Inhospitable: Mapping Russian Cyber Espionage Infrastructure

Summary

This report examines multiple Russian-aligned cyber espionage clusters, including UNC6293, UNC7005, and UNC5976. These actors use sophisticated phishing techniques such as OAuth phishing, device code phishing, and Evilginx-style proxying to target academics and think tank personnel. The research also highlights infrastructure patterns, including shared registration details, CSS similarities, and distinctive favicon hashes used to uncover adversary-controlled domains.

Investigation

The investigation combined DNS history, WHOIS records, certificate analysis, and HTTP header and favicon fingerprinting to pivot from known indicators toward previously unidentified infrastructure. Analysts clustered domains using similarities in CSS classes and shared Facebook App IDs involved in content proxying. The report also shows how registration patterns and so-called ghost domains can help predict or validate future adversary infrastructure.

Mitigation

Organizations should enforce strong OAuth application governance and monitor for unauthorized third-party application registrations. Multi-factor authentication (MFA) should be configured to resist adversary-in-the-middle (AiTM) attacks, particularly through FIDO2/WebAuthn-based security keys. Security teams should also monitor unusual device code requests and suspicious domain registrations that imitate organizational services.

Response

If suspicious phishing activity or unauthorized OAuth grants are detected, security teams should immediately revoke associated session tokens and application permissions. Responders should search web proxy and DNS logs for identified malicious domains and IP addresses. Investigations should also examine the email addresses and device codes involved to determine the scope of account compromise.

## Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary is executing an OAuth phishing campaign. To lure the victim, they direct them to a malicious domain hosted on a hijacked or cheaply purchased infrastructure. The goal is to present a fake login page to harvest OAuth tokens. The simulation will use curl to simulate a user’s browser making a request to one of the UNC6293 identified domains (dosportal.app), which should trigger the proxy log entry and subsequently the detection rule.

• Regression Test Script:

  #!/bin/bash
  # Simulation script to trigger UNC6293 domain detection
  echo "[+] Starting UNC6293 Domain Simulation..."
  
  # Target domain from the detection logic
  TARGET_DOMAIN="dosportal.app"
  
  echo "[+] Simulating web request to malicious domain: $TARGET_DOMAIN"
  # Using curl to generate a network request that will be captured by the proxy
  curl -s -o /dev/null -I "http://$TARGET_DOMAIN/login"
  
  if [ $? -eq 0 ]; then
    echo "[+] Request sent successfully. Check SIEM for alerts."
  else
    echo "[-] Request failed. Ensure you have internet connectivity."
  fi

• Cleanup Commands:

  # No cleanup required for network-based simulation as no files were altered on the host.
  echo "[+] Simulation complete. No host artifacts created."