Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia

Google Threat Intelligence Group identifies three Russian cyber espionage clusters abusing authentication flows to target individuals in academia, defense, and government sectors. The groups use phishing and OAuth abuse to compromise accounts, with UNC6293 linked to ICE RELIC. The report details tactics including app password phishing and captive portal redirects.