Ukraine's CERT attributed the phishing effort to a Russian state-backed group known as Armageddon or Gamaredon.

Amid questions about the most recent cyberattacks on Ukraine a known adversary has been observed launching its own attacks.

Symantec looks at how the spies use infected Microsoft Word attachments to implant backdoor files allowing for the delivery of more malware.

Ukraine doxxed phone calls from the hackers, known in Ukraine as "Armageddon" but as Gamaredon elsewhere.

The suspected Russian hackers used current events in their campaign.

Previous research into Gamaredon determined that hackers included Russian phrases that, when translated into English, insulted Americans.