Security researchers have uncovered a new threat organization targeting users in the Eastern Ukraine region throughout the Russia/Ukraine conflict. The group is known by the monikers ‘Red Stinger’ and ‘Bad Magic’ and is believed to be operational since 2020. Since their operations began, the group launched a cyber campaign in April 2021, another campaign in February 2022 after the Russia/Ukraine conflict began, and a recent campaign affecting those throughout Eastern Ukraine. Each of these operations had varying delivery methods with different payloads and scripts, all of which deployed a variant of the “DBoxShell” (“PowerMagic”) malware. Threat actors conducting these operations have had success with exfiltrating documents from government entities. In one such case, Red Stinger actors targeted an individual in Ukraine and were able to detonate malware on their systems. In the short time before its detection, the malware was able to gather system screenshots, microphone audio recordings, internal documentation, and relay the data back to threat actor endpoints. Additional victims were also observed in Vinnitsya and Zhytomyr in the same operation while Russian-aligned entities were targeted in the most recent Red Stinger campaign. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.