← threat actors
threat actor · RU
UNC6293
also tracked as unc5976 1, unc7005 1
1 story · 1 in the wild · August 21, 2026 – August 21, 2026
evidence: 1 observed
sectors
- defense 1 · Aug 21
- education 1 · Aug 21
- government 1 · Aug 21
- technology 1 · Aug 21
geography
- europe 1 · Aug 21
- united states 1 · Aug 21
techniques
- device linking abuse 1 · Aug 21
- oauth abuse 1 · Aug 21
attack phases seen
- Initial access 1 · Aug 21
- Persistence 1 · Aug 21
what we reported, newest first, grouped by story
August 21, 2026
- Three suspected Russian espionage clusters — UNC6293, UNC7005 and UNC5976 — are abusing legitimate authentication flows rather than credential phishing. Techniques include Google OAuth abuse and WhatsApp device-linking to attach attacker devices to victim accounts, targeting academia, aerospace and defence, government and think tanks across Europe and the US (The Hacker News, The Register).
· Aug 21 · observed · as unc7005, unc5976 · Cloud & Identity