A group of state-sponsored Russian hackers are back in the news this week after launching their new campaign against Ukraine and its allies. The group is tracked as APT28 (Fancy Bear, Pawn Storm) and is known for their espionage campaigns against NATO countries. Campaigns attributed to the group include the French TV5Monde defacement of 2015, Democratic National Committee (DNC) compromise of 2016, and German government compromises between 2015 and 2017. Several group members were arrested in 2018 after their participation in the DNC attack, including nine (9) GRU officials. In this new campaign, APT28 actors distributed malicious phishing correspondence to the Ukrainian government. Masking themselves as system administrators, APT28 actors lured victims into interacting with their so-called “Windows Update” application. Upon executing this application at the command line, a PowerShell script is downloaded which begins to simulate a simple Windows system update. However, once this script begins a second-stage payload runs additional commands in the background to gather information about the infected system. Threat actors utilized the “.\tasklist.exe” and “.\systeminfo.exe” PowerShell commands and transmitted that data back to actor-controlled command-and-control (C2) servers. CTIX continues to track threat actor activity worldwide and will provide additional updates accordingly.