Would be worth checking the meta data on those docs, looking for data manipulation/forgeries, analyzing the email header content, and seeing if the sender email appeared somewhere else in the open source, such as VT
More information here that the 3 outlets that received the leaked/suspected hacked material chose not use it for reporting due to concerns around suspicious origin
In russia:
1.) FSB call out newly revealed apparent iOS hacking campaign that's hit security researchers and diplomats:
2.) Kaspersky has more analysis of the campaign, reveals company staff were targeted:
If you’ve gotten an alert that looks like this (via email, iMessage, or a banner alert within your iCloud account) - please reach out: Christopher.Bing
@tr
.com — see sender account for verification in image below.
for years I heard LE officials make the argument for victims not to pay the ransom -- explaining it by saying that giving these ransomware crews more resources would improve theircapabilities.
This may be one of the more tangible examples of that dynamic at play.