UTA0355

Reports

First seen

Apr 22

Last seen

Jun 4

Motivation

espionage, Espionage, espionage, targeting NGOs and human righ

Targeting

Sectors

government ×1other ×1

Top ATT&CK techniques

T1566 Phishing ×4T1078 Valid Accounts ×3T1562.001 Impair Defenses: Disable or Modify Tools ×2T1598 Phishing for Information ×2T1566.002 Phishing: Spearphishing Link ×2T1556 Modify Authentication Process ×2T1550 Use Alternate Authentication Material ×2T1021.001 Remote Services: Remote Desktop Protocol ×1T1055 Process Injection ×1T1547.010 Boot or Logon Autostart Execution: Port Monitors ×1T1005 Data from Local System ×1T1621 Multi-Factor Authentication Interception ×1

Indicators

domain ×15url ×9cve ×4

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2019-5736 (exploited)CVE-2022-0492 (exploited)CVE-2024-21626 (exploited)CVE-2026-20230

Recent reports

High

ThreatsDay Bulletin: AI Agents, C2 Tools, ClickFix, JS Backdoors & 20+ Security Stories

The Hacker NewsJun 4 High

ROADtools and Nation-State Cloud Attacks: Persistence, Evasion, and Discovery Techniques

Palo Alto Unit 42May 22 High

Russian Threat Actor UTA0355 Spoofs European Security Events in Targeted Phishing Campaigns

VolexityDec 4 High

Russian Threat Actors Target M365 OAuth Workflows in Phishing Campaign

VolexityApr 22

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.