Threat actors from the Asylum Ambuscade group have been observed conducting cybercriminal activity over the past several months. The group, however, has now begun to shift into the cyberespionage realm. Asylum Ambuscade has been active for just over two (2) years and is known for their continued attacks against banks and cryptocurrency outlets across the globe. The group has also shown signs of shifting focus away from cybercriminal activity and focusing more on cyberespionage. Historically, these threat actors were believed to be associated with a phishing campaign against the European Government after compromising email accounts from the Ukrainian Military, as well as using them as decoy accounts to spoof their movements and limit detection. Attacks often conducted by this group follow the same procedures as their previous campaigns, utilizing social engineering to deliver maliciously crafted Excel or Word documents. These documents often contained malicious payloads developed by Asylum Ambuscade actors, including SunSeed and AHKBOT malicious applications. To date, there have been roughly 4,500 victims of the Asylum Ambuscade threat organization on a global scale, most of which were contained within North America. These threat actors continue to make waves throughout the cybercrime and cyberespionage world and will continue to be an active threat for the months to come. CTIX analysts continue to monitor threat actor activity worldwide and will provide additional updates accordingly.