Analysts from the threat intelligence company Cyjax released a report on a large credential harvesting phishing campaign targeting governments in the APAC and EMEA regions. The report lists 53 domain’s that mimic various government departments. These countries include Armenia, Azerbaijan, Belarus, China, Georgia, Kyrgyzstan, Pakistan, Russia, Turkey, Ukraine, and Uzbekistan. Every website leads to a phishing page with a login to a mail server. After analysis of one of the IP addresses found a link to an APT campaign targeting Ukraine during the COVID-19 pandemic. This attack has been tentatively attributed to the threat groups UNC1151 and Hades/Sandworm which have been known to operate out of Russia. At the time of publication, 15 of these phishing pages were still active targeting the governments of Kyrgyzstan, Belarus, Georgia, Turkmenistan, Ukraine, Uzbekistan, and Pakistan.