Russian Threat Actor Uses Fake European Security Events in OAuth Phishing Campaigns
Summary
Volexity attributes campaigns impersonating European security events to Russian threat actor UTA0355. Fake registration sites and rapport-building phishing led targets to OAuth or device-code workflows, enabling access to Microsoft 365 accounts.
Key points
- UTA0355 impersonated the Belgrade Security Conference and Brussels Indo-Pacific Dialogue to target people in foreign policy and related fields.
- The campaigns used tailored email conversations and WhatsApp or Signal contact to build trust before sending phishing links.
- Fake event websites directed selected users into Microsoft OAuth or device-code phishing workflows, sometimes asking them to share a URL containing an authentication code.
- In one investigated case, the attacker accessed a compromised Microsoft 365 account and its files, and registered a new device in Microsoft Entra ID to maintain access.
- The actor used compromised accounts and requests for colleagues’ contact details to expand its target list.
- Volexity observed post-compromise access through proxy-network infrastructure and identified additional domains that may have been used in earlier targeting.
Article Details
- Attack Vectors
- Spear-phishing emails used event-registration pretexts and links to OAuth or Microsoft 365 Device Code authentication workflows to obtain access to user accounts.
- Attackers used rapport-building and communications through WhatsApp or Signal to establish trust and guide targets through the phishing process.
- Fake event websites collected corporate email addresses and redirected selected targets to Microsoft 365 phishing workflows.
- After compromising accounts, the attacker registered a new device in Microsoft Entra ID using a name matching an existing user device to maintain access.
- UTA0355 sought referrals and colleagues’ names and email addresses from initial targets to expand its target list.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | brussels-indo-pacific-forum[.]org | Website impersonating the Brussels Indo-Pacific Dialogue and presenting a Device Code phishing workflow. |
| DOMAIN | bsc2025[.]org | Attacker-created website impersonating the Belgrade Security Conference and used in phishing. |
| DOMAIN | confirmyourflight-parisaeroport[.]com | Related domain identified by Volexity; Volexity said its use in earlier UTA0355 attacks was possible but unconfirmed. |
| DOMAIN | ustrs[.]com | Domain used in a targeted phishing campaign attributed to UTA0355. |
| DOMAIN | wne-2025[.]com | Related domain identified by Volexity; Volexity said its use in earlier UTA0355 attacks was possible but unconfirmed. |
| DOMAIN | world-nuclear-exhibition-paris[.]com | Related domain identified by Volexity; Volexity said its use in earlier UTA0355 attacks was possible but unconfirmed. |
MITRE ATT&CK
T1098.005 · Device RegistrationThe attacker registered a new device in Microsoft Entra ID under a name matching an existing user device to maintain account access.T1528 · Steal Application Access TokenThe phishing workflows induced users to complete OAuth or Device Code authentication and provide the resulting URL or code, enabling unauthorized account access.T1566.002 · Spearphishing LinkUTA0355 sent spear-phishing emails containing links to fake event-registration pages and authentication workflows.
Threat Actors
Vendors
Products
Microsoft 365posts detailing a new trend among Russian threat actors targeting organizations through the abuse of Microsoft 365 OAuth and Device Code authentication workflows to gain access to Microsoft user accounts.Microsoft Entra IDA new device was created in Microsoft Entra ID to maintain access to the account.SignalGuiding users via WhatsApp/Signal: The attacker offers to provide “live support” to targeted users via messaging apps to ensure they correctly return the URL, in the case of OAuth phishing workflows.WhatsAppGuiding users via WhatsApp/Signal: The attacker offers to provide “live support” to targeted users via messaging apps to ensure they correctly return the URL, in the case of OAuth phishing workflows.
Tools
Countries
BelgiumIn this second campaign, the emails purported to be from an individual at the Centre for Security, Diplomacy, and Strategy (CSDS) at Vrije Universiteit Brussel in Belgium.RussiaSerbiaThe email had come from an account the user had recently corresponded with, and it was a continuation of an existing and legitimate thread related to the upcoming Belgrade Security Conference in Serbia.United StatesVolexity observed subsequent attempted attacker activity via a residential Comcast IP address in the United States, which according to spur.us, belonged to a proxy network.