A new threat organization has surfaced in the threat landscape and is actively targeting military and defense companies throughout Pakistan. Under the codename NewsPenguin, this group has launched an espionage campaign against Pakistan’s Navy, using the upcoming Pakistan International Maritime Expo & Conference as a ploy in their phishing attacks. The name NewsPenguin originates from encryption keys within headers which were titled ‘getlatestnews’ and ‘penguin’. Phishing emails from this campaign included a malicious Microsoft Office attachment with embedded macro-malware which, when enabled, would begin the infection chain, and compromise the user’s device. Analysis of the malware code shows that it was written to gather and transmit confidential data from the user’s system back to the threat actors. Indicators harvested from the malware showed geofencing capabilities (only executing certain code if the user’s device originates from a Pakistani IP address), exfiltration endpoints, and domains registered around mid-2022; this suggests that the campaign was in planning for over six (6) months. While NewsPenguin has not been attributed to any one country, Pakistan has often been a target of Chinese state-actors over the past few years. CTIX is continuing to monitor this emerging threat group alongside other organizations throughout the world and will provide additional updates accordingly.