Threat reportAPTTL-2026-0083
Operation MacroMaze: APT28 Campaign Targeting Western & Central Europe via Evolving Macro Droppers & Legitimate Infrastructure Abuse
Operation MacroMaze: APT28 (Fancy Bear / Forest Blizzard / FROZENLAKE) campaign targeting Western and Central European entities using macro-enabled document droppers, INCLUDEPICTURE tracking pixels, and legitimate service abuse (webhook.site) for C2 and exfiltration. Active September 2025 through January 2026. Four macro variants showing progressive evasion evolution.
Key facts for APT28 MacroMaze campaign
| Identifiers | TL-2026-0083 |
|---|---|
| Severity | MEDIUM |
| Weaknesses (CWE) | CWE-829 |
| Attribution | APT28 (high confidence) |
| Nation-state nexus | Russia |
| Malware | Headlace |
| MITRE ATT&CK techniques | T1005 Data from Local System, T1016 System Network Configuration Discovery, T1027 Obfuscated Files or Information, T1036 Masquerading, T1041 Exfiltration Over C2 Channel, T1053 Scheduled Task/Job, T1059 Command and Scripting Interpreter, T1070 Indicator Removal, T1071 Application Layer Protocol, T1074 Data Staged, T1082 System Information Discovery, T1083 File and Directory Discovery and 13 more in the attack flow |
| Motivation | ESPIONAGE |
| Target sectors | Government, Diplomacy, Defense, European Union Institutions, Think Tanks, Energy, Finance, Academic |
| Target regions | Western Europe, Central Europe, Spain, Poland, Romania, Hungary, Turkey, Ukraine, Belgium, Germany, Italy, Latvia |
| Detection rules | 12 (1 shown free) |
| Sources | 7 cited sources |
Detection coverage for APT28 MacroMaze campaign
As of 2026-02-13, Threadlinqs Intelligence publishes 12 detection rule(s) for TL-2026-0083 across Splunk SPL, Microsoft KQL and Sigma, covering 43 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: Operation MacroMaze — WINWORD.EXE Outbound HTTP Request to webhook.site (INCLUDEPICTURE Tracking Pixel Document-Open Confirmation)
Detects the INCLUDEPICTURE tracking pixel mechanism used by APT28 in Operation MacroMaze. All analyzed MacroMaze documents contain an INCLUDEPICTURE field in the document XML (w:instrText) referencing a remote URL on webhook.site (e.g., /docopened.jpg). When the victim opens the document and Word evaluates the field, WINWORD.EXE makes an outbound HTTP request to webhook.site — functioning as a document-open confirmation beacon. This fires BEFORE macro execution, giving APT28 operational intelligence (document opened, victim IP, Office version) regardless of whether macros are subsequently enabled. Legitimate Word documents almost never reference webhook.site resources. Any WINWORD.EXE network connection to webhook.site is a HIGH-confidence indicator of MacroMaze or similar APT28 campaign targeting.
- Language: Splunk SPL
- ATT&CK: T1566.001, T1102.002, T1071.001
- Data sources: proxy_logs, sysmon, network_monitoring, dns_logs
- Severity: critical
- Confidence: high
Splunk SPL
index=proxy OR index=sysmon OR index=network
| where (process_name="WINWORD.EXE" OR Image LIKE "%\\WINWORD.EXE" OR src_process="WINWORD.EXE")
AND (url LIKE "%webhook.site%" OR dest LIKE "%webhook.site%" OR DestinationHostname LIKE "%webhook.site%" OR QueryName LIKE "%webhook.site%")
| eval detection="CRITICAL — APT28 MacroMaze INCLUDEPICTURE tracking pixel: WINWORD.EXE connecting to webhook.site"
| eval tracking_type=case(
url LIKE "%docopened%", "Document-open confirmation beacon (docopened.jpg tracking pixel)",
1=1, "Potential webhook.site C2 communication from Word process")
| eval next_steps="IMMEDIATE: (1) Isolate endpoint (2) Identify and quarantine the opened document (3) Check for 6 GUID-named files in %USERPROFILE% (4) Check for newly created scheduled tasks (5) Check for msedge.exe --headless launched by scripts"
| stats count AS events, earliest(_time) AS first_seen, latest(_time) AS last_seen, values(url) AS urls, values(Computer) AS hosts BY detection, tracking_type, User
| table detection, tracking_type, hosts, User, urls, events, first_seen, last_seen, next_stepsKnown false positives:
- Legitimate Word documents referencing webhook.site resources — extremely rare. Developers may use webhook.site but not from within WINWORD.EXE. If seen, verify the document origin and content.
Tuning notes: This is the EARLIEST detection point in the MacroMaze kill chain — fires when the document is opened, before macro execution. Requires proxy logs, Sysmon DNS queries (Event ID 22), or network connection monitoring (Event ID 3) capturing the WINWORD.EXE process making external requests. Extend the domain list to include run.mocky.io and mockbin for broader APT28 legitimate-service-abuse coverage. The /docopened.jpg path is campaign-specific — APT28 may change the path in future campaigns, so detect on the process+domain combination, not the specific path.
- Operation MacroMaze — Microsoft Edge Launched in Headless or Off-Screen Mode by Script Interpreter (Browser-Based Exfiltration via BAT/CMD/VBS Parent Process) · unlock with TL Creds
- Operation MacroMaze — Office Process Executing VBA Macro with SendKeys API Call (Automated Security Prompt Bypass — Variant 4 January 2026) · unlock with TL Creds
- Operation MacroMaze — Aggressive Microsoft Edge Process Termination by Script Interpreter (taskkill /f /im msedge.exe from BAT/CMD — Batch Variant 2 Reliability Pattern) · unlock with TL Creds
- Operation MacroMaze — WINWORD.EXE Spawning Script Interpreters After Document Open (VBA Macro Dropper Initial Execution) · unlock with TL Creds
- Operation MacroMaze — Scheduled Task with Non-Standard Interval Executing Script from User Profile (Prime-Number Persistence Evasion) · unlock with TL Creds
- Operation MacroMaze — Base64-Encoded HTML Data URI Loaded by Microsoft Edge from Script Context (Fragment-Based Payload Download and Exfiltration Rendering) · unlock with TL Creds
- APT28 MacroMaze — Malicious Office Macro Dropping Encoded Payload · unlock with TL Creds
- APT28 MacroMaze — Multi-Stage Loader with Anti-Analysis Checks · unlock with TL Creds
- APT28 MacroMaze — HeadLace Backdoor C2 Communication Pattern · unlock with TL Creds
- Operation MacroMaze — Multi-File Drop to %USERPROFILE% with Script and HTML File Types (VBS/BAT/CMD/HTM/XHTML GUID-Named Dropper Payload) · unlock with TL Creds
- Operation MacroMaze — Scheduled Task Created via XML Import from User Profile Directory Targeting VBScript (schtasks Persistence Installation) · unlock with TL Creds
Indicators of compromise for APT28 MacroMaze campaign
As of 2026-02-13, Threadlinqs Intelligence tracks 43 indicators of compromise for TL-2026-0083.
Sample indicators (3 of 43)
- Domain:
webhook[.]site - File hash:
b0f9f0a34ccab1337fbcca24b4f894de8d6d3a6f5db2e0463e2320215e4262e4 - File hash:
c3b617e0c6b8f01cf628a2b3db40e8d06ef20a3c71365ccc1799787119246010
Defanged, TLP:CLEAR. Full set of 43 indicators: unlock with TL Creds.
How APT28 MacroMaze campaign works
Delivers multi-stage payload chain using VBS, BAT, CMD, and HTML files with GUID-based filenames. Exfiltrates system reconnaissance via browser-rendered HTML form POST to webhook.site. Kill chain matches APT28's HEADLACE malware pattern previously documented by IBM X-Force and CERT Polska.
Lab52 (S2 Grupo) disclosed Operation MacroMaze, a sustained APT28 campaign active from late September 2025 through January 2026, targeting specific entities in Western and Central Europe. The campaign relies on basic but carefully orchestrated tooling — macro-enabled Office documents, batch files, VBScript launchers, and HTML templates — combined with legitimate infrastructure abuse (webhook.site) for both command and control and data exfiltration.
The campaign opens with spear-phishing emails delivering macro-enabled documents (.docm). One confirmed lure impersonates an agenda from the Spanish Ministry of the Presidency, Justice and Relations with the Courts, reproducing content from official government publications dated September 18-23, 2025. All analyzed documents share a structural element: an INCLUDEPICTURE field in the document XML (w:instrText) referencing a remote docopened.jpg file on webhook.site — functioning as a document-open tracking pixel that confirms victim engagement before payload delivery.
Four macro variants were identified, showing progressive evolution: - Variant 1 (September 2025): Core dropper with document cleanup (removes ContentControls, changes text to black) - Variant 2 (October 2025): Adds fake Microsoft Word error message to explain document appearance anomalies - Variant 3 (December 2025): Removes document cleanup but retains fake error message - Variant 4 (January 2026): Adds SendKeys automation (DOWN, ENTER, UP) to dismiss 'Enable Content' security warnings automatically — the most evolved evasion
All variants use heavy string concatenation obfuscation (e.g., 'WScri' + 'pt.shell') and drop six files into %USERPROFILE% with GUID-based filenames matching the webhook.site C2 path extension. Files include VBS launchers, BAT/CMD scripts, and HTM/XHTML exfiltration templates.
Execution chain: Macro → VBS launcher → CMD file → Edge browser (headless or off-screen) renders Base64 HTML → downloads fragments from webhook.site → reconstructs CMD payload → executes → captures output → merges with HTM/XHTML templates → renders final HTML in Edge → auto-submitting form POSTs data to webhook.site C2.
Persistence is established via Windows Scheduled Tasks with XML definitions written to disk at runtime then imported via schtasks. Repetition intervals evolved: 30 minutes (v1) → 20 minutes (v2) → 61 minutes (v3/v4).
Two batch file variants handle the execution differently: - Batch 1: Stealth-focused — uses Edge headless mode, targeted window-title termination (taskkill /fi WindowTitle) - Batch 2: Reliability-focused — uses off-screen positioning (--window-position=10000,10000), forceful Edge process kill (taskkill /f /im msedge.exe), adds --ignore-certificate-errors
The kill chain is virtually identical to APT28's HEADLACE malware, documented by IBM X-Force (ITG05) and CERT Polska in 2023-2024 campaigns targeting Polish government institutions and 13+ nations worldwide. HEADLACE also used webhook.site and run.mocky.io for payload staging and C2, with MSEdge headless mode for continuous secondary payload download and exfiltration. The CERT Polska campaign used DLL side-loading (fake WindowsCodecs.dll loaded by renamed calculator) as the initial execution vector, while MacroMaze uses Office macros — suggesting APT28 maintains parallel delivery mechanisms.
Lab52 noted the campaign demonstrates that 'simplicity can be powerful' — basic tools arranged with operational care maximize stealth by moving operations into hidden browser sessions, cleaning up artifacts, and outsourcing infrastructure to ephemeral webhook services. The operator favors brief, low-visibility intrusions over long-term implants.
MITRE ATT&CK techniques by tactic:
collection
T1005 Data from Local System; T1074 Data Staged
discovery
T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1564 Hide Artifacts
exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1204 User Execution
command-and-control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer
defense-impairment
initial-access
resource-development
T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities; T1608 Stage Capabilities
Remediation for APT28 MacroMaze campaign
Immediate actions
- Block macro execution in Office documents from external/internet sources via Group Policy (HKCU\Software\Microsoft\Office\*\Security\blockcontentexecutionfrominternet)
- Block webhook.site and run.mocky.io at network perimeter for organizations that do not use these services
- Deploy email gateway rules to quarantine .docm attachments with INCLUDEPICTURE external references
- Monitor for schtasks.exe importing XML task definitions from %USERPROFILE% directories
- Block Edge headless mode execution from non-development user accounts
Workarounds
- Disable VBA macros enterprise-wide via Group Policy if macro functionality is not business-critical
- Configure email gateway to strip or sandbox .docm/.xlsm attachments before delivery
- Enable Attack Surface Reduction rules for Office macro child process blocking
Longer-term hardening
- Implement Attack Surface Reduction (ASR) rules: Block Office applications from creating child processes
- Deploy application control policies restricting VBS/BAT/CMD execution from %USERPROFILE%
- Implement DNS filtering/monitoring for webhook.site, run.mocky.io, and similar ephemeral service domains
- Enable Protected View and Application Guard for Office documents from external sources
- Deploy Sysmon with configuration monitoring macro-enabled document child process creation
Timeline of APT28 MacroMaze campaign
- CERT-UA reports APT28 using Headlace malware against Ukrainian energy infrastructure. Source: https://cert.gov.ua/article/5702579
- IBM X-Force discloses ITG05 (APT28) campaign delivering Headlace via Israel-Hamas conflict lures, targeting 13+ nations. Kill chain matches MacroMaze pattern. Source: https://www.ibm.com/think/x-force/itg05-ops-leverage-israel-hamas-conflict-lures-to-deliver-headlace-malware
- CERT Polska discloses APT28 campaign targeting Polish government — DLL side-loading, locked-ioc-55 C2, Edge headless exfiltration. Highly similar kill chain to MacroMaze. Source: https://cert.pl/en/posts/2024/05/apt28-campaign/
- Spanish Ministry of the Presidency issues agenda used as lure material. APT28 reproduces official content published September 23 on La Moncloa website.
- Macro Variant 1 detected — earliest Operation MacroMaze artifact. Drops 6 files to %USERPROFILE%, establishes 30-minute scheduled task persistence, uses document cleanup (ContentControls removal). Source: https://lab52.io/blog/operation-macromaze-new-apt28-campaign-using-basic-tooling-and-legit-infrastructure/
- Macro Variant 2 detected — adds fake Microsoft Word error message to disguise document anomalies, maintains 20-minute scheduled task interval.
- Macro Variant 3 detected — removes document cleanup routines, retains fake error message, increases scheduled task interval to 61 minutes.
- Macro Variant 4 detected — most evolved version. Adds SendKeys automation (DOWN, ENTER, UP) to dismiss 'Enable Content' security warnings automatically. Direct iteration of Variant 3.
- Lab52 (S2 Grupo) publishes Operation MacroMaze report, attributing campaign to APT28 targeting Western and Central European entities. Source: https://lab52.io/blog/operation-macromaze-new-apt28-campaign-using-basic-tooling-and-legit-infrastructure/
- As of 2026-05-29, Operation MacroMaze is a concluded APT28 campaign (active Sept 2025-Jan 2026, last variant V4 in Jan 2026), described in past tense by Lab52, The Hacker News and SC Media with no activity since and no CVE/patch involved. The actor APT28/GRU Unit 26165 remains highly active (new Storm-2754 and router campaigns through April 2026) and the macro/SendKeys/locked-ioc-55 TTPs stay viable, so the record warrants continued MONITORING rather than closure.
Sources cited for APT28 MacroMaze campaign
- CERT Polska — APT28 campaign targeting Polish government institutions cert.pl · Advisory · 2024-05-09
- CERT-UA — APT28 Headlace backdoor targeting Ukrainian energy infrastructure CERT-UA · Advisory · 2023-09-01
- MITRE ATT&CK — APT28 Group Profile (G0007) MITRE · Other · 2024-01-01
- Lab52 — Operation MacroMaze: new APT28 campaign using basic tooling and legit infrastructure lab52.io · Blog · 2026-02-13
- IBM X-Force — ITG05 ops leverage Israel-Hamas conflict lures to deliver Headlace malware ibm.com · Blog · 2024-02-01
- Elastic Security Labs — GrimResource (APT28 technique overlap with TL-0082) elastic.co · Blog · 2024-06-01
- Spanish Government La Moncloa — Council of Ministers reference (lure source) lamoncloa.gob.es · Other · 2025-09-23
More from APT28
- APT and Financial Attacks on Industrial Organizations in Q1 2026 (Kaspersky ICS CERT): Operation Neusploit (CVE-2026-21509/CVE-2026-21513), Poland Energy Wipers, TGR-STA-1030, MuddyWater, LockBit 5.0, Diesel Vortex
- APT28 PixyNetLoader Campaign Update: PNG-steganography loader delivering Covenant Grunt against Ukrainian military logistics
- APT28 (Fancy Bear) Espionage Campaign Against European Defense Contractors Using Hookedge Backdoor
- APT28 (GRU Unit 26165) exploits TP-Link and MikroTik routers to enable DNS hijacking and AitM credential theft (CVE-2023-50224) - FrostArmada / Operation Masquerade
- Weekly threat digest (week ending 2026-06-07): PAN-OS GlobalProtect CVE-2026-0257 exploitation, React2Shell CVE-2025-55182 abuse by APT-C-26, and npm/state-actor campaigns
- AI-Powered Polymorphic Malware Queries LLMs at Runtime to Evade Signature Detection: PROMPTFLUX and PROMPTSTEAL/LAMEHUG (APT28)
Previous and next in apt
Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated —.
