In April, a campaign was spotted targeting the Russian officials, that points to a Chinese threat actor known as Mustang Panda. The attackers had employed phishing lures with English docs (named in the Russian language), which pretend to be released by the European Union and come with the details regarding sanctions against Belarus. Other Major Incidents Emotet operators (TA542) were spotted testing new attack techniques. Rocket Kitten was observed abusing a CVE-2022-22954 flaw to deploy the Core Impact Backdoor. A large-scale Monero crypto-mining campaign including LemonDuck malware was targeting the Docker APIs on Linux servers. Modified versions of malicious shell scripts belonging to the TeamTNT threat group were observed. A new Prynt stealer was spotted on the cybercrime forums.