UNC7005
UNC7005 is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets 4 sectors, including Government, and Transportation and Logistics, in the United States and Ukraine. It uses 4 MITRE ATT&CK techniques.
- STORM-2945
- Techniques
- 4
- Exploited CVEs
- No CVE data
- First seen
- Feb 1, 2026
- Last seen
- Aug 13, 2026
- Record updated
Who They Target.
About UNC7005.
UNC7005, also known as STORM-2945, is a suspected Russian cyber espionage cluster active since at least February 2026 and assessed to perform initial-access operations aligned with Russian state interests. The cluster targets personnel in academia, diplomacy, defense and nonprofit research across Ukraine, Western Europe and the United States using tailored phishing and account-compromise workflows. Observed operations combine app-password, OAuth and device-code phishing, messaging-device-linking lures, traffic manipulation through compromised captive portals, and malware delivery for credential theft and persistent access. Public reporting links the cluster to a broader Russian espionage actor, but this attribution remains an analytic assessment rather than an independently confirmed identity.
Last updated Sep 24, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.