Russian organizations and government entities have been the targets of Chinese threat actors in a new targeting campaign. While not directly tied to one such threat organization, indicators of previous campaigns against Russia highlight several threat groups including Mustang Panda, Scarab, Space Pirates, and other groups. A recent campaign against Russia’s cybersecurity incident response center (RU-CERT) and telecommunication sectors revealed the use of social engineering attacks leveraging malicious Microsoft Office documents laced with the decade-old Bisonal remote-access trojan (RAT). The malicious payload exploits CVE-2018-0798, which is a memory flaw within Equation Editor in Microsoft Office 2007-2016 which allows for threat actors to remotely execute arbitrary code on the system. This same vulnerability was utilized by Chinese nation state hackers when targeting a Russian defense contractor involved with nuclear submarine designs. Security researchers from Ukraine stated that these phishing emails were compiled with a tool called “Royal Road”, which themes its payloads around Russian government interests. CTIX analysts continue to monitor threat actor activity worldwide and will provide additional updates accordingly.