Recent analysis reveals two clusters of malicious archives targeting Ukraine and Poland since April 2025, linked to UAC-0057 (also known as UNC1151, FrostyNeighbor or Ghostwriter). The infection chains aim to collect system information and deploy implants for further exploitation, using readily available tools for obfuscation and packing. The threat actor's toolset and practices have evolved, including the use of Slack for C2 communication and transitions to new top-level domains for infrastructure. The campaigns consistently target Ukraine and Poland, with potential expansion to other European countries. Notable tactics include weaponized XLS spreadsheets with obfuscated VBA macros, C# and C++ downloaders, and infrastructure mimicking legitimate websites.