Threat actors worldwide continue to target victims of the Ukraine/Russia conflict with extensive phishing campaigns and deployment of various malware distributions onto victim devices. Throughout this conflict, phishing campaigns are being utilized at a significant rate, often targeting victims attempting to flee the country to escape the violence. Some campaigns that have been observed thus far include a threat group asking for charity funds for refugees, other actors asking for Bitcoin financial assistance, and supposedly providing communication assistance throughout the conflict. Threat actors have been successful in most campaigns as users are desperate for any assistance that they can get, which ultimately lead to malicious programs being dropped onto the user’s device(s). Campaigns have been seen using malicious Office documents (maldocs) to deliver their payloads, while others are more traditional with masked hyperlinks laced with malicious commands and communications to actor-controlled command-and-control (C2) nodes. From there, threat actors have the capability of deploying any number of ransomware, espionage, or remote access trojan payloads against the victim. CTIX continues to urge all users to verify the integrity of all email correspondence and report any suspicious activity.