Russian Clusters Abuse OAuth, WhatsApp in Espionage

Google Threat Intelligence Group tracks three suspected Russian espionage clusters, UNC6293, UNC5976, and UNC7005, abusing legitimate authentication flows to target academia, aerospace, defense, government, and think tank personnel across Europe and the U.S. UNC7005 spoofed WhatsApp to link accounts to attacker devices, while UNC5976 used OAuth phishing and the HEADRUSH malware.