Russian Cyber Espionage Groups Target Academia and Government via OAuth Abuse

Google's Threat Intelligence Group is monitoring three suspected Russian cyber espionage clusters, including UNC6293, UNC7005, and UNC5976, which are targeting individuals in academia, aerospace, defense, and government sectors across Europe and the US. These groups are employing sophisticated phishing techniques that exploit legitimate OAuth authentication flows, making their attacks appear more credible. The campaigns have been ongoing since at least June 2025, with UNC6293 continuing to impersonate US State Department officials to lure victims into providing app passwords. Recent operations have adapted to include requests for verification codes after legitimate logins, further complicating detection. Each campaign typically targets fewer than 100 individuals, with under 10 confirmed victims. Google aims to raise awareness of these tactics to help potential victims recognize malicious outreach.

Key Points: • Three Russian cyber espionage groups are targeting academia and government sectors. • Phishing campaigns exploit OAuth flows, making them harder to detect. • UNC6293 has been active since June 2025, impersonating US State Department officials.