In February 2025, TA406 began targeting government entities in Ukraine, delivering credential harvesting and malware in its phishing campaigns. The…