UTA0355 also leveraged a breached Ukrainian government email account to distribute fake conference invitations.
Russian-linked threat groups UTA0352 and UTA0355 have been abusing Microsoft 365's OAuth workflows to compromise non-profit organisations' Microsoft accounts.
As part of a series of targeted phishing intrusions, attacks by UTA0352 involved the distribution of malicious emails purporting to be from European diplomats, a report from Volexity showed. The emails included a link redirecting to an online Visual Studio Code that launches OAuth and delivers an authorisation code enabling Microsoft Graph data and email access.
UTA0355 also leveraged a breached Ukrainian government email account to distribute fake conference invitations followed by messages on WhatsApp and other apps seeking victims' authentication, which resulted in eventual email data downloads.
Written by
Dan Raywood is a B2B journalist with 25 years of experience, including covering cybersecurity for the past 17 years. He has extensively covered topics from Advanced Persistent Threats and nation-state hackers to major data breaches and regulatory changes.
He has spoken at events including 44CON, Infosecurity Europe, RANT Forum, BSides Scotland, Steelcon and the National Cyber Security Show, and served as editor of SC Media UK, Infosecurity Magazine and IT Security Guru. He was also an analyst with 451 Research and a product marketing lead at Tenable.
