A recent social engineering attack by Russian threat actors utilized nuclear war themed phishing emails to lure victims, ultimately leading to compromise of the user’s device. The threat organization connected to this campaign is APT28, commonly referred to as Fancy Bear or Sofacy. These threat actors have been active since 2004 with the prime directive of gathering intelligence on behalf of the Russian government. Historically, APT28 has reportedly compromised assets of the World Anti-Doping Agency (WADA), a United States nuclear facility, and several assets of the 2016 United States Presidential election. APT28 recently utilized nuclear threat documents in phishing emails to intrigue its victims to download the malicious email attachment titled “Nuclear Terrorism A Very Real Threat.rtf”. Once downloaded, malicious code exploits the Follina vulnerability (CVE-2022-30190), which impacts Microsoft Office applications. This allowed APT28 threat actors to drop a new .Net application which allows for gathering data from the user’s browser, including harvesting credentials, and exfiltrating the data to actor-controlled command-and-control (C2) endpoints. With tensions continuing to rise in the Russia/Ukraine conflict, this allows threat actors to use the act of war to socially engineer victims and spread their malicious activities throughout the region. CTIX urges users to verify the integrity of a suspicious email prior to opening any attachments or visiting any embedded links.