WASHINGTON (AP) — Hackers working for Russian intelligence recently attacked an American engineering company, investigators at an American cybersecurity company said, seemingly because that firm had worked for a United States municipality with a sister city in Ukraine.

The findings reflect the evolving tools and tactics of Russia’s cyber war and demonstrate Moscow’s willingness to attack a growing list of targets, including governments, organizations and private companies that have supported Ukraine, even in a tenuous way.

Arctic Wolf, the U.S. cybersecurity firm that identified the Russian campaign, wouldn’t identify its customer or the city it worked with to protect their security, but said the company had no direct connection to Russia’s invasion of Ukraine. However, the group behind the attack, known to cybersecurity analysts as RomCom, has consistently targeted groups with links to Ukraine and its defense against Russia.

“They routinely go after organizations that support Ukrainian institutions directly, provide services to Ukrainian municipalities and assist organizations tied to Ukrainian civil society, defense or government functions,” said Ismael Valenzuela, Arctic Wolf’s vice president of labs, threat research and intelligence.

The attack on the engineering firm was identified by Arctic Wolf in September before it could disrupt the engineering company’s operations or spread further.

A message left with officials at the Russian Embassy in Washington seeking comment was not immediately returned.

Many towns and cities around the world enjoy sister-city relationships with other communities, using the program to offer social and economic exchanges. Several U.S. cities, including Cincinnati, Chicago, Baltimore and Albany, N.Y., have sister-city relationships with communities in Ukraine.

The campaign in September came a few weeks after the FBI warned that hackers linked to Russia were seeking to break into U.S. networks as a way to burrow into important systems or disrupt critical infrastructure. According to the latest bulletin from the U.S. Cybersecurity and Infrastructure Security Agency, the Russia-aligned hackers have multiple motives: disrupting aid and military supplies to Ukraine; punishing businesses with ties to Ukraine; or stealing military or technical secrets.

In October, the Digital Security Lab of Ukraine and investigators at SentinelOne, a U.S. cybersecurity firm, exposed a speedy and sprawling cyberattack on relief groups supporting Ukraine, including the International Red Cross and UNICEF. That hacking campaign used fake emails impersonating Ukrainian officials that sought to fool users into infecting their own computers by clicking on malicious links.