Russian Cyber Clusters Bypass MFA via Google OAuth and WhatsApp Linking
Three suspected Russian threat groups are targeting Western defense and government officials by abusing legitimate authentication flows to hijack accounts.
Google Threat Intelligence Group (GTIG) has identified three suspected Russian threat clusters targeting high-value individuals across the U.S. and Europe. These actors are bypassing traditional security measures by abusing legitimate authentication flows to maintain persistent access to sensitive communications.
The campaign involves three distinct clusters—UNC6293, UNC7005, and UNC5976—that specifically target individuals within academia, governments, think tanks, and the aerospace and defense sectors. According to GTIG, these groups leverage Google OAuth and WhatsApp device linking to hijack accounts and circumvent multi-factor authentication (MFA), allowing them to monitor targets without triggering standard security alerts.
Sophisticated Access Methods
The clusters employ varied technical methods to gain and maintain entry. UNC6293 has been observed using App-Specific Passwords (ASPs) to access Gmail accounts. This technique effectively bypasses Google's 2-Step Verification (2SV), allowing the attackers to enter accounts without the need for a secondary authentication token.
Meanwhile, UNC5976 utilizes a different vector involving a rogue Excel plugin codenamed 'HEADRUSH.' This plugin is used to deliver HTML Application (HTA) downloads to the target's system, facilitating the initial compromise. Once inside, the actors shift toward abusing legitimate platform features, such as WhatsApp's device linking, to mirror communications and maintain a foothold in the target's personal and professional life.
The Shift in Espionage Tactics
This campaign represents a strategic shift in cyber espionage. Rather than relying solely on traditional malware that can be detected by antivirus software, these actors are exploiting the trust inherent in 'legitimate' authentication flows. By leveraging OAuth tokens and device linking, the attackers can maintain access to data and messages without the need for password changes or new login events that typically alert security teams.
This approach is particularly dangerous because it undermines MFA, which most modern organizations rely on as their primary line of defense. By targeting the intersection of professional Google accounts and personal WhatsApp channels, these Russian clusters can conduct deep espionage on strategic sectors with a significantly lower risk of detection than traditional phishing or malware campaigns.
Future Outlook
Security researchers continue to monitor these clusters as they refine their ability to blend in with legitimate user traffic. While the use of 'HEADRUSH' and ASPs provides a clear signature for detection, the broader trend of abusing OAuth and device linking suggests a growing vulnerability in how users and organizations manage third-party authorizations. Defenders are encouraged to audit authorized apps and linked devices to identify unauthorized persistence.