A new threat organization that has been targeting entities throughout the United States has surfaced in the past few months. The group is tracked as TA866 by security researchers and is financially-motivated based on observed tactics, techniques, and procedures (TTPs). TA866’s first campaigns have been operating since October 2022 and are continuing to prosper well into 2023. This financially-motivated operation is dubbed “Screentime” and has been commonly targeting United States companies, alongside newly observed international targeting of German organizations. TA866 distributes phishing emails to its targets containing a variety of malicious tools including embedded URLs to Publisher and JavaScript files, Publisher attachments with macro-malware, and PDFs embedded with URLs to malicious JavaScript files. These phishing emails were distributed to over ten thousand individuals across over a thousand companies in the United States and Germany. Initially these phishing emails were observed targeting individuals two (2) to four (4) times per week but have slightly reduced in the new year with an overall higher volume of phishing emails. The malicious URLs, attachments, and tooling are not unique to TA866 and are available throughout underground forums and marketplaces. CTIX continues to monitor new activity originating from TA866 and will provide additional updates accordingly.