APT28 spearphishing G20 attendees with stolen email(proofpoint.com)

https://www.proofpoint.com/us/threat-insight/post/turla-apt-actor-refreshes-kopiluwak-javascript-backdoor-use-g20-themed-attack