CampaignPublished 18 Jun 2025Updated 18 Jul 2025

What's in an ASP? Creative Phishing Attack on Prominent Academics and Critics of Russia

Source AlienVault OTX General

Description

A Russia state-sponsored cyber threat actor impersonated the U.S. Department of State to target prominent academics and critics of Russia. The attackers used extensive rapport building and tailored lures to convince targets to set up application specific passwords (ASPs). Once obtained, these ASPs allowed persistent access to victims' mailboxes. Two distinct campaigns were observed, both using residential proxies and VPS servers for access. The attackers sent phishing emails disguised as meeting invitations, including spoofed Department of State email addresses to increase legitimacy. Victims were directed to create ASPs with specific names, which the attackers then used to access their email accounts. This activity is tracked as UNC6293 and is assessed with low confidence to be associated with APT29 / ICECAP.

Impact

For European organizations, especially academic institutions, think tanks, human rights organizations, and government bodies, this campaign poses a significant espionage risk. The targeted individuals—academics and critics of Russia—are often based in or collaborate with European entities, making these organizations potential indirect victims or secondary targets. Compromise of email accounts via ASP abuse enables attackers to maintain long-term, stealthy access to sensitive communications, intellectual property, and strategic discussions. This can lead to unauthorized data exfiltration, manipulation of communications, and potential reputational damage. The persistent access granted by ASPs circumvents many standard detection mechanisms, increasing the risk of prolonged undetected espionage. Additionally, the use of spoofed U.S. Department of State emails may cause confusion and mistrust in official communications, potentially disrupting diplomatic or academic collaborations. The campaign’s focus on tailored social engineering means that European organizations with prominent Russia-related research or policy roles are at elevated risk. While the campaign does not directly target European infrastructure or systems, the human targets within Europe are critical nodes in the information ecosystem, and their compromise could have cascading effects on European policy, research integrity, and security.

Defensive guidance

1. Implement strict monitoring and auditing of Application Specific Passwords (ASPs) usage within organizational email systems, including alerts for newly created ASPs and unusual naming conventions. 2. Educate high-risk personnel, especially academics and policy experts, about the specific phishing tactics used in this campaign, emphasizing skepticism of unsolicited meeting invitations and requests to create ASPs. 3. Enforce multi-factor authentication (MFA) methods that do not rely solely on ASPs, or restrict the use of ASPs where possible, favoring modern OAuth tokens or app-based authentication. 4. Deploy advanced email security solutions that can detect and block spoofed emails, including DMARC, DKIM, and SPF enforcement, combined with anomaly detection for sender behavior. 5. Conduct regular threat hunting focused on detecting persistent access via ASPs, including reviewing mailbox access logs for unusual IP addresses or proxy usage. 6. Collaborate with national cybersecurity centers and intelligence-sharing platforms to receive timely indicators of compromise related to UNC6293 and APT29. 7. Encourage the use of secure communication platforms for sensitive discussions, reducing reliance on email accounts vulnerable to such phishing. 8. Implement endpoint detection and response (EDR) tools that can identify lateral movement or data exfiltration attempts following mailbox compromise. These measures go beyond generic advice by focusing on the unique ASP abuse vector and the social engineering nuances of this campaign.

Indicators of compromise

IP addresses 1

91.190.191.117

Hashes 1

329fda9939930e504f47d30834d769b30ebeaced7d73f3c1aadd0e48320d6b39

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 19 Jun 2025, 19:32 UTC

MITRE ATT&CK techniques9 from threat tags

Technical details

Indicators of compromise

IP addresses 1

Hashes 1

Community reviews

Related threats