Loading story…
Russia-linked APT28, also known as Swallowtail, Pawn Storm and Fancy Bear, reportedly deployed the newly identified Prismex malware toolkit in a cyberespionage campaign against military and humanitarian supply chains supporting Ukraine and its allies across Central and Eastern Europe. Prismex combines a dropper, loader and staging tool based on the open-source Covenant framework, using fileless execution, legitimate cloud services and advanced steganography to evade defenses. Trend Micro researchers assess that the toolkit represents a strategic expansion of the group's older NotDoor malware network. Reported access methods include exploitation of Microsoft Office bypass vulnerability CVE-2026-21509 and Windows vulnerability CVE-2026-21513.
APT28 also reportedly exploited CVE-2026-21513 in MSHTML before disclosure and patch availability to target diplomatic and defense-aligned organizations. Spear-phishing attachments containing malicious HTML reportedly triggered execution during document opening or previewing without requiring macros, followed by in-memory shellcode and loaders, HTTPS payload retrieval, persistence and encrypted command-and-control traffic. MSHTML remains reachable through Windows document-rendering and preview functionality even when Internet Explorer is not used. Defenders should prioritize the relevant Microsoft security updates, restrict previews of untrusted documents, monitor anomalous document-process and memory activity, and limit unnecessary outbound connections.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
Swallowtail, also known as APT28, reportedly launched a Prismex cyberespionage campaign against military and humanitarian supply chains supporting Ukraine and its allies across Central and Eastern Europe, exploiting vulnerabilities including CVE-2026-21509. Trend Micro researchers identified a dropper, loader, and Covenant-based staging tool using fileless execution, legitimate cloud services, and steganography, and assessed the toolkit as an expansion of the actor's NotDoor network.
APT28 reportedly exploited CVE-2026-21513 before public disclosure and patch availability, targeting diplomatic and defense-aligned organizations with malicious documents. Opening or previewing the attachments triggered in-memory execution without requiring macros, followed by payload retrieval and encrypted command-and-control communications.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russia-linked espionage group APT28, also known as Swallowtail and Fancy Bear, targeted a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency in two unnamed European NATO countries, according to Symantec. At the shipbuilder, an employee opened a malicious Microsoft Word email attachment, initiating an intrusion on July 24, 2026. The attackers deployed the Hookedge backdoor, conducted network reconnaissance and attempted credential theft. Related activity was observed through September 24, but researchers could not establish uninterrupted access or successful theft of sensitive information. Hookedge initially used webhook.site for tasking and result collection through a hidden Microsoft Edge browser, then switched to attacker-controlled infrastructure at **185.82.218.119**. Follow-on activity included an outbound SSH reverse tunnel and a PowerShell technique designed to capture local NTLM authentication exchanges. The attackers also deployed a previously undocumented reflective loader, **ld.exe**, designed to decrypt and execute a payload in memory; the encrypted payload was not recovered, leaving its ultimate functionality unknown. Researchers assessed that the apparently ongoing campaign supported Russian intelligence collection against European government and defense organizations. Defenders should investigate these indicators alongside unexpected SSH tunnels, hidden browser activity and suspicious Office attachment execution.
Oct 20, 2026
Ukraine’s CERT-UA reported active exploitation of a Microsoft Office zero-day, **CVE-2026-21509** (a security feature bypass), attributed to Russia-linked **UAC-0001 / APT28 (Fancy Bear)** and used to target Ukrainian government bodies and organizations across the EU. Microsoft disclosed the flaw with a warning that it was already being exploited in the wild, and CERT-UA observed rapid weaponization: a lure document titled `Consultation_Topics_Ukraine(Final).doc` appeared shortly after disclosure and was themed around EU discussions on Ukraine, suggesting the exploit chain was prepared in advance. CERT-UA also described a parallel phishing campaign impersonating the Ukrhydrometeorological Center, sent to 60+ recipients largely in Ukrainian central executive bodies. The attack chain described includes opening a malicious DOC that triggers a **WebDAV** connection to attacker infrastructure, downloads a shortcut (`.lnk`) used to stage additional payloads, and deploys components including a DLL masquerading as a legitimate Windows component (e.g., `EhStoreShell.dll`) with shellcode hidden in a decoy file (e.g., `SplashScreen.png`), alongside persistence techniques such as **COM hijacking** (registry modification) and scheduled task creation.
Feb 9, 2026
A joint advisory from CISA, NSA, FBI and allied agencies warns that Russia’s GRU Unit 26165, known as **APT28, Fancy Bear and Forest Blizzard**, has conducted cyberespionage against dozens of Western government and private-sector organizations supporting aid to Ukraine since 2022. Targets include air, sea and rail transportation providers, logistics companies and related technology services. Operators gain access through password spraying, credential-harvesting and malware-delivery spearphishing, and exploitation of internet-facing infrastructure, including VPNs. Reported exploited vulnerabilities include Outlook’s NTLM credential leak (**CVE-2023-23397**), several Roundcube flaws and WinRAR’s **CVE-2023-38831**. Follow-on reporting also identifies exploitation of **CVE-2023-20273**. After compromise, operators steal credentials, conduct Active Directory reconnaissance, move laterally using Impacket, PsExec and RDP, and abuse Microsoft Exchange mailbox permissions for sustained email collection. They use legitimate utilities alongside malware such as **HEADLACE and MASEPIE**, clear event logs, and exfiltrate data through OpenSSH and email interfaces. The advisory links the campaign to targeting of more than **10,000 internet-connected cameras**, concentrated in Ukraine and neighboring countries, to monitor aid movements; that figure represents targeted cameras, not confirmed compromises. Defenders should prioritize patching exposed services, strong authentication, privileged-access restrictions and segmentation, while hunting for abnormal mailbox permissions, credential theft, lateral movement and log clearing across endpoint, cloud and network telemetry. Persistent access could enable future disruption, but the reporting does not establish confirmed sabotage.
May 27, 2025