Russia

Gbhackers •Mayura Kathir • August 21, 2026

Three suspected Russian cyber espionage clusters abusing legitimate authentication mechanisms to hijack accounts belonging to academics, diplomats, defense personnel, government staff, and think-tank researchers across Europe and the United States. Rather than relying solely on credential-harvesting pages, the operators manipulate users into completing genuine app-password, OAuth, device-code, and device-linking workflows that can hand attackers authenticated […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Russian Cyber Espionage Clusters Exploit OAuth and Phishing Techniques Google's Threat Intelligence Group (GTIG) is tracking three Russian cyber espionage clusters—UNC6293, UNC7005, and UNC5976—targeting individuals in academia, defense, and government across Europe and the U.S. These groups exploit legitimate authentication workflows, such as OAuth and app password phishing, to compromise accounts. UNC6293 impersonates U.S. State Department officials, while UNC7005 and UNC5976 employ various social engineering tactics, including fake invitations and device linking. The attacks are highly selective, often targeting fewer than 100 individuals at a time, but they pose significant risks due to their sophisticated methods. GTIG has observed these operations since at least 2025, with ongoing adaptations to their phishing techniques. The current status indicates a persistent threat as these clusters continue to evolve their tactics. 10 sources 76

Extracted Entities

Russia

The full story

Extracted Entities

Attack Types (1)

Countries (2)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (3)