UTA0355Threat actor
UTA0355 is a Russian threat actor that conducts phishing campaigns targeting individuals and organizations associated with Ukraine. The actor initiates contact via email, inviting targets to a video conference, and follows up through Signal or WhatsApp to enhance legitimacy.From MISP Galaxy
Last reported 10 months ago, by Volexity2 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1684Social Engineering
“Since early March 2025, Volexity has observed multiple suspected Russian threat actors conducting highly targeted social engineering operations aimed at gaining access to the Microsoft 365 (M365) accounts of targeted individuals.”
- T1036Masquerading
“These attacks involved the creation of fake websites masquerading as legitimate international security events taking place in Europe, with the aim of tricking users who registered for these events into granting unauthorized access to their accounts.”
- T1098.005Device Registration
“OAuth Phishing and the Device Registration Service”
- T1213.005Messaging Applications
“…reate websites that mimic real-world events, impersonate individuals associated with those events, and contact users directly on messaging applications demonstrates that UTA0355 is a well-resourced and capable threat actor.”
- T1556.009Conditional Access Policies
“Consider implementing conditional access policies that restrict access to organizational resources to only approved or managed devices.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks“Volexity attributes these new campaigns to the Russian threat actor it tracks as UTA0355.”
-
Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows“Volexity is currently tracking what is believed to be at least two Russian threat actors, which it tracks as UTA0352 and UTA0355, that are behind these attacks.”
Indicators in its reports
named in the reports above- bsc2025[.]orgin 1 report
- hxxps://login.microsoftonline[.]com/common/reprocess?ctx=rQQIARAAJU3Pin 1 report
- ustrs[.]comin 1 report
- brussels-indo-pacific-forum[.]orgin 1 report
- mailum[.]comin 1 report
- world-nuclear-exhibition-paris[.]comin 1 report
- wne-2025[.]comin 1 report
- confirmyourflight-parisaeroport[.]comin 1 report
- hxxps://login.microsoftonline[.]com/organizations/oauth2/v2.0/authorize?state=https://mae.gov.ro/in 1 report
- hxxps://login.microsoftonline[.]com/common/oauth2/authorize?redirect=https://zoom.us/j/in 1 report
- vscode-redirect.azurewebsites[.]netin 1 report
- usesinsiders.vscode[.]devin 1 report
- hxxp://127.0.0[.]1:9217/callback?code=1.ARsAIGLD9ki0FE63WmhS-KbgFENkvK5tmXin 1 report
- hxxps://login.microsoftonline[.]com/common/oauth2/authorize?url=https://teams.microsoft.com/in 1 report
- address[.]herein 1 report
- hxxps://login.microsoftonline[.]com/WebApp/CloudDomainJoin/8?code=in 1 report
- hxxps://login.microsoftonline[.]com/organizations/oauth2/v2.0/authorize?state=in 1 report
- hxxps://insiders.vscode[.]dev/redirectin 1 report
- insiders.vscode[.]devin 1 report
- hxxps://login.microsoftonline[.]com/common/oauth2/authorize?redirect=in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.