TA499__2023__Proofpoint_Russia-Aligned-TA499-Beleaguers-Targets-Video-Call-Requests_03-07-2023.pdf

Proofpoint documents TA499 (Vovan/Lexus), a Russia-aligned threat actor, conducting targeted email campaigns to induce high-profile officials and executives to engage in recorded video calls or phone conversations. The campaigns impersonate Ukrainian authorities, Ukrainian embassies, and Navalny-affiliates to spread propaganda, often using social engineering and domain impersonations, with multiple IOCs and examples of email artefacts, and even public YouTube postings of the calls.