Russian Espionage Groups Trick Targets Into Handing Over Account Access Through Legitimate Login Processes

Google Threat Intelligence Group (GTIG) is tracking three distinct suspected Russian cyber espionage clusters that abuse legitimate login and authentication processes to break into accounts. Their targets include people working in academia, aerospace and defence, governments and think tanks across Europe, as well as academia and think tanks in the United States. GTIG now tracks two additional clusters, UNC7005 and UNC5976, which use phishing, abuse of OAuth sign-in flows, and in some cases malware. UNC7005 is linked to hospitality captive portal redirects reported by Reliaquest and Microsoft.

Because these campaigns use real authentication steps, they may not look like phishing to the person being targeted. GTIG describes them as persistent and adaptive, using sophisticated social engineering to compromise personal accounts across multiple platforms. The group says it is raising awareness so targets can better recognise malicious outreach.

The third cluster, UNC6293, is assessed with moderate confidence to be a sub cluster of ICE RELIC (formerly APT29), responsible for initial access. It was first reported in June 2025 for app password phishing against prominent critics of Russia. App passwords let a less secure app or device access an account, and attackers who persuade a victim to create one can get in without needing two-factor authentication. In that campaign, the attackers impersonated the US State Department and used a PDF with screenshots to guide targets into setting an app password named ms.state.gov.