Google Threat Intelligence Group: Distinct Clusters Target Individuals of Interest to Russia 27‑minute read

KUALA LUMPUR, 20 AUGUST 2026 —

Google’s Threat Intelligence Group identifies three new Russian cyber-espionage clusters abusing legitimate log-in flows to steal accounts from European and US universities, defence contractors and government agencies.

The clusters rely on phishing, OAuth manipulation and malware to compromise accounts, GTIG said in a technical report. UNC6293 has expanded its app-password phishing since mid-2025 and now also harvests verification codes via spoofed login pages, while UNC7005 has added malware-laced registration portals that record audio and video once victims link their WhatsApp accounts.

GTIG said the operations abuse legitimate authentication flows, making the initial compromise appear genuine to users. “Targets need to recognise social-engineering signals even when the web address appears genuine,” GTIG said.

GTIG assesses with moderate confidence that UNC6293, UNC7005 and UNC5976 are sub-groups of the long-running ICE RELIC operation (formerly tracked as APT29). UNC6293 is placed inside ICE RELIC’s initial-access cell, while UNC7005 is a less sophisticated but faster-moving offshoot first observed in February 2026.

UNC6293 uses slow, precise lures. GTIG first flagged the cluster in June 2025 after it sent PDFs instructing targets to create an app password called ms.state.gov, surrendering account access without two-factor authentication.

By October 2025 the lure shifted to a spoofed State Department portal requesting the password via an on-screen form, and by June 2026 UNC6293 added OAuth phishing, asking victims to paste a verification code after a legitimate login to an external provider—granting persistent mailbox access.

“Campaigns typically target fewer than five individuals at a time,” GTIG said. “Lures mimic diplomatic conferences or secure-file-sharing portals, themes that reappear across campaigns.”

UNC7005 uses hospitality-style redirects and malware. Identified in February 2026, the cluster uses captive-portal techniques similar to those reported by ReliaQuest and Microsoft, redirecting victims through hotel Wi-Fi login pages before presenting a fake conference registration. The portal fingerprints the visitor’s browser and operating system to evade automated scanners.

The group recycled a template from an embassy-invite operation in late April 2026 and reused it for a spoofed GLOBSEC security forum in May 2026, complete with an epicurean wine-selection section—a signature ICE RELIC flourish. Within days the actors changed the colour scheme and questions after GTIG published indicators, adding JavaScript to block automated analysis.

From May to June 2026 UNC7005 pivoted to WhatsApp-themed phishing. Victims who entered a phone number were shown a legitimate QR-code linking screen; once paired, JavaScript recorded audio and video during a fake “failed” call and exfiltrated the recording to a command-and-control server.

The third cluster, UNC5976, is the least technically developed and relies almost exclusively on OAuth credential-harvesting landing pages mimicking third-party cloud sign-ins. GTIG said it has been active since at least January 2026 and focuses on defence-industry contractors and think-tank analysts. Unlike UNC6293 and UNC7005, UNC5976 does not deploy malware.

GTIG assigns moderate confidence that all three clusters feed into ICE RELIC’s broader initial-access pipeline, citing overlapping targeting, shared malware families and re-use of ICE RELIC operational tradecraft such as epicurean-themed lures and device fingerprinting.

Malaysian organisations that exchange sensitive research or defence-related data with European or US counterparts should review OAuth consent screens, app-password policies and captive-portal login flows for anomalous requests, GTIG advised. The clusters’ preference for small, high-value targets means even a single compromised account can yield strategic intelligence.

Related: National Cyber Security Agency (NACSA) · Kuala Lumpur