State-Sponsored Actors Using Russia-Ukraine War for Phishing

Researchers have observed a growing number of threat actors using the Russia-Ukraine war as a lure in phishing and malware campaigns to target the military of multiple Eastern European countries, as well as a NATO Center of Excellence. Google’s Threat Analysis Group observed that government-backed actors from China, Iran, North Korea and Russia, as well as various unattributed groups, have used themes related to the Russia-Ukraine war in an effort to get targets to open malicious emails or click on malicious links.