UnclassifiedUnknown
UTA0352
UTA0352 is a Russia-attributed threat actor group, tracked by Brandefense.
- Origin
- Russia
- Techniques
- 0
- Exploited CVEs
- No CVE data
- Record updated
About UTA0352.
UTA0352 is a Russian threat actor attributed to phishing campaigns that exploit Microsoft OAuth 2.0 authentication workflows, often impersonating government officials to lure targets into providing sensitive information. The actor has been observed using malicious URLs disguised as legitimate services, such as a Romanian government authentication system. UTA0352 has also targeted Microsoft Teams and employed social engineering tactics via messaging platforms like Signal and WhatsApp.
Last updated Oct 9, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.