THREAT OPS › Threat News › Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia
Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia
<div class="block-paragraph_advanced"><p>Written by: Gabby Roncone, Wesley Shields</p> <hr /> <h3><span style="vertical-align: baseline;">Overview</span><strong style="vertical-align: baseline;"> </strong></h3> <p><span style="vertical-align: baseline;">Google Threat Intelligence Group (GTIG) is tracking three distinct suspected Russian cyber espionage threat clusters abusing legitimate authentica
Attributed threat actors
- APT29G0016
MITRE ATT&CK techniques
Indicators of compromise
- 5b8d50c2e8cc3038b7c6e6dbf1219f6e814930a1e3c0053143a1191ae67f8ffcsha256
- 1d9299799a7b8da67c44ebec064d64542c27645f8e84de4a22ca3f6cbc843e3csha256
- c5826032207d623a7f6caec8465af7364eccc355f9a48897da2a54f3e4420265sha256
- 2c7f4165967d6f7737b3fef87959846920b57a5368b531ad1427c7214d4c41a2sha256
- a06a8fd1b6fa1924199a4540cf16d089217ce8f78c617739946f145fd1fc88c1sha256
- 125752ad7c20d715920a3b2fb0fdde660f07b3f2b053665cf38c2d6d9de86e1esha256
- 403b624e35777cbc07dbe66398b21bba70396a20b859c880732338ce1dd1f41fsha256
- 28f622028e690c943f7fa9aca426c07cab52b5aaba757ef8a3328609c0b3bec3sha256
- be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42csha256
- 1e3ee845fde739fcd3ca9ce62c7f142a7c501d11db4c4fb294d4939f12d0f916sha256
- 6f7090895c1c3dee30de6b3f098ca3a788dc198646e5293a8b1210430b0add97sha256
- 20e20b074967ed6f6e04d609ccec5ff7492665ef25f894c90c2ddc92fa47ac38sha256
- ca3be5885afb3eb3bb19341e2653212200c568f3f900e0b2f04de9ba209aed25sha256
- https://reliaquest.com/blog/threat-spotlight-dns-poisoning-tactics-expand-to-hospitality/url
- https://citizenlab.ca/research/russian-government-linked-social-engineering-targets-app-specific-passwords/url
- chikolimdrid@gmail.comemail
- bounce@chamber-ua.orgemail
- keyereaonkendrick4@gmail.comemail
- 107.189.18.7ipv4
- 104.194.159.150ipv4
- 196.251.107.171ipv4
- 31.57.243.154ipv4
- 38.146.28.75ipv4
- foreignrelations.usdomain
- owa-ms365.comdomain
- m365-owa.comdomain
- ms365-device.comdomain
- ms365-live.comdomain
- my-invite.orgdomain
- wa-connect.eudomain
- verify-drive.comdomain
- fewfwfwfwfwf.infodomain
- miov2iaiaoubqosiqoiajwowiwjso.onlinedomain
- wa-connect.netdomain
- wa-invite.comdomain
- wa-device.comdomain
- wa-meeting.comdomain
- shopinvite.orgdomain
- globsec.netdomain
- finishoperations.comdomain