State Actor Uses Compromised Private Ukrainian Military Emails to Target European Governments and Refugee Movement

The infection chain used in this campaign bears significant similarities to a historic campaign Proofpoint observed in July 2021, making it likely the same threat actor is behind both clusters of activity.