This activity has TTP and targeting overlap with previous activity, suspected to be APT29. The 2018 and 2016 LNK files are similar in structure and code, and contain significant metadata overlap, including the MAC address of the system on which the LNK was created