Scarab attackers took aim at select Russian targets since 2012

The Scarab threat group has conducted highly targeted campaigns against Russian-speaking individuals since 2012, using Trojan.Scieron and Trojan.Scieron.B delivered by phishing emails and exploits; the campaigns feature backdoor/rootkit capabilities, C2 over DNS, and Russian-language lures (including G20-themed topics), with Russia as the primary target and limited infections per victim.