Threat actors from the Russian cyber-espionage threat group Gamaredon have been targeting Ukrainian citizens in a new social engineering campaign. Gamaredon, also tracked as Primitive Bear, is known for its consistent targeting of Ukrainian law enforcement, military, judiciary, and non-profit organizations alongside a broader targeting of organizations throughout Europe in similar industries. Tactics demonstrated by Gamaredon threat actors include custom malware scripts, data exfiltration, spear-phishing, social engineering techniques, long term access, and compromised dynamic DNS. In this campaign, threat actors are targeting Ukrainian citizens with phishing emails themed around the Russia/Ukraine conflict. These phishing emails deliver malicious Microsoft Office document templates laced with VBScript macros, which download and execute LNK files from RAR archives to deliver second-stage malware payloads and information stealing scripts. However, in an effort to minimize digital traces and footprints Gamaredon has configured a geofence to restrict malicious hits to only users within the allotted region. Some of the indicators of compromise from this campaign overlap with an attack series on Ukraine’s Computer Emergency Response Team (CERT-UA). While Gamaredon have launched attacks outside of Ukraine, this campaign appears to be solely targeting individuals within Ukraine in an effort to gain headway in the ever-growing cyber war between the two countries. CTIX continues to monitor threat actors worldwide and will provide additional updates accordingly.