UTA0355
UTA0355 is a Russian threat actor tracked by Volexity and described in the provided content as state-affiliated and engaged in cyber-espionage. The actor has targeted Microsoft 365 and Google environments, including employees of organizations connected to Ukraine, NGOs, human rights advocates, foreign policy personnel, and individuals associated with European security events. Reported lures included fake or impersonated security and policy events such as the Belgrade Security Conference and the Brussels Indo-Pacific Dialogue, as well as invitations to Ukraine-related meetings. In some cases, initial outreach came from compromised Ukrainian government email accounts, followed by one-on-one social engineering over WhatsApp and Signal, including "live support" to guide victims through the attack flow. The actor abuses legitimate Microsoft OAuth 2.0 and Device Code authentication workflows rather than relying on malware or attacker-controlled OAuth applications. Reported tradecraft includes sending victims Microsoft-owned authorization URLs, convincing them to share Microsoft-generated OAuth authorization codes or URLs containing those codes, and using the stolen authorization code to obtain access to Microsoft 365 resources. Volexity reported that in an April 2025 variant, UTA0355 used a stolen OAuth authorization code to register a new device in Microsoft Entra ID and then socially engineered the victim into approving a 2FA prompt, enabling access to the victim's email. Separate reporting in the content states UTA0355 registered unauthorized rogue devices to steal Microsoft Graph API tokens and used tooling closely matching ROADtools token-management capabilities. Volexity also observed post-compromise access via proxy networks and device registrations designed to resemble legitimate victim devices. The content also explicitly associates UTA0355 with device code phishing activity and with campaigns spoofing European security events to steal Microsoft 365 OAuth tokens. No additional aliases or sub-groups beyond the name UTA0355 are directly provided in the content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Observables
6 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Observed in early 2025 phishing activity using ROADtools-related tradecraft to register rogue devices and steal Microsoft Graph API tokens.
Conducted a phishing campaign using tooling closely matching ROADtools token management capabilities in Microsoft cloud environments.
Referenced as a Russian threat group that has used device code phishing attacks to hijack Microsoft accounts.
Steals Microsoft 365 OAuth tokens using fake security conference lures and WhatsApp-based support/social engineering.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.