Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
espionageThreat Actor
Active Threat
UNC6293
38
IOCs Tracked
3
Intel Reports
Associated IOCs38 total
IP3
104.194.159.150
2026-10-09High151.236.15.2132026-08-27High107.189.18.7
2026-10-09HighDomain20
m365-owa.com2026-10-09High
owa-ms365.com2026-10-09High
ms365-device.com2026-10-09High
my-invite.org2026-10-09High
foreignrelations.us2026-10-09High
dosportal.app2026-08-27High
statistic-ms.live2026-10-09High
stateaffairs.us2026-08-27High
globsec.org2026-08-27High
sharefolders.org2026-08-27High
fileshareapp.org2026-08-27High
formshare.cloud2026-08-27High
the-washington-ballet.com2026-08-27High
usercontent.app2026-08-27High
verify-drive.com2026-10-09High
internationalaffairsportal.us2026-08-27High
2200freefonts.com2026-08-27High
fllefolder.com2026-08-27High
sharedfolders.org2026-08-27High
wa-connect.eu2026-10-09High
SHA25614
be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c2026-10-09High
403b624e35777cbc07dbe66398b21bba70396a20b859c880732338ce1dd1f41f2026-10-09Medium
28f622028e690c943f7fa9aca426c07cab52b5aaba757ef8a3328609c0b3bec32026-10-09Medium
2c7f4165967d6f7737b3fef87959846920b57a5368b531ad1427c7214d4c41a22026-10-09Medium
20e20b074967ed6f6e04d609ccec5ff7492665ef25f894c90c2ddc92fa47ac382026-10-09Medium
a06a8fd1b6fa1924199a4540cf16d089217ce8f78c617739946f145fd1fc88c12026-10-09Medium
125752ad7c20d715920a3b2fb0fdde660f07b3f2b053665cf38c2d6d9de86e1e2026-10-09Medium
6f7090895c1c3dee30de6b3f098ca3a788dc198646e5293a8b1210430b0add972026-10-09Medium
1d9299799a7b8da67c44ebec064d64542c27645f8e84de4a22ca3f6cbc843e3c2026-10-09Medium
1f24443e2fc1843d59edcad6282898e3fa2a0917706ffb043229e3a555902b682026-10-09Medium
5b8d50c2e8cc3038b7c6e6dbf1219f6e814930a1e3c0053143a1191ae67f8ffc2026-10-09Medium
ca3be5885afb3eb3bb19341e2653212200c568f3f900e0b2f04de9ba209aed252026-10-09Medium
c5826032207d623a7f6caec8465af7364eccc355f9a48897da2a54f3e44202652026-10-09Medium
1e3ee845fde739fcd3ca9ce62c7f142a7c501d11db4c4fb294d4939f12d0f9162026-10-09Medium
Email1
[email protected]2026-08-27High
Related Reports3 total
Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia
Google Threat Intelligence (GTIG / Mandiant)Aug 20, 2026
Russia-Linked Cyber Espionage Clusters Use OAuth Phishing to Target U.S. and European Organizations
Cyber PressAug 27, 2026
Russian Hackers Trick Academics and Diplomats Into Giving Them Access to Email and WhatsApp
Cyber PressAug 21, 2026
Threat Profile
Motivationespionage
Last seenOct 2026
IOCs tracked38