# Operation MacroMaze: APT28 Campaign Targeting Western & Central Europe via Evolving Macro Droppers & Legitimate Infrastructure Abuse

> Operation MacroMaze: APT28 (Fancy Bear / Forest Blizzard / FROZENLAKE) campaign targeting Western and Central European entities using macro-enabled document droppers, INCLUDEPICTURE tracking pixels, and legitimate service abuse (webhook.site) for C2 and exfiltration. Active September 2025 through January 2026. Four macro variants showing progressive evasion evolution. Delivers multi-stage payload chain using VBS, BAT, CMD, and HTML files with GUID-based filenames. Exfiltrates system reconnaissance via browser-rendered HTML form POST to webhook.site. Kill chain matches APT28's HEADLACE malware pattern previously documented by IBM X-Force and CERT Polska.

- **Published:** 2026-02-13T12:12:53Z
- **Last reviewed:** 2026-02-13T12:12:53Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0083
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-apt28-macromaze-campaign-tl-2026-0083.webp?v=04dac9d6 (Threadlinqs threat intel: APT28 (Fancy Bear) Operation MacroMaze: Detection & IOCs (TL-2026-0083) — Medium severity, 43 IOCs, 12 detection rules.)
- **ID:** TL-2026-0083
- **Severity:** MEDIUM
- **Category:** APT
- **Status:** MONITORING
- **Actor:** APT28 (Russia)
- **Detections:** 12 (1 shown free below) · **IOCs:** 43 (3 shown free below)

## Description

Lab52 (S2 Grupo) disclosed Operation MacroMaze, a sustained APT28 campaign active from late September 2025 through January 2026, targeting specific entities in Western and Central Europe. The campaign relies on basic but carefully orchestrated tooling — macro-enabled Office documents, batch files, VBScript launchers, and HTML templates — combined with legitimate infrastructure abuse (webhook.site) for both command and control and data exfiltration.

The campaign opens with spear-phishing emails delivering macro-enabled documents (.docm). One confirmed lure impersonates an agenda from the Spanish Ministry of the Presidency, Justice and Relations with the Courts, reproducing content from official government publications dated September 18-23, 2025. All analyzed documents share a structural element: an INCLUDEPICTURE field in the document XML (w:instrText) referencing a remote docopened.jpg file on webhook.site — functioning as a document-open tracking pixel that confirms victim engagement before payload delivery.

Four macro variants were identified, showing progressive evolution:
- Variant 1 (September 2025): Core dropper with document cleanup (removes ContentControls, changes text to black)
- Variant 2 (October 2025): Adds fake Microsoft Word error message to explain document appearance anomalies
- Variant 3 (December 2025): Removes document cleanup but retains fake error message
- Variant 4 (January 2026): Adds SendKeys automation (DOWN, ENTER, UP) to dismiss 'Enable Content' security warnings automatically — the most evolved evasion

All variants use heavy string concatenation obfuscation (e.g., 'WScri' + 'pt.shell') and drop six files into %USERPROFILE% with GUID-based filenames matching the webhook.site C2 path extension. Files include VBS launchers, BAT/CMD scripts, and HTM/XHTML exfiltration templates.

Execution chain: Macro → VBS launcher → CMD file → Edge browser (headless or off-screen) renders Base64 HTML → downloads fragments from webhook.site → reconstructs CMD payload → executes → captures output → merges with HTM/XHTML templates → renders final HTML in Edge → auto-submitting form POSTs data to webhook.site C2.

Persistence is established via Windows Scheduled Tasks with XML definitions written to disk at runtime then imported via schtasks. Repetition intervals evolved: 30 minutes (v1) → 20 minutes (v2) → 61 minutes (v3/v4).

Two batch file variants handle the execution differently:
- Batch 1: Stealth-focused — uses Edge headless mode, targeted window-title termination (taskkill /fi WindowTitle)
- Batch 2: Reliability-focused — uses off-screen positioning (--window-position=10000,10000), forceful Edge process kill (taskkill /f /im msedge.exe), adds --ignore-certificate-errors

The kill chain is virtually identical to APT28's HEADLACE malware, documented by IBM X-Force (ITG05) and CERT Polska in 2023-2024 campaigns targeting Polish government institutions and 13+ nations worldwide. HEADLACE also used webhook.site and run.mocky.io for payload staging and C2, with MSEdge headless mode for continuous secondary payload download and exfiltration. The CERT Polska campaign used DLL side-loading (fake WindowsCodecs.dll loaded by renamed calculator) as the initial execution vector, while MacroMaze uses Office macros — suggesting APT28 maintains parallel delivery mechanisms.

Lab52 noted the campaign demonstrates that 'simplicity can be powerful' — basic tools arranged with operational care maximize stealth by moving operations into hidden browser sessions, cleaning up artifacts, and outsourcing infrastructure to ephemeral webhook services. The operator favors brief, low-visibility intrusions over long-term implants.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1027 Obfuscated Files or Information
- T1218 System Binary Proxy Execution
- T1036 Masquerading
- T1070 Indicator Removal
- T1564 Hide Artifacts
- T1553 Subvert Trust Controls
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1016 System Network Configuration Discovery
- T1074 Data Staged
- T1071 Application Layer Protocol
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1140 Deobfuscate/Decode Files or Information
- T1005 Data from Local System

## Free detection (Splunk SPL)

**Operation MacroMaze — WINWORD.EXE Outbound HTTP Request to webhook.site (INCLUDEPICTURE Tracking Pixel Document-Open Confirmation)** (`TL-2026-0083-SPL-001`)

Detects the INCLUDEPICTURE tracking pixel mechanism used by APT28 in Operation MacroMaze. All analyzed MacroMaze documents contain an INCLUDEPICTURE field in the document XML (w:instrText) referencing a remote URL on webhook.site (e.g., /docopened.jpg). When the victim opens the document and Word evaluates the field, WINWORD.EXE makes an outbound HTTP request to webhook.site — functioning as a document-open confirmation beacon. This fires BEFORE macro execution, giving APT28 operational intelligence (document opened, victim IP, Office version) regardless of whether macros are subsequently enabled. Legitimate Word documents almost never reference webhook.site resources. Any WINWORD.EXE network connection to webhook.site is a HIGH-confidence indicator of MacroMaze or similar APT28 campaign targeting.

- **Language:** Splunk SPL
- **ATT&CK:** T1566.001, T1102.002, T1071.001
- **Data sources:** proxy_logs, sysmon, network_monitoring, dns_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=proxy OR index=sysmon OR index=network
| where (process_name="WINWORD.EXE" OR Image LIKE "%\\WINWORD.EXE" OR src_process="WINWORD.EXE")
    AND (url LIKE "%webhook.site%" OR dest LIKE "%webhook.site%" OR DestinationHostname LIKE "%webhook.site%" OR QueryName LIKE "%webhook.site%")
| eval detection="CRITICAL — APT28 MacroMaze INCLUDEPICTURE tracking pixel: WINWORD.EXE connecting to webhook.site"
| eval tracking_type=case(
    url LIKE "%docopened%", "Document-open confirmation beacon (docopened.jpg tracking pixel)",
    1=1, "Potential webhook.site C2 communication from Word process")
| eval next_steps="IMMEDIATE: (1) Isolate endpoint (2) Identify and quarantine the opened document (3) Check for 6 GUID-named files in %USERPROFILE% (4) Check for newly created scheduled tasks (5) Check for msedge.exe --headless launched by scripts"
| stats count AS events, earliest(_time) AS first_seen, latest(_time) AS last_seen, values(url) AS urls, values(Computer) AS hosts BY detection, tracking_type, User
| table detection, tracking_type, hosts, User, urls, events, first_seen, last_seen, next_steps
```

**Known false positives:**

- Legitimate Word documents referencing webhook.site resources — extremely rare. Developers may use webhook.site but not from within WINWORD.EXE. If seen, verify the document origin and content.

**Tuning notes:** This is the EARLIEST detection point in the MacroMaze kill chain — fires when the document is opened, before macro execution. Requires proxy logs, Sysmon DNS queries (Event ID 22), or network connection monitoring (Event ID 3) capturing the WINWORD.EXE process making external requests. Extend the domain list to include run.mocky.io and mockbin for broader APT28 legitimate-service-abuse coverage. The /docopened.jpg path is campaign-specific — APT28 may change the path in future campaigns, so detect on the process+domain combination, not the specific path.

### 11 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Operation MacroMaze — Microsoft Edge Launched in Headless or Off-Screen Mode by Script Interpreter (Browser-Based Exfiltration via BAT/CMD/VBS Parent Process) (locked: unlock with TL Creds)
- Operation MacroMaze — Office Process Executing VBA Macro with SendKeys API Call (Automated Security Prompt Bypass — Variant 4 January 2026) (locked: unlock with TL Creds)
- Operation MacroMaze — Aggressive Microsoft Edge Process Termination by Script Interpreter (taskkill /f /im msedge.exe from BAT/CMD — Batch Variant 2 Reliability Pattern) (locked: unlock with TL Creds)
- Operation MacroMaze — WINWORD.EXE Spawning Script Interpreters After Document Open (VBA Macro Dropper Initial Execution) (locked: unlock with TL Creds)
- Operation MacroMaze — Scheduled Task with Non-Standard Interval Executing Script from User Profile (Prime-Number Persistence Evasion) (locked: unlock with TL Creds)
- Operation MacroMaze — Base64-Encoded HTML Data URI Loaded by Microsoft Edge from Script Context (Fragment-Based Payload Download and Exfiltration Rendering) (locked: unlock with TL Creds)
- APT28 MacroMaze — Malicious Office Macro Dropping Encoded Payload (locked: unlock with TL Creds)
- APT28 MacroMaze — Multi-Stage Loader with Anti-Analysis Checks (locked: unlock with TL Creds)
- APT28 MacroMaze — HeadLace Backdoor C2 Communication Pattern (locked: unlock with TL Creds)
- Operation MacroMaze — Multi-File Drop to %USERPROFILE% with Script and HTML File Types (VBS/BAT/CMD/HTM/XHTML GUID-Named Dropper Payload) (locked: unlock with TL Creds)
- Operation MacroMaze — Scheduled Task Created via XML Import from User Profile Directory Targeting VBScript (schtasks Persistence Installation) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 43)

Defanged, TLP:CLEAR.

- Domain: `webhook[.]site`
- File hash: `b0f9f0a34ccab1337fbcca24b4f894de8d6d3a6f5db2e0463e2320215e4262e4`
- File hash: `c3b617e0c6b8f01cf628a2b3db40e8d06ef20a3c71365ccc1799787119246010`

Full set of 43 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Lab52 — Operation MacroMaze: new APT28 campaign using basic tooling and legit infrastructure](https://lab52.io/blog/operation-macromaze-new-apt28-campaign-using-basic-tooling-and-legit-infrastructure/)
- [CERT Polska — APT28 campaign targeting Polish government institutions](https://cert.pl/en/posts/2024/05/apt28-campaign/)
- [IBM X-Force — ITG05 ops leverage Israel-Hamas conflict lures to deliver Headlace malware](https://www.ibm.com/think/x-force/itg05-ops-leverage-israel-hamas-conflict-lures-to-deliver-headlace-malware)
- [CERT-UA — APT28 Headlace backdoor targeting Ukrainian energy infrastructure](https://cert.gov.ua/article/5702579)
- [Spanish Government La Moncloa — Council of Ministers reference (lure source)](https://www.lamoncloa.gob.es/consejodeministros/referencias/paginas/2025/20250923-referencia-rueda-de-prensa-ministros.aspx)
- [MITRE ATT&CK — APT28 Group Profile (G0007)](https://attack.mitre.org/groups/G0007/)
- [Elastic Security Labs — GrimResource (APT28 technique overlap with TL-0082)](https://www.elastic.co/security-labs/grimresource)

## Full data

The other 11 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0083