Since the beginning of the Russia/Ukraine conflict, threat organizations have taken matters into their own hands and begun a cyber war between allies and foes. Threat actors from the Trident Ursa are no different, but rather are expanding their operations and changing their previously observed tactics, techniques, and procedures (TTPs). Trident Ursa, also tracked as Gamaredon, UAC-0010, and Primitive Bear, is one of the more active threat groups in Russia, as well as threat actors being attributed to the Russian Federal Security Service (FSB). Over the past months, threat actors from Trident Ursa launched an unsuccessful attack on a major petroleum refinery on a North Atlantic Treaty Organization (NATO) member back in August, threatened a Ukrainian cybersecurity researcher following a network intrusion, and altered their attack TTP’s. Following a twitter post directed towards a Ukrainian cyber security researcher by an alleged Trident Ursa threat actor that stated “run, im coming for you” [sic], the same threat actor sent an ominous message to Shadow Chasers and TI Research stating “let’s be friends. We do not want to fight, but we do it well”. Aside from becoming more threatening on social media, Trident Ursa continues to launch simplistic cyber operations against their targets with the additions of new obfuscation techniques and tactics as needed. CTIX continues to monitor threat actors worldwide and will provide additional updates accordingly.