Inhospitable: Tracking Russian Cyber Espionage Infrastructure

Multiple Russian cyber espionage clusters (UNC6293, UNC7005, UNC5976) have been observed targeting individuals in academia, think tanks, and organizations across Europe and the US. These clusters employ phishing techniques such as OAuth phishing, Microsoft device code phishing, and WhatsApp targeting. UNC6293 utilized lure domains impersonating entities like the Council on Foreign Relations and government portals, potentially leveraging Evilginx for man-in-the-middle attacks. UNC7005 operated with lower sophistication and poor operational security, using domains like my-invite[.]org for phishing. UNC5976 used Google Drive impersonation domains for OAuth phishing. The analysis used historical DNS data, CSS hash similarities, favicon analysis, registration patterns, and certificate information to track and identify additional malicious infrastructure and domains.

The threat clusters enable credential harvesting and unauthorized access to targeted individuals' accounts through sophisticated phishing campaigns. This compromises sensitive information within academia, think tanks, and organizations in Europe and the United States. The use of OAuth phishing and device code phishing techniques increases the risk of account takeover and espionage activities. The infrastructure supports ongoing cyber espionage operations by Russian threat actors.

No specific patch or fix is applicable as this is an espionage infrastructure threat. Organizations should be aware of the phishing techniques described and implement targeted user awareness training focusing on OAuth and device code phishing. Monitoring for suspicious domains and indicators related to the identified clusters can aid detection. Employing multi-factor authentication and scrutinizing OAuth consent requests can reduce risk. Since this is infrastructure tracking and phishing-based, vendor or official fixes do not apply.