Chinese hackers from the Scarab threat organization have targeted Ukraine in a recent social engineering campaign. The Scarab threat group was first seen in the wild in 2015, however tactics and indicators of compromise tied to the group date back to 2012. These threat actors have targeted entities on a global scale, but commonly target United States and Russian individuals. In their recent attack against Ukraine, Scarab lured individuals with documents laced with macro-malware, which would deploy a payload once the document was opened or they were enabled by the user. Similar attacks related to this operation against Ukraine have been seen in the wild back in mid-2020. The payload in this campaign deploys the executable loader onto the system which in itself contains the first stage HeaderTip malware variant. HeaderTip’s sole directive is to establish a connection back to threat actor-controlled command-and-control (C2) servers to pull down additional second-stage malware. CTIX analysts continue to recommend that all users verify the contents of an email prior to opening any email attachments or clicking any external links to lower the potential for compromise.