Russian Hackers Trick Academics and Diplomats Into Giving Them Access to Email and WhatsApp

Google Threat Intelligence Group (GTIG) has uncovered three suspected Russian cyber-espionage clusters targeting academics, diplomats, defense staff, government personnel, and think-tank researchers in Europe and the United States.

The groups UNC6293, UNC7005, and UNC5976 abuse legitimate account-authentication features to steal access to email, Microsoft 365, Google, and WhatsApp accounts.

The campaigns rely on convincing social-engineering lures rather than obvious malicious attachments.

Attackers impersonate trusted organizations, including the U.S. State Department, conference organizers, Microsoft services, WhatsApp, and defense-sector entities. Their invitations commonly refer to diplomatic meetings, security events, file sharing, or private calls.

UNC6293, assessed with moderate confidence as connected to the Russia-linked ICE RELIC cluster, has used application-specific password phishing since 2025.

It persuaded targets to create app passwords with names such as “ms.state.gov” and submit the generated passcode.

That allows an attacker to access a mailbox without repeatedly requesting the victim’s normal password or two-factor authentication code.

Google previously observed the group targeting prominent academics and critics of Russia through tailored State Department-themed correspondence.

Russian Hackers Breach Diplomat Accounts

UNC7005, also tracked as STORM-2945, expanded this approach with Microsoft device-code phishing and WhatsApp device-linking scams.

Victims receive fake invitations to events or calls and are directed to pages that request a Microsoft verification code or ask them to link WhatsApp to an attacker-controlled device.

Once a WhatsApp account is linked, the operators may offer a fake voice call, encrypted chat, or file-sharing option.

In one observed flow, the malicious page attempted to record the victim’s audio and video during a fake call before sending the recording to attacker infrastructure.

The group also used malware to target browser data. Windows users were served VIDAR, while macOS users received AtomicStealer.

Both information stealers can harvest browser-stored credentials, cookies, payment data, and other sensitive information. UNC7005 also launched OAuth phishing operations against defense-related targets.

Instead of presenting a fake Google or Microsoft login page, victims were sent through legitimate authentication pages and then redirected to attacker-controlled cloud projects.

Approving access could give attackers authentication tokens that enable account access. UNC5976, a separate suspected Russian cluster, similarly used cloud-hosted OAuth phishing pages and malicious Excel add-ins.

GTIG said the group has focused heavily on military, aerospace, defense, NGO, and think-tank targets, particularly in Ukraine and Armenia. These campaigns are dangerous because legitimate workflows can make the requests appear trustworthy.

A user may see a real Google or Microsoft sign-in page and assume the activity is safe, even when the final authorization grants access to a malicious application, cloud google said.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN