Date: 08/21/2026
Severity: Medium
Summary
Three suspected Russian cyber-espionage clusters are targeting individuals in academia, aerospace and defense, government, and think tanks across Europe and the United States. The groups abuse legitimate authentication and OAuth workflows to make phishing attempts appear more trustworthy and harder to detect. Researchers are tracking two additional clusters, UNC7005 and UNC5976, which use phishing, OAuth abuse, and malware to compromise victims. UNC7005 has also been linked to hospitality captive-portal redirects used to target victims. Although their techniques differ, all three clusters rely on persistent and adaptive social engineering campaigns to compromise personal accounts. Because these attacks exploit legitimate login processes, users should remain alert to unexpected authentication requests, redirects, and suspicious account-related messages.
Indicators of Compromise (IOC) List
Domains/URLs | fewfwfwfwfwf.info miov2iaiaoubqosiqoiajwowiwjso.online mioisiskwowiwjowuwjwolab.club chamber-ua.org wa-connect.eu wa-connect.net wa-invite.com wa-device.com wa-meeting.com shopinvite.org my-invite.org globsec.net statistic-ms.live owa-ms365.com m365-owa.com ms365-device.com ms365-live.com finishoperations.com finishoperations.org foc-share.com share-foc.com internal-share.com foc-share.org drive.google.verify-drive.com mail.kiis.co.uk dosportal.app foreignrelations.us |
IP Address | 107.189.18.7 196.251.107.171 31.57.243.154 38.146.28.75 104.194.159.150 |
Hash | 5b8d50c2e8cc3038b7c6e6dbf1219f6e814930a1e3c0053143a1191ae67f8ffc
a06a8fd1b6fa1924199a4540cf16d089217ce8f78c617739946f145fd1fc88c1
1d9299799a7b8da67c44ebec064d64542c27645f8e84de4a22ca3f6cbc843e3c
c5826032207d623a7f6caec8465af7364eccc355f9a48897da2a54f3e4420265
125752ad7c20d715920a3b2fb0fdde660f07b3f2b053665cf38c2d6d9de86e1e
403b624e35777cbc07dbe66398b21bba70396a20b859c880732338ce1dd1f41f
28f622028e690c943f7fa9aca426c07cab52b5aaba757ef8a3328609c0b3bec3
be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c
1e3ee845fde739fcd3ca9ce62c7f142a7c501d11db4c4fb294d4939f12d0f916
6f7090895c1c3dee30de6b3f098ca3a788dc198646e5293a8b1210430b0add97
20e20b074967ed6f6e04d609ccec5ff7492665ef25f894c90c2ddc92fa47ac38
ca3be5885afb3eb3bb19341e2653212200c568f3f900e0b2f04de9ba209aed25
2c7f4165967d6f7737b3fef87959846920b57a5368b531ad1427c7214d4c41a2
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "wa-device.com" or url like "wa-device.com" or siteurl like "wa-device.com" or domainname like "wa-connect.eu" or url like "wa-connect.eu" or siteurl like "wa-connect.eu" or domainname like "foreignrelations.us" or url like "foreignrelations.us" or siteurl like "foreignrelations.us" or domainname like "globsec.net" or url like "globsec.net" or siteurl like "globsec.net" or domainname like "owa-ms365.com" or url like "owa-ms365.com" or siteurl like "owa-ms365.com" or domainname like "my-invite.org" or url like "my-invite.org" or siteurl like "my-invite.org" or domainname like "foc-share.org" or url like "foc-share.org" or siteurl like "foc-share.org" or domainname like "wa-meeting.com" or url like "wa-meeting.com" or siteurl like "wa-meeting.com" or domainname like "finishoperations.com" or url like "finishoperations.com" or siteurl like "finishoperations.com" or domainname like "ms365-device.com" or url like "ms365-device.com" or siteurl like "ms365-device.com" or domainname like "drive.google.verify-drive.com" or url like "drive.google.verify-drive.com" or siteurl like "drive.google.verify-drive.com" or domainname like "wa-connect.net" or url like "wa-connect.net" or siteurl like "wa-connect.net" or domainname like "fewfwfwfwfwf.info" or url like "fewfwfwfwfwf.info" or siteurl like "fewfwfwfwfwf.info" or domainname like "foc-share.com" or url like "foc-share.com" or siteurl like "foc-share.com" or domainname like "miov2iaiaoubqosiqoiajwowiwjso.online" or url like "miov2iaiaoubqosiqoiajwowiwjso.online" or siteurl like "miov2iaiaoubqosiqoiajwowiwjso.online" or domainname like "statistic-ms.live" or url like "statistic-ms.live" or siteurl like "statistic-ms.live" or domainname like "dosportal.app" or url like "dosportal.app" or siteurl like "dosportal.app" or domainname like "mioisiskwowiwjowuwjwolab.club" or url like "mioisiskwowiwjowuwjwolab.club" or siteurl like "mioisiskwowiwjowuwjwolab.club" or domainname like "chamber-ua.org" or url like "chamber-ua.org" or siteurl like "chamber-ua.org" or domainname like "internal-share.com" or url like "internal-share.com" or siteurl like "internal-share.com" or domainname like "m365-owa.com" or url like "m365-owa.com" or siteurl like "m365-owa.com" or domainname like "ms365-live.com" or url like "ms365-live.com" or siteurl like "ms365-live.com" or domainname like "mail.kiis.co.uk" or url like "mail.kiis.co.uk" or siteurl like "mail.kiis.co.uk" or domainname like "share-foc.com" or url like "share-foc.com" or siteurl like "share-foc.com" or domainname like "wa-invite.com" or url like "wa-invite.com" or siteurl like "wa-invite.com" or domainname like "shopinvite.org" or url like "shopinvite.org" or siteurl like "shopinvite.org" or domainname like "finishoperations.org" or url like "finishoperations.org" or siteurl like "finishoperations.org" |
Detection Query 2 : | dstipaddress IN ("196.251.107.171","104.194.159.150","107.189.18.7","31.57.243.154","38.146.28.75") or srcipaddress IN ("196.251.107.171","104.194.159.150","107.189.18.7","31.57.243.154","38.146.28.75") |
Detection Query 3 : | sha256hash IN ("20e20b074967ed6f6e04d609ccec5ff7492665ef25f894c90c2ddc92fa47ac38","1e3ee845fde739fcd3ca9ce62c7f142a7c501d11db4c4fb294d4939f12d0f916","6f7090895c1c3dee30de6b3f098ca3a788dc198646e5293a8b1210430b0add97","be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c","403b624e35777cbc07dbe66398b21bba70396a20b859c880732338ce1dd1f41f","ca3be5885afb3eb3bb19341e2653212200c568f3f900e0b2f04de9ba209aed25","2c7f4165967d6f7737b3fef87959846920b57a5368b531ad1427c7214d4c41a2","28f622028e690c943f7fa9aca426c07cab52b5aaba757ef8a3328609c0b3bec3","a06a8fd1b6fa1924199a4540cf16d089217ce8f78c617739946f145fd1fc88c1","5b8d50c2e8cc3038b7c6e6dbf1219f6e814930a1e3c0053143a1191ae67f8ffc","1d9299799a7b8da67c44ebec064d64542c27645f8e84de4a22ca3f6cbc843e3c","c5826032207d623a7f6caec8465af7364eccc355f9a48897da2a54f3e4420265","125752ad7c20d715920a3b2fb0fdde660f07b3f2b053665cf38c2d6d9de86e1e")
|
Reference:
https://cloud.google.com/blog/topics/threat-intelligence/distinct-clusters-target-individuals-of-interest-to-russia