Google Threat Intelligence Group detailed three suspected Russian espionage clusters—UNC6293, UNC7005, and UNC5976—that abuse legitimate authentication flows such as app passwords, device code linking, OAuth, and messaging-app linking to steal access across academia, defense, governments, and think tanks. The report also ties UNC7005 to malware delivery and infrastructure overlaps involving VIDAR, ATOMIC, ENGINELIGHT, CHERRYPIE, and HEADRUSH, while connecting UNC6293 and UNC7005 to ICE RELIC. #UNC6293 #UNC7005 #UNC5976 #ICE_RELIC #VIDAR #ATOMIC #ENGINELIGHT #CHERRYPIE #HEADRUSH