Loading threat actor…
UTA0355 is a Russian cyber-espionage threat actor tracked for highly targeted social-engineering operations that abuse legitimate Microsoft 365 and Microsoft Entra ID authentication workflows to compromise accounts and maintain access. The actor has been observed targeting individuals and organizations connected to Ukraine, human rights, foreign policy, and related civil-society and government networks. Reported victim approaches include spear-phishing emails, including messages sent from compromised Ukrainian government accounts, followed by one-on-one engagement over Signal and WhatsApp to build trust and guide victims through malicious authentication steps. UTA0355 is notable for exploiting legitimate OAuth and device-related authentication flows rather than relying on conventional credential phishing pages or malware delivery. Observed tradecraft includes tricking victims into sharing Microsoft-generated OAuth authorization artifacts, stealing Microsoft 365 OAuth tokens, registering rogue or unauthorized devices in Microsoft Entra ID, and using stolen authorization material to obtain access to Microsoft 365 resources through legitimate Microsoft APIs, including Microsoft Graph. In some cases, the actor used follow-on social engineering to induce victims to approve multi-factor authentication prompts, enabling mailbox access and broader account compromise. The actor has also used fake security conference and policy-event lures, polished registration workflows, and live “support” interactions over messaging apps to increase credibility and completion rates. UTA0355 activity has been associated with tooling and behaviors consistent with ROADtools, particularly token-management and device-registration capabilities that support reconnaissance, persistence, and defense evasion in Microsoft cloud environments. Reported post-compromise behavior includes access to victim email and files, use of newly registered devices to preserve access, and expansion of targeting through requests for colleague introductions or contact details. The actor’s operations are difficult to detect because they leverage first-party Microsoft infrastructure and legitimate authentication flows, blending malicious activity into normal cloud identity traffic. UTA0355 has been described as a Russian state-affiliated or Russian APT actor focused on espionage objectives rather than financially motivated extortion.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Observed in early 2025 phishing activity using ROADtools-related tradecraft to register rogue devices and steal Microsoft Graph API tokens.
Conducted a phishing campaign using tooling closely matching ROADtools token management capabilities in Microsoft cloud environments.
Referenced as a Russian threat group that has used device code phishing attacks to hijack Microsoft accounts.
Steals Microsoft 365 OAuth tokens using fake security conference lures and WhatsApp-based support/social engineering.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.