From CyberScoop: "In December, Kyle Ehmke, a researcher for Arlington, Virginia-based ThreatConnect, discovered a number of phishing links that looked to be spoofing Ukraine-based organizations. After Area 1’s report was released, Ehmke said the links, along with some other tactics, pointed to behavior that could be linked with APT28.

“Ultimately, none of these characteristics are definitively indicative of APT28 activity and we don’t have any specific information on how the domains have been operationalized,” Ehmke said in a tweet. “However, considering the possible targets that the domains spoof and given the aforementioned non-definitive consistencies, we assess with moderate confidence that the domains probably are associated with APT28 operations.”