--- title: Distinct Clusters Target Individuals of Interest to Russia description: Google Threat Intelligence Group details three distinct suspected Russian cyber espionage clusters (UNC6293, UNC7005, UNC5976) abusing legitimate... canonical: https://daily.dev/posts/distinct-clusters-target-individuals-of-interest-to-russia-7rzgcceuv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Distinct Clusters Target Individuals of Interest to Russia | daily.dev og:description: Google Threat Intelligence Group details three distinct suspected Russian cyber espionage clusters (UNC6293, UNC7005, UNC5976) abusing legitimate... og:url: https://daily.dev/posts/distinct-clusters-target-individuals-of-interest-to-russia-7rzgcceuv og:image: https://api.daily.dev/og/posts/7rzGcCEuV.png og:image:alt: Distinct Clusters Target Individuals of Interest to Russia og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Distinct Clusters Target Individuals of Interest to Russia **[Google Cloud](https://daily.dev/sources/gcp)** · 22 min read · 0 upvotes · 0 comments ## Summary Google Threat Intelligence Group details three distinct suspected Russian cyber espionage clusters (UNC6293, UNC7005, UNC5976) abusing legitimate authentication flows like app-specific passwords, OAuth consent screens, and device code flows to compromise personal accounts of academics, diplomats, defense personnel, and Russia critics. UNC6293 (linked to ICE RELIC/APT29) impersonates the US State Department for app-password phishing. UNC7005 conducts app password, device code (Microsoft, WhatsApp), OAuth phishing via fake cloud projects, and distributes VIDAR and ATOMIC infostealers, and is tied to hospitality captive portal DNS redirect attacks previously reported by Reliaquest and Microsoft. UNC5976 focuses on OAuth token theft via fake file-sharing pages and a malicious Excel plugin (HEADRUSH). The post includes IOCs, malware samples, and remediation guidance including disabling app passwords and enabling Advanced Protection Program. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What malware does UNC7005 deliver through its fake Ukraine summit phishing page? UNC7005 serves VIDAR infostealer to Windows users and ATOMIC (AtomicStealer) to macOS users, both delivered as a fake 'Summit Companion App' download from a page spoofing a Ukraine-related resolution summit. The malware is selected based on the target's User Agent string. VIDAR was observed as an obfuscated Go binary communicating with C2 at 107.189.18.7, and both stealers target browser-stored credentials, payment data, cookies, and saved addresses. _daily.dev surfaces threat intel writeups like this so security teams can track evolving infostealer campaigns._ ### How does the UNC7005 hospitality captive portal attack work? UNC7005 infrastructure mimicking Microsoft authentication pages gets served to hotel and conference center guests through DNS-poisoned captive portal redirects, first reported by Reliaquest on July 23, 2026 and detailed by Microsoft as Midnight Blizzard activity on July 31, 2026. Victims connecting to hotel Wi-Fi are redirected to attacker-controlled login pages that either deliver malware or run device code phishing against Microsoft accounts. _Following captive portal and DNS abuse tactics on daily.dev helps teams harden travel network security._ ### What is app password phishing and how do attackers exploit it? App password phishing tricks a target into creating an application-specific password on their account, then convinces them to hand it over, letting the attacker bypass two-factor authentication entirely. UNC6293 impersonated the US State Department and lured victims into setting an app password named ms.state.gov via instructions in a PDF, later evolving to have victims enter it into a fake authentication form instead of emailing it back. _daily.dev helps security-minded developers stay ahead of authentication abuse techniques like app password phishing._ ## Similar posts on daily.dev - [An Investigation Into Years of Undetected Operations Targeting High-Value Sectors](https://daily.dev/posts/an-investigation-into-years-of-undetected-operations-targeting-high-value-sectors-y5ptdykz6) · Unit 42 · 0 upvotes · 0 comments - ['Several dozen' orgs targeted by a new extortion crew](https://daily.dev/posts/several-dozen-orgs-targeted-by-a-new-extortion-crew-hwkvov6ma) · The Register · 0 upvotes · 0 comments - [Google: New UNC6783 hackers steal corporate Zendesk support tickets](https://daily.dev/posts/google-new-unc6783-hackers-steal-corporate-zendesk-support-tickets-gepqft9l2) · BleepingComputer · 0 upvotes · 0 comments - [Inside Russia Credential-Based Intrusions & Cyber Risks](https://daily.dev/posts/inside-russia-credential-based-intrusions-cyber-risks-aolztcxcp) · Cyble · 0 upvotes · 0 comments --- Tags: [#malware](https://daily.dev/tags/malware), [#phishing](https://daily.dev/tags/phishing), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/distinct-clusters-target-individuals-of-interest-to-russia-7rzgcceuv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Distinct Clusters Target Individuals of Interest to Russia","url":"https://daily.dev/posts/distinct-clusters-target-individuals-of-interest-to-russia-7rzgcceuv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/distinct-clusters-target-individuals-of-interest-to-russia-7rzgcceuv"},"datePublished":"2026-08-20T14:02:21.813Z","dateModified":"2026-08-21T00:24:20.835Z","description":"Google Threat Intelligence Group details three distinct suspected Russian cyber espionage clusters (UNC6293, UNC7005, UNC5976) abusing legitimate...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/efb6ebdd31507ed6cdc6e0fe53ac3537?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/efb6ebdd31507ed6cdc6e0fe53ac3537?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Google Cloud","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Google Cloud","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/gcp","url":"https://daily.dev/sources/gcp"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/distinct-clusters-target-individuals-of-interest-to-russia-7rzgcceuv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"malware,phishing,oauth","timeRequired":"PT22M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Google Cloud","item":"https://daily.dev/sources/gcp"},{"@type":"ListItem","position":3,"name":"Distinct Clusters Target Individuals of Interest to Russia"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/distinct-clusters-target-individuals-of-interest-to-russia-7rzgcceuv#faq","mainEntity":[{"@type":"Question","name":"What malware does UNC7005 deliver through its fake Ukraine summit phishing page?","acceptedAnswer":{"@type":"Answer","text":"UNC7005 serves VIDAR infostealer to Windows users and ATOMIC (AtomicStealer) to macOS users, both delivered as a fake 'Summit Companion App' download from a page spoofing a Ukraine-related resolution summit. The malware is selected based on the target's User Agent string. VIDAR was observed as an obfuscated Go binary communicating with C2 at 107.189.18.7, and both stealers target browser-stored credentials, payment data, cookies, and saved addresses. daily.dev surfaces threat intel writeups like this so security teams can track evolving infostealer campaigns."}},{"@type":"Question","name":"How does the UNC7005 hospitality captive portal attack work?","acceptedAnswer":{"@type":"Answer","text":"UNC7005 infrastructure mimicking Microsoft authentication pages gets served to hotel and conference center guests through DNS-poisoned captive portal redirects, first reported by Reliaquest on July 23, 2026 and detailed by Microsoft as Midnight Blizzard activity on July 31, 2026. Victims connecting to hotel Wi-Fi are redirected to attacker-controlled login pages that either deliver malware or run device code phishing against Microsoft accounts. Following captive portal and DNS abuse tactics on daily.dev helps teams harden travel network security."}},{"@type":"Question","name":"What is app password phishing and how do attackers exploit it?","acceptedAnswer":{"@type":"Answer","text":"App password phishing tricks a target into creating an application-specific password on their account, then convinces them to hand it over, letting the attacker bypass two-factor authentication entirely. UNC6293 impersonated the US State Department and lured victims into setting an app password named ms.state.gov via instructions in a PDF, later evolving to have victims enter it into a fake authentication form instead of emailing it back. daily.dev helps security-minded developers stay ahead of authentication abuse techniques like app password phishing."}}]} ```