ctrlINT What the industry said about every indicator, with the quote

UNC6293Threat actor

UNC6293 is a Russian state-sponsored threat actor identified by Google's Threat Intelligence Group (GTIG), which associates them with APT29 with low confidence. They have conducted campaigns utilizing social engineering tactics, including leveraging App-Specific Passwords for account compromises. GTIG has also noted a second campaign by UNC6293 that incorporates Ukrainian themes.From MISP Galaxy

Last reported 2 months ago, by Google Threat Intelligence1 report

Suspected originRussiaMISP Galaxy

ATT&CK techniques

3 techniques · each with the sentence it comes from
  1. T1036Masquerading

    “secure file sharing) and/or the organization UNC7005 is masquerading as.”

    Google Threat IntelligenceVendor
  2. T1213.005Messaging Applications

    “Threat actors are continually targeting victim’s personal messaging applications and performing device linking attacks.”

    Google Threat IntelligenceVendor
  3. T1684Social Engineering

    “These clusters engage in persistent, adaptive phishing campaigns, using sophisticated social engineering tactics to compromise personal accounts across multiple platforms.”

    Google Threat IntelligenceVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

1 report, newest first · the exact sentence from each

  1. “Examples of these techniques can be found in our previous blog on UNC6293’s phishing operations.”

    Google Threat IntelligenceVendor
    Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with UNC6293 here?
No account needed. We do not store your IP address.