Russian government organizations are continuously being targeted with spear phishing campaigns from an unknown threat organization. Since February 2022, threat actors have attacked these government entities with at least four (4) different phishing themes to lure in victims. The first occurred a few days after Russia invaded Ukraine, when threat actors injected a customized malware into a fake interactive map of Ukraine, deploying the malicious payload when executed. The next campaign utilized the Log4J exploit where threat actors distributed phishing emails to the Russia Today television network. The malicious Log4J-themed emails contained numerous file attachments which were laced with more custom malware by the threat actor. These files claimed to be from the state-backed Russian defense conglomerate Rostec. Another campaign unleashed by these threat actors utilized fake job description documents supposedly from Saudi Aramco which were infected with macro-malware, set to be deployed once the user enabled editing of the document. Once deployed, the malware communicated to actor-controlled command-and-control (C2) servers leaving behind some indicators for attribution. All four (4) campaigns utilize malware that is essentially identical with small code differences. Based on the indicators discovered by the Malwarebytes Threat Intelligence Team, there is a loose IP connection to China, but attribution cannot be assessed with high confidence at this time because this threat actor uses a variety of false flags to thwart analysts from tracing activity back to its origin. CTIX analysts continue to urge users to validate the integrity of suspicious emails prior to downloading any attachments or visiting embedded links to lessen the risk of threat actor compromise.