Loading threat actor…
UNC6293 is a Russia-nexus cyber-espionage cluster focused on highly selective initial-access operations against high-value individuals, including prominent academics, journalists, and critics of Russia. It is assessed with moderate confidence to be an initial-access subcluster of ICE RELIC, formerly tracked as APT29 and also known as Cozy Bear and Midnight Blizzard, an activity ecosystem widely associated with Russia's Foreign Intelligence Service (SVR). Active since at least 2025, UNC6293 conducts patient, personalized social-engineering campaigns, often impersonating U.S. Department of State personnel and using foreign-policy or diplomatic-event themes. It has persuaded targets to generate and disclose application-specific passwords, providing durable mailbox access while bypassing ordinary multifactor-authentication prompts. The cluster subsequently expanded to OAuth phishing and Microsoft device-code abuse, inducing victims to provide authorization data or link attacker-controlled devices to their accounts. It also uses tailored calendar invitations and trusted virtual-meeting themes to sustain its impersonation pretexts. UNC6293 typically conducts low-volume operations against fewer than five individuals at a time, re-engages prior targets, and adapts lures and account infrastructure after disruption. Its tradecraft is designed to obtain persistent access to email correspondence and cloud-hosted documents through legitimate authentication mechanisms rather than software exploitation.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
25 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
53 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A suspected Russian espionage cluster conducting targeted authentication phishing against high-value targets. It harvests application passwords and OAuth verification codes to gain persistent account access.
Conducting Russian-linked cyber-espionage account-takeover operations using foreign-policy and diplomatic lures, OAuth phishing, and suspected adversary-in-the-middle proxy phishing.
Russian-linked espionage cluster focused on initial access via application password phishing and OAuth phishing, typically targeting fewer than five users at a time while impersonating the U.S. Department of State.
Russian-nexus cyber-espionage cluster using phishing and account-takeover tradecraft, including verification-code phishing and other legitimate-authentication abuse.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.