UNC6293: Russian Sub-Cluster of Ice Relic Targeting Academia and Government

UNC6293 is a suspected Russian cyber espionage sub-cluster of Ice Relic (APT29), first detailed in June 2025. It conducts small-scale phishing campaigns impersonating State Department officials, abusing app passwords and OAuth verification codes to hijack accounts. Targets include academia, aerospace, defense, and think tanks in Europe and the U.S.