I assume this is all the Grizzly Steppe evidence: https://us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity