APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine and NATO Allies
Summary: Trend Micro researchers Feike Hacquebord and Hiroyuki Kakara linked APT28 (Forest Blizzard, Pawn Storm) to a spear-phishing campaign active since at least September 2025 that targets Ukrainian central executive bodies, hydrometeorology, defense and emergency services, plus rail logistics in Poland, maritime and transportation in Romania, Slovenia and Turkey, ammunition-related partners in Slovakia and the Czech Republic, and military and NATO partners. The campaign deploys MiniDoor, an Outlook email stealer, or PRISMEX, a malware suite that hides payloads in image files via steganography and uses COM hijacking and legitimate cloud services for command-and-control, and it weaponized CVE-2026-21509 and CVE-2026-21513, with infrastructure preparation seen on January 12, 2026, two weeks before the first was publicly disclosed.
Bottom line: Trend Micro observed infrastructure staged two weeks before Microsoft disclosed CVE-2026-21509, and a COVENANT Grunt payload in an October 2025 incident that ran a wiper erasing all files under %USERPROFILE% - evidence the same intrusion set can conduct espionage and sabotage, aimed at the supply chains and operational planning of Ukraine and its NATO partners.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-21509CVE-2026-21513
- Related
- Patch Tuesday, February 2026 Edition Cyber Risks ·CVE-2026-21513: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability Known Exploited Vulnerabilities · Feb 10, 2026