Since the start of the Russia/Ukraine conflict, threat actors globally have chosen sides defending their respective countries. Recently, financially motivated TrickBot threat actors have started targeting Ukrainian assets, unleashing six campaigns since mid-April. These campaigns encompassed several new tactics, tools, and procedures including the deployment of infected Microsoft Excel documents to install payloads, and self-extracting archives designed to deliver AnchorMail, CobaltStrike, and IcedID. Statistics captured by X-Force analysts show that Excel downloaders were utilized in three (3) of the campaigns, and five (5) of the campaigns deployed CobaltStrike, Meterpreter, or AnchorMail to the target system. These campaigns targeted several audiences including general citizens of Ukraine, state departments, state authorities of Ukraine, critical infrastructure entities, and individual corporations or organizations throughout the region. To lure in their victims, TrickBot deployed several themed phishing emails with subjects such as “List of mobilized citizens”, “Urgent! Unblocking Azovstal”, “Decree of the Press Office of the European Union No. 576/22 on uninterrupted security measures”, and “State Tax Service of Ukraine”. With the recent takeover of TrickBot by pro-Russian Conti threat actors, it comes as no surprise that they have sided with Russia in the conflict. CTIX will continue to monitor threat actor movements throughout this conflict and provide additional updates as needed.