Ransomware threat organizations have begun targeting entities and government organizations throughout Russia and surrounding regions. In one attack, “OldGremlin” threat actors unleashed two sophisticated phishing operations against Russian companies, which ultimately lead to the compromise of a Russian mining company. The themed phishing emails were styled around the user’s credit/debit card accounts and claimed new sanctions were shutting down their bank services. Once the user opened the malicious file attachment, OldGremlin’s newly updated trojan “TinyFluff” was installed onto the compromised device. Once installed, various scripts and ransomware loaders encrypt the entire file system and display a ransom message once the encryption is completed. Another incident targeting Russian organizations involves the Network Battalion 65 (NB65) threat organization, who conducted malicious operations against Russian-owned television and radio broadcasting networks. This attack allowed NB65 to exfiltrate 900,000 email communications and 4,000 files from the computer networks of these companies. Furthermore, NB65 has recently exposed source code from the Conti ransomware gang, stirring up activity from both threat groups. CTIX analysts continue to monitor threat actors worldwide and will provide updates accordingly.