The compressed attachment of the “REQUEST FOR QUOTATION” email contains an exe: the malware. Stolen data is exfiltrated via Telegram API.
Syria, Russia’s jammers disturb aircraft GPS signals

Russia’s jammers disturb aircraft GPS signals. They are part of the air defense systems at the Khmeimim base in Latakia and do spoof. Israel asks to weaken them, but Moscow refuses
Russia has deployed powerful jammers in Syria that disturb GPS signals from aircraft. This was reported by the Israeli television channel KAN, adding that the Jewish state has sent a letter to Moscow denouncing that the electromagnetic signals coming from the defense systems of the Khmeimim air base (Latakia) are creating problems for the aircraft landing at the airport of Tel Aviv. However, Russia refused to take action, stating that the air defense systems were deployed precisely to protect its forces in the area. Therefore, they will not be removed or weakened. The jamming of GPS signals in the Middle Eastern country, however, has been going on for a month now. According to local sources, this is “spoofing”, ie a form of electronic warfare in which the satellite navigation system is deceived, falsifying the information displayed on locations and coordinates.