UNK_AcademicFlare

Executive Summary

UNK_AcademicFlare is a suspected Russia‑aligned espionage group that primarily targets government, defense, and academic organizations across the US and Europe by spearphishing Microsoft 365 users through malicious OAuth device code flows. Their campaigns use compromised email accounts and Cloudflare Worker URLs to spoof OneDrive links, enabling MFA bypass and credential theft. The actor deploys PlugX malware, SquarePhish/Graphish phishing kits, and reverse‑proxy techniques to achieve lateral movement and persistence within victim networks.

Goals & Targeting

The primary strategic objective of UNK_AcademicFlare is state‑aligned espionage aimed at extracting sensitive information from critical government and defense infrastructures. By compromising Microsoft 365 accounts they gain early access to email, calendars, documents, and internal collaboration tools, which can be used for further reconnaissance, exfiltration, or to plant additional malware such as PlugX for persistence. Their targeting focus on academic institutions offers a low‑defense entry point into research that may influence defense procurement or policy decisions.

Key Capabilities

• Microsoft 365 OAuth device code phishing campaigns
• Compromised email address spearphishing with benign outreach
• Spoofing OneDrive links via Cloudflare Worker domains
• Exploitation of the device authorization flow as an MFA bypass
• Automated token endpoint polling to refresh access tokens
• Reverse‑proxy (Adversary‑in‑the‑Middle) capturing credentials
• Fabrication of Azure App Registrations with fake client IDs and certificates
• Use of PlugX malware for persistence and lateral movement
• Automation via SquarePhish and Graphish phishing kits
• QR code phishing embedded in emails

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

UNK_AcademicFlare’s campaigns exhibit a high degree of automation and low visibility. They leverage publicly available phishing kits to rapidly scale attacks across multiple user accounts while maintaining an aggressive operational tempo. Victim profiles tend toward public‑sector entities with high sensitivity, particularly those relying on Microsoft 365 for collaboration. The group frequently updates its infrastructure—changing Cloudflare Worker domains and using rotated credentials—to evade detection. Historical activity indicates coordinated operations from 2025 onward, suggesting a sustained effort supported by state resources. Notable past operations include the September‑2025 surge of device code phishing targeting U.S. homeland security agencies and a separate wave against European transportation regulators. In both cases, attackers succeeded in stealing MFA tokens, compromising accounts, and installing plug‑and‑play malware to maintain persistence. Their use of AI‑powered spearphishing narratives tied to Russia/Ukraine conflicts has proven effective at gaining initial trust. Defense analysts note that the group’s primary value lies in early compromise of privileged accounts, which unlocks a broad range of subsequent attack vectors, including lateral movement via Office 365 groups and data exfiltration through cloud drives.

IOC Patterns

• OAuth Device Authorization URL phishing targeting Microsoft 365
• Compromised email address spearphishing with spoofed Azure tenant sender
• Malicious URLs and QR codes embedded in emails
• Cloudflare Worker domains mimicking legitimate OneDrive links
• Fake Azure App Registration capturing login credentials
• Token theft via automated OAuth device flow polling
• MFA redemption through attacker‑controlled pages

Recommended Actions

• Implement strict controls on Microsoft Device Code grant flows, such as whitelisting approved applications and enforcing usage policies.
• Deploy real‑time monitoring of OAuth token issuance events and flag anomalies (e.g., simultaneous requests from new locations).
• Educate users about OTPs that appear in unfamiliar web pages and train them to verify the authenticity of one‑click sign‑in URLs.
• Block or sandbox Cloudflare Worker domains known to be used for phishing, and apply stricter outbound filtering against suspicious redirect hosts.
• Validate sender email domain integrity using SPF/DKIM/DMARC before permitting user interaction with attachments or links.
• Deploy endpoint detection solutions that detect PlugX activity and other known persistence mechanisms.
• Leverage threat intelligence feeds from vendors such as Rescana, Proofpoint, or Mandiant to keep IOC lists current.
• Restrict external app registrations in Azure AD and enforce MFA for privileged roles even when using OAuth flows.

Suggested Tags