Operation MacroMaze: APT28 Campaign Targeting Western & Central Europe via Evolving Macro Droppers & Legitimate Infrastructure Abuse — Threadlinqs Intelligence
As of 2026-05-30, Operation MacroMaze: APT28 Campaign Targeting Western & Central Europe via Evolving Macro Droppers & Legitimate Infrastructure Abuse is a medium-severity apt threat attributed to APT28 (Russia), tracked by Threadlinqs Intelligence with 12 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 43 indicators of compromise.
Threat ID: TL-2026-0083 · Severity: MEDIUM · Status: MONITORING · Category: APT
Attribution: APT28 · Russia · ESPIONAGE
Operation MacroMaze: APT28 (Fancy Bear / Forest Blizzard / FROZENLAKE) campaign targeting Western and Central European entities using macro-enabled document droppers, INCLUDEPICTURE tracking pixels,
Lab52 (S2 Grupo) disclosed Operation MacroMaze, a sustained APT28 campaign active from late September 2025 through January 2026, targeting specific entities in Western and Central Europe. The campaign relies on basic but carefully orchestrated tooling — macro-enabled Office documents, batch files, VBScript launchers, and HTML templates — combined with legitimate infrastructure abuse (webhook.site) for both command and control and data exfiltration.
The campaign opens with spear-phishing emails delivering macro-enabled documents (.docm). One confirmed lure impersonates an agenda from the Spanish Ministry of the Presidency, Justice and Relations with the Courts, reproducing content from official government publications dated September 18-23, 2025. All analyzed documents share a structural element: an INCLUDEPICTURE field in the document XML (w:instrText) referencing a remote docopened.jpg file on webhook.site — functioning as a document-open tracking pixel that confirms victim engagement before payload delivery.
Four macro variants were identified, showing progressive evolution:
- Variant 1 (September 2025): Core dropper with document cleanup (removes ContentControls, changes text to black)
- Variant 2 (October 2025): Adds fake Microsoft Word error message to explain document appearance anomalies
- Variant 3 (December 2025): Removes document cleanup but retains fake error message
- Variant 4 (January 2026): Adds SendKeys automation (DOWN, ENTER, UP) to dismiss 'Enable Content' security warnings automatically — the most evolved evasion
All variants use heavy string concatenation obfuscation (e.g., 'WScri' + 'pt.shell') and drop six files into %USERPROFILE% with GUID-based filenames matching the webhook.site C2 path extension. Files include VBS launchers, BAT/CMD scripts, and HTM/XHTML exfiltration templates.
Execution chain: Macro → VBS launcher → CMD file → Edge browser (headless or off-screen) renders Base64 HTML → downloads fragments from webhook.site → reconstructs CMD payload → executes → captures output → merges with HTM/XHTML templates → renders final HTML in Edge → auto-submitting form POSTs data to webhook.site C2.
Persistence is established via Windows Scheduled Tasks with XML definitions written to disk at runtime then imported via schtasks. Repetition intervals evolved: 30 minutes (v1) → 20 minutes (v2) → 61 minutes (v3/v4).
Two batch file variants handle the execution differently:
- Batch 1: Stealth-focused — uses Edge headless mode, targeted window-title termination (taskkill /fi WindowTitle)
- Batch 2: Reliability-focused — uses off-screen positioning (--window-position=10000,10000), forceful Edge process kill (taskkill /f /im msedge.exe), adds --ignore-certificate-errors
The kill chain is virtually identical to APT28's HEADLACE malware, documented by IBM X-Force (ITG05) and CERT Polska in 2023-2024 campaigns targeting Polish government institutions and 13+ nations worldwide. HEADLACE also used webhook.site and run.mocky.io for payload staging and C2, with MSEdge headless mode for continuous secondary payload download and exfiltration. The CERT Polska campaign used DLL side-loading (fake WindowsCodecs.dll loaded by renamed calculator) as the initial execution vector, while MacroMaze uses Office macros — suggesting APT28 maintains parallel delivery mechanisms.
Lab52 noted the campaign demonstrates that 'simplicity can be powerful' — basic tools arranged with operational care maximize stealth by moving operations into hidden browser sessions, cleaning up artifacts, and outsourcing infrastructure to ephemeral webhook services. The operator favors brief, low-visibility intrusions over long-term implants.
Target sectors: Government, Diplomacy, Defense, European Union Institutions, Think Tanks, Energy, Finance, Academic
Target regions: Western Europe, Central Europe, Spain, Poland, Romania, Hungary, Turkey, Ukraine, Belgium, Germany, Italy, Latvia
Detections & IOCs
As of 2026-07-28, this threat has 12 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 43 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, MEDIUM, threat intelligence, cybersecurity, T1566, T1204, T1059, T1059, T1059, T1053, T1053, T1027, T1218, T1036