Recently, in a spam campaign targeted towards Bulgarian users, malicious JavaScript based Dreambot downloader was sent inside an archive file. The theme of the emails was related to "Notification of changes to Regulation for NRA" .
NRA is the National Revenue Agency in Bulgaria (in Bulgarian it is: Национална агенция за приходите).
http://www.pwncode.club/2017/09/dreambot-targeting-bulgarian-users.html