The mass phishing campaign has been attributed to a threat actor that CERT-UA tracks as UAC-0050, with the agency describing the activity as likely motivated by espionage given the toolset employed.
Source: cyware.com