DEV Community

Anoymask
Anoymask

Posted on

Three Russian-Linked Clusters Abuse Legitimate Authentication Flows

#security #threatintel

1. Basic Information

  • Article Title: Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia
  • Publisher: Google Threat Intelligence Group
  • Publication Date: 2026-08-20
  • Update Date: None
  • Severity: high
  • Original Source: Google Threat Intelligence Group
  • Related Sources: None
  • Related Entities:
  • malware: VIDAR, ATOMIC, ENGINELIGHT, CHERRYPIE, HEADRUSH
  • groups: UNC6293, UNC7005, UNC5976, ICE RELIC (APT29)
  • cves: None
  • products: Google OAuth, WhatsApp, Google Cloud, Microsoft 365

2. Executive Summary

Attackers use fake login pages, but they also trick users into completing legitimate actions. These actions include app passwords, OAuth, and WhatsApp device linking. This lets attackers steal credentials and user sessions.

3. Attack Flows

1. UNC6293: App Passwords / OAuth

  1. Attackers contact targets while posing as diplomats or other contacts.
  2. They trick the target into creating a legitimate app password or completing an external OAuth login.
  3. They make the target share the generated value, confirmation code, or full redirect URL with the attacker.
  4. The attacker accesses the account using this legitimate authentication flow.

2. UNC7005: WhatsApp Device Linking and Further Compromise

  1. Attackers lure targets to a page that looks like a secure call, chat, or document-sharing tool.
  2. They use the entered phone number to start a legitimate device linking request and show a QR code or linking code.
  3. When the user approves it, the attacker's device connects to the WhatsApp account.
  4. If the user selects a fake call option, the site asks for browser camera and microphone permissions and sends the recorded data to the attacker's API.
  5. In another path, they deliver VIDAR to Windows and ATOMIC to macOS.

3. UNC5976: OAuth Token Theft

  1. Attackers lure targets to a domain that looks like a file-sharing service.
  2. The user completes a legitimate Google OAuth login.
  3. The user is redirected to a malicious script on Google Cloud, which steals the authentication token from the URL.
  4. In another path, the HEADRUSH Excel plug-in leads to an HTA downloader.

4. Attacker Infrastructure and Execution Location

  • Phishing sites and cloud projects controlled by attackers
  • Outside the legitimate OAuth, app password, or WhatsApp device-linking flows
  • After the compromise, attackers connect to legitimate services using residential proxies or dedicated infrastructure

5. Visibility for Victims and Administrators

Victims

  • The login, QR code, and confirmation code look real and legitimate.
  • Messages come from people they know, or pretend to be diplomatic events or file-sharing notices.
  • The WhatsApp path asks for camera and microphone permissions or software installation.

Administrators and SOCs

  • Appears as new app password creation, OAuth consent, or a new WhatsApp linked device.
  • Looks like a login from legitimate cloud redirects or residential proxies.
  • If users use personal accounts, the activity may not leave logs in corporate systems.

6. Success and Failure Conditions

Success Conditions

  • The target gives the attacker an app password, confirmation code, or full redirect URL.
  • The target approves the WhatsApp device linking.
  • The OAuth token reaches the attacker-controlled script.
  • In the malware path, the user runs the downloaded application.

Failure Conditions

  • App passwords are blocked or revoked.
  • Anti-phishing MFA and advanced protection are enabled.
  • The user verifies the request with the real event organizer through another channel and stops the connection or consent.
  • Regular audits of WhatsApp linked devices remove unauthorized devices.

7. What Happens Upon Success

  • Unauthorized access to email, cloud, and WhatsApp sessions
  • Theft of browser credentials, cookies, and payment information
  • Collection of audio and video recordings
  • Further phishing, data collection, and malware execution

8. Observable Logs

Email

  • Senders and reply-to addresses disguised as diplomatic events, shared documents, or government agencies
  • Email bodies containing a mix of legitimate links and attacker domains

Proxy / SWG / DNS

  • Connections to domains such as dosportal.app, foreignrelations.us, wa-connect.eu, and drive.google.verify-drive.com
  • Multiple redirects from legitimate OAuth to new cloud projects

Endpoint / EDR

  • Execution traces of Summit Companion App, VIDAR, ATOMIC, ENGINELIGHT, CHERRYPIE, and HEADRUSH
  • Browser behavior that accesses the camera and microphone and sends WebM files

Identity / IdP

  • Creation of a new app password followed immediately by abnormal logins
  • Access from unknown IP addresses or residential proxies right after OAuth authorization
  • Logins from unusual devices, locations, or clients

SaaS / Cloud

  • Addition of a new WhatsApp linked device
  • Cloud projects that receive stolen Google OAuth tokens
  • Lack of corporate logs when personal accounts are used

Network

  • Post-authentication traffic coming from residential proxies or dedicated infrastructure
  • Recording upload destinations such as /api/code/<session>/recording

9. Determining Attack Success

  • Attack Attempt Observed (Success Unconfirmed): Only contact with the phishing message or target domain. No authentication actions or device linking seen yet.
  • User Action Confirmed: User created an app password, gave OAuth consent, scanned a QR code, or allowed camera and microphone access.
  • Malware Execution or Successful Auth Confirmed: Successful login from an attacker IP, a new unknown WhatsApp linked device added, or VIDAR/malware execution confirmed.
  • Data Theft or Session Compromise Confirmed: Tokens, recordings, or browser info sent to the attacker, or unauthorized viewing/actions seen in a compromised session.

10. Investigation Playbook

Trigger

  • New app password creation, OAuth consent, or new WhatsApp linked device
  • Access to listed IOCs or malware detection

Initial Checks

  • Put receiving paths, URL redirects, and user actions in chronological order
  • Check if corporate or personal accounts were used

Endpoints

  • Preserve browser history, downloads, and camera/microphone usage logs
  • Search for VIDAR, ATOMIC, ENGINELIGHT, CHERRYPIE, and HEADRUSH

Authentication and Cloud

  • Check app passwords, OAuth grants, sessions, and recovery info
  • Revoke all sessions and remove suspicious connections

Subsequent Actions

  • Check email reading, forwarding rules, shared files, and sent messages
  • Search for other colleagues who received the same lure

Containment

  • Revoke app passwords and tokens
  • Remove WhatsApp linked devices
  • Isolate compromised devices and change credentials

Incident Categorization

  • Contact only
  • User action performed
  • Authentication or device linking successful
  • Data or session compromise confirmed

11. Defense and Detection Ideas

Single Events

  • Creation of a new app password
  • Addition of an unknown WhatsApp linked device
  • Connection to listed IOCs

Timeline Correlation

  • Lure email -> OAuth consent -> Login from residential proxy
  • Linking code displayed -> Device added -> Recording API traffic sent

Threat Hunting Perspective

  • Check personal and corporate accounts for suspicious authentication helper methods
  • Search for new OAuth apps and immediate logins following them

Log Gaps

  • Audit logs for personal accounts and WhatsApp
  • Browser camera and microphone usage history

Priority Countermeasures

  • Disable app passwords
  • Implement anti-phishing MFA
  • Regularly audit linked devices and OAuth consents

12. Facts / Inference / Hypothesis

Facts

  • GTIG tracks UNC6293, UNC7005, and UNC5976 as distinct Russian-linked clusters.
  • UNC7005 uses legitimate WhatsApp device linking and fake call code to record audio and video.
  • UNC5976 uses cloud scripts to steal tokens from URLs after legitimate OAuth logins.
  • GTIG links UNC6293 and UNC7005 to the ICE RELIC initial access unit with medium confidence.

Inference

  • Because legitimate authentication flows themselves are used as the attack path, blocking phishing domains is not enough.
  • When organizations use personal accounts for business communication, SOCs may easily miss compromises.

Hypothesis

  • Correlating OAuth consent with immediate residential proxy logins can help detect attacks earlier than looking at single events alone.

13. MITRE ATT&CK Mapping

  • T1566.002 Phishing: Spearphishing Link (Confidence: high)
  • T1528 Steal Application Access Token (Confidence: high)
  • T1098.005 Account Manipulation: Device Registration (Confidence: medium) — Mapped to adding WhatsApp linked devices.
  • T1550.001 Use Alternate Authentication Material: Application Access Token (Confidence: high)
  • T1539 Steal Web Session Cookie (Confidence: medium)
  • T1204.002 User Execution: Malicious File (Confidence: high)

14. Unknowns and Further Investigation

  • Number of successful compromises for each cluster
  • Complete infection chain for UNC5976 HEADRUSH
  • Exact scope of data stolen from individual victims

15. Impact on SOCs and Organizations

This affects not only diplomatic, defense, and research organizations, but also any enterprise where remote offices, overseas branches, or executives use personal Google or WhatsApp accounts for business communication. Security teams must include OAuth consents, app passwords, and messaging linked devices in their audit scope, beyond standard IdP logs.

16. Summaries by Role

For SOCs

Correlate new app password creation, OAuth consents, and new linked devices with subsequent logins.

For Administrators

Disable app passwords, enforce anti-phishing MFA, and apply strict OAuth consent controls.

For Users

Even if a screen looks real, if someone asks you for a code, a full URL, or QR approval, verify it through another communication channel.

Top comments (0)