Loading threat actor…
UNC7005, also tracked as Storm-2945, is a suspected Russian cyber espionage cluster focused on authentication-centric initial access operations. It has been assessed with high confidence as having a Russian nexus and with moderate confidence as related to an ICE RELIC subcluster associated with APT29/Cozy Bear/Midnight Blizzard initial access activity. The actor has primarily targeted academia, diplomatic personnel, nonprofit organizations, researchers, and defense-related individuals across Ukraine, Western Europe, and the United States, including people of interest to the Kremlin and individuals connected to the European defense sector. UNC7005 is notable for abusing legitimate authentication workflows rather than relying solely on traditional malware delivery. Its tradecraft includes selective app password phishing, OAuth phishing, Microsoft device code phishing, and WhatsApp device-linking lures. The actor has used highly tailored social engineering themes such as diplomatic events, conferences, summit invitations, and defense-related pretexts. In WhatsApp-focused operations, victims were tricked into linking their accounts to attacker-controlled devices, enabling account compromise through legitimate platform functionality. The cluster has also expanded into malware-enabled collection and post-compromise activity. It has used commodity infostealers including Vidar and Atomic macOS Stealer, and its activity has overlapped with the broader CaptiveCrunch campaign. That overlapping activity included adversary-in-the-middle phishing, traffic redirection, malware delivery disguised as software updates, and use of malware such as CornFlake RAT and ChocoShell for credential theft, session theft, surveillance, and broader post-exploitation. Reporting also indicates reliance on commercial residential proxies for post-compromise operations. Overall, UNC7005 represents a Russian espionage actor specializing in stealthy account compromise, token and credential theft, and selective follow-on collection against policy, diplomatic, academic, nonprofit, and defense-adjacent targets.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
20 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
43 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.