Russian government agencies are the latest victims of a recent phishing campaign by Chinese threat actors. These actors utilized several tactics, techniques, and procedures (TTP) that possibly link with recent Stone Panda (APT10) espionage campaigns. While some TTPs may correlate with Stone Panda, CheckPoint security researchers have classified them as their own threat group dubbed Twisted Panda. The campaign itself was first discovered in July 2021 targeting entities throughout the Russian nation; in recent events, however, threat actors have targeted two (2) research institutes operated by Rostec, a state-operated defense organization. The phishing emails were themed around institutions being targeted by United States sanctions related to the ongoing Russia-Ukraine conflict. Once opened, the user is met with both a hyperlink and a malware-laced document. The hyperlink directs the user to a malicious cloned website claiming to be the Russian Ministry of Health. The document claims it is from the Russian Ministry of Health but is laced with a multi-layered payload which installs the SPINNER backdoor on the infected system. The specific information being harvested from this backdoor is currently undisclosed, however by targeting research institutions it is likely threat actors are exfiltrating sensitive project documentation and other information wherever possible. CTIX analysts continue to urge users to validate the integrity of all emails prior to downloading any attachments to lessen the chance for threat actor compromise.