ctrlINT What the industry said about every indicator, with the quote

UTA0352Threat actor

UTA0352 is a Russian threat actor attributed to phishing campaigns that exploit Microsoft OAuth 2.0 authentication workflows, often impersonating government officials to lure targets into providing sensitive information. The actor has been observed using malicious URLs disguised as legitimate services, such as a Romanian government authentication system.From MISP Galaxy

Last reported 15 months ago, by Elastic Security Labs2 reports

Suspected originRussiaMISP Galaxy

ATT&CK techniques

3 techniques · each with the sentence it comes from
  1. T1098.005Device Registration

    “We emulated the attack chain in a controlled environment to explore the mechanics of token abuse, device registration, and token enrichment firsthand.”

    Elastic Security LabsVendor
  2. T1556.009Conditional Access Policies

    “Conditional Access Policies (CAP)”

    Elastic Security LabsVendor
  3. T1684Social Engineering

    “Since early March 2025, Volexity has observed multiple suspected Russian threat actors conducting highly targeted social engineering operations aimed at gaining access to the Microsoft 365 (M365) accounts of targeted individuals.”

    VolexityVendor

What the reports say

2 reports, newest first · the exact sentence from each

  1. “…get Microsoft 365 OAuth Workflows, which attributes a sophisticated OAuth phishing campaign against NGOs to the threat actor designated UTA0352.”

    Elastic Security LabsVendor
    Microsoft Entra ID OAuth Phishing and Detections

  2. “Volexity is currently tracking what is believed to be at least two Russian threat actors, which it tracks as UTA0352 and UTA0355, that are behind these attacks.”

    VolexityVendor
    Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with UTA0352 here?
No account needed. We do not store your IP address.