Operation MacroMaze: APT28 Campaign Targeting Western & Central Europe via Evolving Macro Droppers & Legitimate Infrastructure Abuse
Operation MacroMaze (TL-2026-0083) is a medium-severity advanced persistent threat campaign, first published 2026-02-13. It is attributed to APT28 (Russia) with high confidence, maps to 25 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 12 detection rules and 43 indicators of compromise.
Key facts for TL-2026-0083
- Threat ID
- TL-2026-0083
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- APT
- First published
- 2026-02-13
- Last reviewed
- 2026-02-13
- Attribution
- APT28
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- Government, Diplomacy, Defense, European Union Institutions, Think Tanks, Energy, Finance, Academic
- Target regions
- Western Europe, Central Europe, Spain, Poland, Romania, Hungary, Turkey, Ukraine, Belgium, Germany, Italy, Latvia
- Detection rules
- 12
- Indicators of compromise
- 43
Malware and tooling in Operation MacroMaze
Malware and tooling: Headlace
Operation MacroMaze: APT28 (Fancy Bear / Forest Blizzard / FROZENLAKE) campaign targeting Western and Central European entities using macro-enabled document droppers, INCLUDEPICTURE tracking pixels, and legitimate service abuse (webhook.site) for C2 and exfiltration. Active September 2025 through January 2026. Four macro variants showing progressive evasion evolution. Delivers multi-stage payload chain using VBS, BAT, CMD, and HTML files with GUID-based filenames. Exfiltrates system reconnaissance via browser-rendered HTML form POST to webhook.site. Kill chain matches APT28's HEADLACE malware pattern previously documented by IBM X-Force and CERT Polska.
How Operation MacroMaze works
Lab52 (S2 Grupo) disclosed Operation MacroMaze, a sustained APT28 campaign active from late September 2025 through January 2026, targeting specific entities in Western and Central Europe. The campaign relies on basic but carefully orchestrated tooling — macro-enabled Office documents, batch files, VBScript launchers, and HTML templates — combined with legitimate infrastructure abuse (webhook.site) for both command and control and data exfiltration.
The campaign opens with spear-phishing emails delivering macro-enabled documents (.docm). One confirmed lure impersonates an agenda from the Spanish Ministry of the Presidency, Justice and Relations with the Courts, reproducing content from official government publications dated September 18-23, 2025. All analyzed documents share a structural element: an INCLUDEPICTURE field in the document XML (w:instrText) referencing a remote docopened.jpg file on webhook.site — functioning as a document-open tracking pixel that confirms victim engagement before payload delivery.
Four macro variants were identified, showing progressive evolution: - Variant 1 (September 2025): Core dropper with document cleanup (removes ContentControls, changes text to black) - Variant 2 (October 2025): Adds fake Microsoft Word error message to explain document appearance anomalies - Variant 3 (December 2025): Removes document cleanup but retains fake error message - Variant 4 (January 2026): Adds SendKeys automation (DOWN, ENTER, UP) to dismiss 'Enable Content' security warnings automatically — the most evolved evasion
All variants use heavy string concatenation obfuscation (e.g., 'WScri' + 'pt.shell') and drop six files into %USERPROFILE% with GUID-based filenames matching the webhook.site C2 path extension. Files include VBS launchers, BAT/CMD scripts, and HTM/XHTML exfiltration templates.
Execution chain: Macro → VBS launcher → CMD file → Edge browser (headless or off-screen) renders Base64 HTML → downloads fragments from webhook.site → reconstructs CMD payload → executes → captures output → merges with HTM/XHTML templates → renders final HTML in Edge → auto-submitting form POSTs data to webhook.site C2.
Persistence is established via Windows Scheduled Tasks with XML definitions written to disk at runtime then imported via schtasks. Repetition intervals evolved: 30 minutes (v1) → 20 minutes (v2) → 61 minutes (v3/v4).
Two batch file variants handle the execution differently: - Batch 1: Stealth-focused — uses Edge headless mode, targeted window-title termination (taskkill /fi WindowTitle) - Batch 2: Reliability-focused — uses off-screen positioning (--window-position=10000,10000), forceful Edge process kill (taskkill /f /im msedge.exe), adds --ignore-certificate-errors
The kill chain is virtually identical to APT28's HEADLACE malware, documented by IBM X-Force (ITG05) and CERT Polska in 2023-2024 campaigns targeting Polish government institutions and 13+ nations worldwide. HEADLACE also used webhook.site and run.mocky.io for payload staging and C2, with MSEdge headless mode for continuous secondary payload download and exfiltration. The CERT Polska campaign used DLL side-loading (fake WindowsCodecs.dll loaded by renamed calculator) as the initial execution vector, while MacroMaze uses Office macros — suggesting APT28 maintains parallel delivery mechanisms.
Lab52 noted the campaign demonstrates that 'simplicity can be powerful' — basic tools arranged with operational care maximize stealth by moving operations into hidden browser sessions, cleaning up artifacts, and outsourcing infrastructure to ephemeral webhook services. The operator favors brief, low-visibility intrusions over long-term implants.
MITRE ATT&CK techniques used in TL-2026-0083
collection
T1005 Data from Local System; T1074 Data Staged
discovery
T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1564 Hide Artifacts
exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1204 User Execution
command-and-control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer
defense-impairment
initial-access
resource-development
T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities; T1608 Stage Capabilities
Remediation for Operation MacroMaze
Immediate actions
- Block macro execution in Office documents from external/internet sources via Group Policy (HKCU\Software\Microsoft\Office\*\Security\blockcontentexecutionfrominternet)
- Block webhook.site and run.mocky.io at network perimeter for organizations that do not use these services
- Deploy email gateway rules to quarantine .docm attachments with INCLUDEPICTURE external references
- Monitor for schtasks.exe importing XML task definitions from %USERPROFILE% directories
- Block Edge headless mode execution from non-development user accounts
Workarounds
- Disable VBA macros enterprise-wide via Group Policy if macro functionality is not business-critical
- Configure email gateway to strip or sandbox .docm/.xlsm attachments before delivery
- Enable Attack Surface Reduction rules for Office macro child process blocking
Longer-term hardening
- Implement Attack Surface Reduction (ASR) rules: Block Office applications from creating child processes
- Deploy application control policies restricting VBS/BAT/CMD execution from %USERPROFILE%
- Implement DNS filtering/monitoring for webhook.site, run.mocky.io, and similar ephemeral service domains
- Enable Protected View and Application Guard for Office documents from external sources
- Deploy Sysmon with configuration monitoring macro-enabled document child process creation
Weaknesses (CWE) in Operation MacroMaze
CWE-829
Timeline of Operation MacroMaze
- CERT-UA reports APT28 using Headlace malware against Ukrainian energy infrastructure. Source: https://cert.gov.ua/article/5702579
- IBM X-Force discloses ITG05 (APT28) campaign delivering Headlace via Israel-Hamas conflict lures, targeting 13+ nations. Kill chain matches MacroMaze pattern. Source: https://www.ibm.com/think/x-force/itg05-ops-leverage-israel-hamas-conflict-lures-to-deliver-headlace-malware
- CERT Polska discloses APT28 campaign targeting Polish government — DLL side-loading, webhook.site C2, Edge headless exfiltration. Highly similar kill chain to MacroMaze. Source: https://cert.pl/en/posts/2024/05/apt28-campaign/
- Spanish Ministry of the Presidency issues agenda used as lure material. APT28 reproduces official content published September 23 on La Moncloa website.
- Macro Variant 1 detected — earliest Operation MacroMaze artifact. Drops 6 files to %USERPROFILE%, establishes 30-minute scheduled task persistence, uses document cleanup (ContentControls removal). Source: https://lab52.io/blog/operation-macromaze-new-apt28-campaign-using-basic-tooling-and-legit-infrastructure/
- Macro Variant 2 detected — adds fake Microsoft Word error message to disguise document anomalies, maintains 20-minute scheduled task interval.
- Macro Variant 3 detected — removes document cleanup routines, retains fake error message, increases scheduled task interval to 61 minutes.
- Macro Variant 4 detected — most evolved version. Adds SendKeys automation (DOWN, ENTER, UP) to dismiss 'Enable Content' security warnings automatically. Direct iteration of Variant 3.
- Lab52 (S2 Grupo) publishes Operation MacroMaze report, attributing campaign to APT28 targeting Western and Central European entities. Source: https://lab52.io/blog/operation-macromaze-new-apt28-campaign-using-basic-tooling-and-legit-infrastructure/
- As of 2026-05-29, Operation MacroMaze is a concluded APT28 campaign (active Sept 2025-Jan 2026, last variant V4 in Jan 2026), described in past tense by Lab52, The Hacker News and SC Media with no activity since and no CVE/patch involved. The actor APT28/GRU Unit 26165 remains highly active (new Storm-2754 and router campaigns through April 2026) and the macro/SendKeys/webhook.site TTPs stay viable, so the record warrants continued MONITORING rather than closure.
Sources cited for Operation MacroMaze
- Lab52 — Operation MacroMaze: new APT28 campaign using basic tooling and legit infrastructure
- CERT Polska — APT28 campaign targeting Polish government institutions
- IBM X-Force — ITG05 ops leverage Israel-Hamas conflict lures to deliver Headlace malware
- CERT-UA — APT28 Headlace backdoor targeting Ukrainian energy infrastructure
- Spanish Government La Moncloa — Council of Ministers reference (lure source)
- MITRE ATT&CK — APT28 Group Profile (G0007)
- Elastic Security Labs — GrimResource (APT28 technique overlap with TL-0082)
Threats related to Operation MacroMaze
- BlueDelta (GRU/APT28) Targets Defense and Diplomacy with HOOKEDGE Backdoor
- APT28 Operation Neusploit: MS Office CVE-2026-21509 Espionage Campaign
- HOOKEDGE: New BlueDelta (APT28/Fancy Bear) Backdoor Abuses Microsoft Edge and webhook.site for C2
- APT28 Microsoft Office Security Feature Bypass (CVE-2026-21509) — CISA KEV, Targeting Ukraine & EU via COREPER-Themed Spear-Phishing
Detection coverage for TL-2026-0083
As of 2026-02-13, Threadlinqs Intelligence publishes 12 detection rule(s) for TL-2026-0083 across Splunk SPL, Microsoft KQL and Sigma, covering 43 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.