Inhospitable: Tracking Russian Cyber Espionage Infrastructure
This analysis examines infrastructure used by multiple Russian cyber espionage clusters targeting individuals in academia, think tanks, and organizations across Europe and the United States. The investigation expands on three threat clusters (UNC6293, UNC7005, and UNC5976) that employed OAuth phishing, Microsoft device code phishing, and WhatsApp targeting. UNC6293 utilized lure domains impersonating the Council on Foreign Relations and government portals, with possible Evilginx configurations. UNC7005 demonstrated lower sophistication with poor operational security, using domains like my-invite[.]org for phishing campaigns. UNC5976 employed Google Drive impersonation domains for OAuth phishing. The analysis leverages historical DNS data, CSS hash similarities, favicon analysis, registration patterns, and certificate information to identify additional infrastructure and tracking methods for discovering related malicious domains and IP addresses.
Indicators of Compromise
- ip: 185.158.250.155
- domain: ukrspecsystens.com
- domain: export.galmabuna.com
- domain: fileshareapp.org
- domain: sharefolders.org
- domain: formshare.cloud
- domain: drive.google.sharefolders.org
- domain: drive.google.formshare.cloud
- domain: usercontent.online
- domain: drive.google.usercontent.online
- domain: fllefolder.com
- domain: drive.google.linkfileshare.net
- ip: 138.226.240.37
- domain: linkfileshare.net
- domain: drive.worksplace.cloud
- domain: ms365-live.com
- domain: my-invite.org
- domain: statistic-ms.live
- domain: verify-drive.com
- domain: drive.google.verify-drive.com
- hash: 6971626bf83b92c4ceef538c8919ca17
- hash: c66f20f2e39eb2f6a0a4cdbe0d955e5f
- domain: 8291.ru
- domain: ad-g.org
- domain: antonov.live
- domain: bouw-bemiddeling.nl
- domain: eurcpa.org
- domain: forc.email
- domain: schoolclasssciencemath.me
- domain: sharedfolders.org
- domain: the-washington-ballet.com
- domain: account.securemail3d.ru
- domain: accounts.gsecure.space
- domain: cloud.3dsecurity.ru
- domain: cloud.mailsecure.ru
- domain: cloud.rsecure.ru
- domain: drive.google.anticens.xyz
- domain: drive.google.anticorruption.eurcpa.org
- domain: drive.google.sharedfolders.org
- domain: gdrive.gregc.online
- domain: login.antonov.live
- domain: login.intergroup.media
- domain: mail.baranbo.nl
- domain: mail2.spravedlivo.site
- domain: portal.owalogin.ru
- domain: portal.spravedlivo.site
- domain: www.010kerstbomen.nl
- domain: www.bouw-projecten.nl
- domain: www.hosting-backup.com
- domain: www.xn--80abhgqfmrcigxgke9b9f.xn--p1ai
Inhospitable: Tracking Russian Cyber Espionage Infrastructure
Description
This analysis examines infrastructure used by multiple Russian cyber espionage clusters targeting individuals in academia, think tanks, and organizations across Europe and the United States. The investigation expands on three threat clusters (UNC6293, UNC7005, and UNC5976) that employed OAuth phishing, Microsoft device code phishing, and WhatsApp targeting. UNC6293 utilized lure domains impersonating the Council on Foreign Relations and government portals, with possible Evilginx configurations. UNC7005 demonstrated lower sophistication with poor operational security, using domains like my-invite[.]org for phishing campaigns. UNC5976 employed Google Drive impersonation domains for OAuth phishing. The analysis leverages historical DNS data, CSS hash similarities, favicon analysis, registration patterns, and certificate information to identify additional infrastructure and tracking methods for discovering related malicious domains and IP addresses.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://www.validin.com/blog/inhospitable_russian_cyber_espionage_clusters/"]
- Adversary
- null
- Pulse Id
- 6a8f61a3ebc215465ad2ccff
- Threat Score
- null
Indicators of Compromise
Ip
| Value | Description | Copy |
|---|---|---|
ip185.158.250.155 | — | |
ip138.226.240.37 | — |
Domain
| Value | Description | Copy |
|---|---|---|
domainukrspecsystens.com | — | |
domainexport.galmabuna.com | — | |
domainfileshareapp.org | — | |
domainsharefolders.org | — | |
domainformshare.cloud | — | |
domaindrive.google.sharefolders.org | — | |
domaindrive.google.formshare.cloud | — | |
domainusercontent.online | — | |
domaindrive.google.usercontent.online | — | |
domainfllefolder.com | — | |
domaindrive.google.linkfileshare.net | — | |
domainlinkfileshare.net | — | |
domaindrive.worksplace.cloud | — | |
domainms365-live.com | — | |
domainmy-invite.org | — | |
domainstatistic-ms.live | — | |
domainverify-drive.com | — | |
domaindrive.google.verify-drive.com | — | |
domain8291.ru | — | |
domainad-g.org | — | |
domainantonov.live | — | |
domainbouw-bemiddeling.nl | — | |
domaineurcpa.org | — | |
domainforc.email | — | |
domainschoolclasssciencemath.me | — | |
domainsharedfolders.org | — | |
domainthe-washington-ballet.com | — | |
domainaccount.securemail3d.ru | — | |
domainaccounts.gsecure.space | — | |
domaincloud.3dsecurity.ru | — | |
domaincloud.mailsecure.ru | — | |
domaincloud.rsecure.ru | — | |
domaindrive.google.anticens.xyz | — | |
domaindrive.google.anticorruption.eurcpa.org | — | |
domaindrive.google.sharedfolders.org | — | |
domaingdrive.gregc.online | — | |
domainlogin.antonov.live | — | |
domainlogin.intergroup.media | — | |
domainmail.baranbo.nl | — | |
domainmail2.spravedlivo.site | — | |
domainportal.owalogin.ru | — | |
domainportal.spravedlivo.site | — | |
domainwww.010kerstbomen.nl | — | |
domainwww.bouw-projecten.nl | — | |
domainwww.hosting-backup.com | — | |
domainwww.xn--80abhgqfmrcigxgke9b9f.xn--p1ai | — |
Hash
| Value | Description | Copy |
|---|---|---|
hash6971626bf83b92c4ceef538c8919ca17 | — | |
hashc66f20f2e39eb2f6a0a4cdbe0d955e5f | — |
Threat ID: 6a90b51eacd9273b49c9fb6b
Added to database: 08/27/2026, 22:07:26 UTC
Last updated: 08/28/2026, 03:37:45 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.