901
Last month , Trend Micro said a Russian hacking group known as Fancy Bear was using a similar email attack method that abused the OAuth protocol to phish victims .
 ( phishing: phish,  Fancy Bear: attacker, was using a similar email attack method: attack pattern, abused the OAuth protocol: attack pattern, victims: victim, Last month: time) 
Locate the role in the text that participated in the event based on the event type and return it in the event list. 
 Option: Event type: phishing, data breach, ransom, discover vulnerability, patch vulnerability, Arguments type: vulnerable system, capabilities, vulnerability, number of victim, issues addressed, compromised data, damage amount, common vulnerabilities and exposures, victim, patch number, number of data, tool, discoverer, time, purpose, place, payment method, releaser, vulnerable system version, attacker, supported platform, patch, price, vulnerable system owner, trusted entity, attack pattern. 
Text: {0} 
Answer:
 ( phishing: phish,  Fancy Bear: attacker, was using a similar email attack method: attack pattern, abused the OAuth protocol: attack pattern, victims: victim, Last month: time) 