Loading story…
Russian state-linked APT28 (aka Fancy Bear/Sednit/Sofacy/STRONTIUM) conducted Operation MacroMaze, targeting selected organizations in Western and Central Europe from September 2025 through January 2026 using spear-phishing emails carrying weaponized Microsoft Office documents. The documents’ XML contained an INCLUDEPICTURE field that forced Microsoft Word to fetch a remote image (e.g., docopened.jpg) from webhook[.]site, functioning as a tracking mechanism that generated outbound HTTP requests to confirm when a victim opened the lure and updated fields.
After initial execution, the campaign relied on macro-enabled malware and “basic” tooling (e.g., batch scripts, small VBS launchers, simple HTML) arranged to maximize stealth, including hiding activity in off-screen/hidden browser sessions and cleaning up artifacts. Reporting notes that macro implementations evolved over the campaign, with newer variants shifting techniques (e.g., keyboard simulation replacing headless browser execution) to evade detection, while continuing to leverage widely used webhook services for payload delivery and covert data exfiltration.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
In February 2026, S2 Grupo's LAB52 disclosed technical details of Operation MacroMaze, describing the tooling, exfiltration method, and links to prior APT28 tradecraft noted by CERT Polska and Ukraine's CERT. The research assessed the malware as relatively simple but operationally effective.
Researchers said the observed MacroMaze activity ran through January 2026, marking the end of the documented intrusion window. The campaign used Microsoft Edge and auto-submitting HTML forms to exfiltrate collected command output to webhook[.]site with limited disk artifacts.
During the campaign, APT28 used multiple macro variants that dropped VBS, batch, and HTML files, established persistence with a Scheduled Task, and cleaned up artifacts. Later variants added fake Word errors and SendKeys-based UI manipulation to bypass prompts and reduce detection compared with earlier execution methods.
From September 2025, the Russia-linked APT28 group began targeting select organizations in Western and Central Europe with spear-phishing emails carrying weaponized Microsoft Word documents. The lures abused the XML "INCLUDEPICTURE" field to contact webhook[.]site, helping confirm when victims opened the files.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
paubox.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed a **Zebrocy** malware campaign linked to **Sofacy / APT28 (Fancy Bear)** that used malicious Microsoft Word documents with embedded **VBA macros** to deliver a Delphi-written payload, `wininition.exe`. SentinelLabs traced a March 2021 cluster targeting **Kazakhstan**, including six lure documents that shared the same macro logic; two samples appeared to have been uploaded from victim environments in the country. Once executed, the payload installed a low-level keyboard hook to capture keystrokes and exfiltrated the data to command-and-control infrastructure hosted on apparently compromised domains. The reporting aligns with earlier research showing Zebrocy’s evolving, **multilanguage** toolset and flexible delivery methods. Analysts said the operation combined document-based initial access with malware written in multiple languages, including Delphi, and used reverse-engineering techniques to unpack password-protected macros and inspect the payload. The investigation also uncovered additional Zebrocy clusters and produced **indicators of compromise** and **YARA rules** to help defenders detect related activity.
Aug 15, 2026
Ukraine’s CERT-UA reported active exploitation of a Microsoft Office zero-day, **CVE-2026-21509** (a security feature bypass), attributed to Russia-linked **UAC-0001 / APT28 (Fancy Bear)** and used to target Ukrainian government bodies and organizations across the EU. Microsoft disclosed the flaw with a warning that it was already being exploited in the wild, and CERT-UA observed rapid weaponization: a lure document titled `Consultation_Topics_Ukraine(Final).doc` appeared shortly after disclosure and was themed around EU discussions on Ukraine, suggesting the exploit chain was prepared in advance. CERT-UA also described a parallel phishing campaign impersonating the Ukrhydrometeorological Center, sent to 60+ recipients largely in Ukrainian central executive bodies. The attack chain described includes opening a malicious DOC that triggers a **WebDAV** connection to attacker infrastructure, downloads a shortcut (`.lnk`) used to stage additional payloads, and deploys components including a DLL masquerading as a legitimate Windows component (e.g., `EhStoreShell.dll`) with shellcode hidden in a decoy file (e.g., `SplashScreen.png`), alongside persistence techniques such as **COM hijacking** (registry modification) and scheduled task creation.
Jun 29, 2026
**APT28** (Russia-linked) has been observed exploiting a **Microsoft Office RTF zero-day, `CVE-2026-21509`**, in a campaign dubbed **Operation Neusploit** targeting organizations in **Central and Eastern Europe** (including **Ukraine, Slovakia, and Romania**). The intrusion chain begins with **socially engineered emails** delivering **weaponized RTF documents**; opening the file triggers code execution and downloads a malicious **dropper DLL** from attacker-controlled infrastructure, enabling follow-on payload deployment and persistence. Technical analysis describes **two dropper variants** that deploy different components, including **MiniDoor**, a malicious **Microsoft Outlook VBA** project designed to **steal and forward emails**. Observed behaviors include writing the VBA payload to `%appdata%\Microsoft\Outlook\VbaProject.OTM`, creating a mutex (`adjgfenkbe`), and modifying Windows Registry settings to **weaken Outlook security** so the malicious project loads automatically at Outlook startup; string decryption uses XOR routines (including a hardcoded `0x3a` key and a rolling XOR key). Reporting attributes the activity to APT28 based on TTP overlaps and notes exploitation was seen **in the wild** shortly after Microsoft issued an emergency fix.
Aug 21, 2026