A new operation conducted by the Fancy Bear threat organization is targeting users with malicious PowerPoint files through social engineering tactics. Fancy Bear, commonly referred to as APT28, has been active since 2004 and has been attributed to Russia’s General Staff Main Intelligence Directorate military unit. These threat actors have conducted several operations including compromising the 2016 Democratic National Committee, Democratic Constitutional Campaign Committee, and presidential candidate Hilary Clinton in an attempt to interfere with United States elections. The group has also been attributed to attacks against the World Anti-Doping Agency, United States Anti-Doping Agency, Organization for the Prohibition of Chemical Weapons, and domestic nuclear facilities. In their latest espionage campaign, Fancy Bear targets defense and government organizations associated with the European Union and other Eastern European countries. Phishing emails distributed to Fancy Bear targets claim to be originating from associates of the Organization for Economic Cooperation (OECD) and include a malicious PowerPoint file that contains droppers for the Graphite malware. In short, the Graphite malware variant lives solely within computer memory and is used to deliver post-exploitation frameworks and establish communications to command-and-control (C2) servers through Microsoft OneDrive. Exfiltrated data types from this campaign have not yet been specified. CTIX analysts urges users to validate the integrity of all email communications prior to downloading any attachments or visiting embedded links to lessen the risk of threat actor compromise.