UNC1151 threat actors have been tied to a new phishing campaign in the wake of the Ukraine & Russia conflict. High level analysis of the campaign reveals that emails were distributed to Ukrainian military forces and European government personnel, which were laced with a malicious macro attachment. Emails would often state that the user’s contact information was originating from a spam bot, prompting the user to verify their information with a listed hyperlink. Additionally, the email contained a malicious attachment that would attempt to download a SunSeed malware variant to the user’s device. Once downloaded, the malware installs itself onto the host system followed up by outbound secure connections to actor-controlled command-and-control (2) endpoints, where additional payloads would be downloaded to the system. The payloads would exfiltrate messages and contact information from the compromised device and send it back to the threat actors where the information gathered could be exploited. CTIX analysts predict the continued attacks themed around the Ukraine-Russia conflict and expect a rise in themed phishing campaigns in the months to come.