Russia-link cyberespionage APT28 leverages COVID-19 as phishing lures to deliver the Go version of their Zebrocy (or Zekapab) malware. The lures consisted of documents about Sinopharm International Corporation, a pharmaceutical company involved in the development of a vaccine that is currently going through phase three clinical trials. The lure was delivered as part of a Virtual Hard Drive (VHD) file that could be accessed only by Windows 10 users.”]
Source: https://securityaffairs.co/wordpress/112137/apt/apt28-covid-19-zebrocy.html