← Back to Feed

Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia

August 20, 2026 · Google Cloud Security · Severity: CRITICAL

Google Threat Intelligence Group (GTIG) is tracking three distinct suspected Russian cyber espionage threat clusters that abuse legitimate authentication flows. The clusters target individuals of interest to Russia in academia, aerospace, defense, and government sectors. The attackers use sophisticated social engineering, OAuth abuse, and WhatsApp linking to compromise personal accounts. GTIG researchers Gabby Roncone and Wesley Shields detailed the clusters' tactics and techniques in their analysis.

Key Takeaways

  • GTIG is tracking three Russian cyber espionage clusters abusing legitimate authentication flows.
  • The clusters target individuals in academia, aerospace, defense, and government sectors.
  • Attackers use sophisticated social engineering, OAuth abuse, and WhatsApp linking to compromise accounts.
☕ Buy a Coffee