Ukrainian cyber defenders report that fast-acting Russian military intelligence hackers have been targeting government agencies as well as organizations in Poland using backdoor malware tied to phishing lures based on a fake letter from the Ukrainian deputy prime minister.

The Computer Emergency Response Team of Ukraine on Thursday detailed a spear-phishing campaign that it has tied to the Russian advanced persistent group APT28, also known as Fancy Bear. Western intelligence agencies said APT28 is run by Russia’s GRU military intelligence agency.