UTA0352

Executive Summary

Russian threat actor UTA0352 utilizes sophisticated OAuth 2.0 phishing campaigns to hijack Microsoft 365 user credentials by impersonating European officials and leveraging messaging apps such as Signal and WhatsApp. The group targets a broad spectrum of NGOs, media, defense, and critical‑infrastructure sectors linked to Ukraine, using stolen authorization codes to gain persistent access to corporate clouds. Their methods indicate a focus on credential theft and lateral movement rather than destructive sabotage.

Goals & Targeting

The primary strategic objective appears to be the systematic acquisition and use of privileged credentials across diverse sectors—especially those tied to Ukrainian interests and European NGOs—to facilitate long‑term data exfiltration and leverage compromised accounts for potential secondary operations. By infiltrating Microsoft 365, Exchange, and Google Workspace environments, UTA0352 gains access to high‑value email archives, contacts, and sensitive documents that can be weaponized for political or commercial purposes. Their broad target list suggests a desire to harvest a wide array of data types while maintaining operational secrecy through legitimate cloud services and social engineering techniques.

Key Capabilities

• Phishing for OAuth 2.0 authentication codes via legitimate Microsoft 365 workflows
• Social engineering using messaging platforms such as Signal and WhatsApp to increase message legitimacy
• Impersonation of European government officials to gain victim trust in phishing outreach
• Exploitation of compromised email accounts for initial access
• Compromise of cloud accounts and use of cloud storage services for tool upload and exfiltration
• Leveraging cloud infrastructure (VPS, serverless functions) to host malicious content or command & control
• Abuse of third‑party domains, DNS, and servers to facilitate phishing and lateral movement
• Building botnets from compromised machines to scale attacks
• Establishing new local and domain user accounts using net user /add for persistence and lateral movement
• Targeting Exchange, Office 365, and Google Workspace environments to harvest email data
• Injecting malicious code into cloud or container images to establish persistence
• Exploiting SAP NetWeaver CVE‑2025-31324 to deploy web shells and install Brute Ratel RAT

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

UTA0352 campaigns exhibit a high frequency of phishing blasts tied to Microsoft 365 OAuth fraud, typically delivered via mass email and followed by targeted WhatsApp or Signal messages. Operations appear to be low‑noise but high‑volume, with attackers exploiting cloud infrastructures for rapid scaling and automated credential harvesting. Victims are primarily NGOs, media outlets, defense contractors, and other entities linked to Ukrainian policy concerns; the group has also recently expanded reach into broader sectors such as critical infrastructure and education. Previous similar operations attributed to Cozy Bear/UNC2452 suggest a long‑standing pattern of exploiting legitimate authentication workflows for stealthy persistence.

IOC Patterns

• Domain
• File
• URL
• OAuth 2.0 redirect URI pattern
• Microsoft authentication code URL pattern

Recommended Actions

• Implement multi‑factor authentication for all Microsoft 365 accounts
• Configure OAuth consent boundaries to limit third‑party app access
• Monitor and block suspicious Azure AD OAuth redirect URIs
• Enforce strict email filtering rules and educate users on spear‑phishing linked to legitimate services
• Verify authorization code requests via secure, out‑of‑band channels
• Regularly review newly created or privileged user accounts in domain
• Implement network segmentation to isolate critical cloud services from external exposure
• Monitor DNS changes for unauthorized domain or record alterations

Suggested Tags