2, keylogging, audio/video surveillance, credential theft via ChromeKatz, and remote shell) and ChocoShell/CHERRYPIE (a PowerShell infostealer with AMSI bypass, UAC bypass chain, and CDP-based browser credential extraction that bypasses Chrome App-Bound Encryption). The ChocoShell script shows artifacts suggesting LLM-augmented development.

The campaigns are assessed by GTIG with high confidence as having a Russian nexus, based on targeting patterns, phishing themes, and shared operational techniques. The abuse of legitimate authentication features (OAuth, device code, app passwords) makes detection particularly challenging, as the authentication flows themselves are legitimate — only the resulting tokens are redirected to attacker infrastructure. Remediation recommendations include the use of Google's Advanced Protection Program (which blocks app password creation), disabling device-code authentication flows where not required, enforcing always-on full-tunnel VPN on corporate devices, and maintaining strict phishing-resistant MFA.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1078 Valid Accounts
- T1204.002 User Execution: Malicious File
- T1204.001 User Execution: Malicious Link
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1098.005 Account Manipulation: Device Registration
- T1543.003 Create or Modify System Process: Windows Service
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1548.002 Bypass User Account Control
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1497.001 System Checks
- T1528 Steal Application Access Token
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1539 Steal Web Session Cookie
- T1555.003 Credentials from Web Browsers
- T1056.001 Input Capture: Keylogging
- T1123 Audio Capture
- T1125 Video Capture
- T1119 Automated Collection
- T1071.001 Application Layer Protocol: Web Protocols
- T1573 Encrypted Channel
- T1534 Internal Spearphishing
- T1550.001 Use Alternate Authentication Material: Application Access Token

## Sources

- [Google Cloud Blog — Distinct clusters targeting individuals of interest to Russia](https://cloud.google.com/blog/topics/threat-intelligence/distinct-clusters-target-individuals-of-interest-to-russia)
- [Microsoft Security Blog — CaptiveCrunch: Midnight Blizzard targets travelers worldwide](https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/)
- [ReliaQuest — DNS Poisoning Tactics Expand to Hospitality Wi-Fi](https://reliaquest.com/blog/threat-spotlight-dns-poisoning-tactics-expand-to-hospitality/)
- [Citizen Lab — Same Sea, New Phish: Russian Government-Linked Social Engineering Targets App-Specific Passwords](https://citizenlab.ca/research/russian-government-linked-social-engineering-targets-app-specific-passwords/)
- [Google Threat Intelligence — What's in an ASP? Creative phishing targets academics and critics of Russia](https://cloud.google.com/blog/topics/threat-intelligence/creative-phishing-academics-critics-of-russia)
- [The Register — Russian snoops add OAuth abuse to targeted phishing campaigns](https://www.theregister.com/security/2026/08/21/russian-snoops-add-oauth-abuse-to-targeted-phishing-campaigns/5290706)
- [The Hacker News — Suspected Russian Hackers Abuse Google, Microsoft OAuth in Targeted Phishing](https://thehackernews.com/2026/08/suspected-russian-hackers-abuse-google.html)
- [BleepingComputer — Russian hackers bypass Gmail MFA using stolen app passwords](https://www.bleepingcomputer.com/news/security/russian-hackers-bypass-gmail-mfa-using-stolen-app-passwords/)
- [BleepingComputer — Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts](https://www.bleepingcomputer.com/news/security/hackers-hijack-hotel-wi-fi-dns-to-steal-microsoft-365-accounts/)
- [SecurityWeek — Hacked Public Wi-Fi Gateways Used to Harvest Corporate Credentials](https://www.securityweek.com/hacked-public-wi-fi-gateways-used-to-harvest-corporate-credentials/)
- [SANS ISC — Atomic macOS Stealer (AMOS) Infection](https://isc.sans.edu/diary/33208)
- [Microsoft Security Blog — Hunting infostealers: macOS threats](https://techcommunity.microsoft.com/blog/microsoftsecurityexperts/hunting-infostealers---macos-threats/4494435)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2091