Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia
Google GTIG tracks three Russian espionage clusters abusing legitimate OAuth authentication flows to target individuals in defence, academia, and government—a technique that bypasses traditional perimeter controls.
Summary written by editorial AI · Source link below
Written by: Gabby Roncone, Wesley Shields Overview Google Threat Intelligence Group (GTIG) is tracking three distinct suspected Russian cyber espionage threat clusters abusing legitimate authentication flows to target individuals working in academia, aerospace and defense, governments and think tanks across Europe, as well as academia and think tanks within the United States. Examples of these techniques can be found in our previous blog on UNC6293’s phishing operations. We now track an addition
Editorial Analysis
OAuth flow abuse bypasses conventional email and endpoint defences entirely, shifting the battleground to identity-layer controls where many European organisations remain under-invested.
Audit OAuth and consent-grant configurations in Azure AD/Entra ID or Google Workspace, restrict token scopes, and deploy alerts for anomalous authentication-flow activity.
Russian espionage groups are abusing legitimate login flows to target defence and government personnel—identity-layer controls require immediate attention.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at Google Threat Intel in a new tab.
More from the Threat Intel Desk
- PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking1d
- BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot2d
- Trust Is Not What It Seems — And Fraudsters Are Counting on It3d
- AI Tools Are Generating Massive Attacks for Little Cost3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 43 (2026)3d