APT-C-20

APT28, also known as Fancy Bear and tracked here as APT-C-20, is a well-known cyber espionage threat actor associated with Russia. The group is known for targeting government, diplomatic, and defense-related entities, particularly in contexts aligned with Russian strategic intelligence interests. In this activity cluster, the actor used a fileless intrusion chain centered on a malicious macro-enabled Microsoft Word lure with Eastern European defense-themed content. The operation employed layered defense evasion and in-memory execution. After macro execution, the malware dropped a malicious DLL and a seemingly benign PNG image, then established persistence through COM hijacking tied to Windows Explorer. The DLL loader validated its execution context, performed anti-analysis timing checks, extracted encrypted payload material hidden in image pixels using steganographic techniques, decrypted shellcode, and executed it entirely in memory. The shellcode then reflectively loaded an obfuscated C# backdoor. The backdoor gathered host and user context, generated a victim identifier, encrypted collected data, and communicated through cloud storage gateway infrastructure rather than a conventional dedicated command-and-control server. It also supported receipt and loading of additional attacker-supplied code, indicating flexible post-compromise capability. This tradecraft reflects emphasis on stealth, persistence, memory-resident execution, and evasion of conventional endpoint detection.