Pawn Storm (APT28) Deploys PRISMEX Malware Suite via CVE-2026-21509 and CVE-2026-21513 Zero-Days Targeting Ukrainian Defense Supply Chain
Pawn Storm (APT28) Deploys PRISMEX Malware Suite via (TL-2026-0285), also tracked as Operation Neusploit, is a critical-severity advanced persistent threat campaign scored CVSS 8.8, first published 2026-03-25 and last reviewed 2026-08-13. It is attributed to APT28 (Russia) with high confidence, affects Microsoft Microsoft 365 Apps for Enterprise, references 2 CVEs (CVE-2026-21509, CVE-2026-21513), maps to 22 MITRE ATT&CK techniques (T1027, T1048, T1053), and is covered by 9 detection rules and 35 indicators of compromise.
Key facts for TL-2026-0285
- Threat ID
- TL-2026-0285
- Also known as
- Operation Neusploit, Operation Phantom Net Voxel, PRISMEX Campaign
- Severity
- CRITICAL
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-03-25
- Last reviewed
- 2026-08-13
- Attribution
- APT28
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- government, defense, critical-infrastructure, maritime-transport, rail-logistics, hydrometeorology, emergency-services, humanitarian-aid, military
- Target regions
- Ukraine, Poland, Romania, Slovenia, Turkey, Slovakia, Czech Republic, Greece, United Arab Emirates, Central Europe, Eastern Europe
- Detection rules
- 9
- Indicators of compromise
- 35
- Updates
- 2026-08-13 · revalidated 1× · latest source
Malware and tooling in Pawn Storm (APT28) Deploys PRISMEX Malware Suite via
Malware and tooling: Covenant
Russia-aligned APT28 (Pawn Storm/Fancy Bear/UAC-0001) has deployed PRISMEX, a sophisticated multi-stage malware suite combining steganography, COM hijacking, and Filen.io cloud abuse for C2, targeting Ukrainian defense supply chain and NATO logistics across Central and Eastern Europe. The campaign exploits CVE-2026-21509 (Office OLE bypass, CVSS 7.8) and CVE-2026-21513 (MSHTML zero-day exploited 11 days before patch, CVSS 8.8), delivering MiniDoor email stealers, PixyNetLoader droppers, Covenant Grunt implants, and BEARDSHELL backdoors with espionage and potential sabotage capabilities.
How Pawn Storm (APT28) Deploys PRISMEX Malware Suite via works
In a sustained espionage campaign active since at least September 2025, Russia's GRU-linked APT28 (also tracked as Pawn Storm, Fancy Bear, UAC-0001, and Forest Blizzard) has deployed a comprehensive malware toolkit collectively designated PRISMEX by Trend Micro, targeting Ukrainian defense supply chain entities, NATO logistics hubs, and government agencies across Central and Eastern Europe.
The campaign leverages two Microsoft vulnerabilities as initial access vectors. CVE-2026-21509 (CVSS 7.8) is a Microsoft Office OLE security feature bypass disclosed on January 26, 2026, which APT28 weaponized within 24 hours using spear-phishing RTF documents with geopolitically themed lures in English, Romanian, Slovak, and Ukrainian. The exploit bypasses OLE security restrictions, exposing unsafe COM controls to execution and triggering WebDAV requests to retrieve next-stage payloads from attacker-controlled servers. CVE-2026-21513 (CVSS 8.8) is an MSHTML Framework zero-day rooted in insufficient URL validation within ieframe.dll's hyperlink navigation logic, allowing attacker-controlled input to reach ShellExecuteExW for code execution outside the browser sandbox. A malicious sample was uploaded to VirusTotal on January 30, 2026 — 11 days before Microsoft's February 10 patch — confirming zero-day exploitation. The exploit uses specially crafted LNK files embedding HTML content with nested iframes to bypass Mark-of-the-Web (MotW) and Internet Explorer Enhanced Security Configuration.
The PRISMEX infection chain follows two primary execution variants. Variant 1 deploys MiniDoor, a lightweight 64-bit C++ DLL that implements Outlook email theft. MiniDoor injects a malicious VBA project into Outlook, monitoring MAPILogonComplete and Application_NewMailEx events to silently forward emails from Inbox, Junk, Drafts, and RSS folders to threat actor-controlled addresses (ahmeclaw2002@outlook.com and ahmeclaw@proton.me). It uses a hardcoded single-byte XOR key (0x3a) for initial decryption and a 58-byte rolling XOR key for VBA project decryption. MiniDoor modifies Outlook security registry settings to enable macro execution and weakens security controls. Variant 2 deploys PixyNetLoader, a previously undocumented dropper that writes EhStoreShell.dll (shellcode loader), SplashScreen.png (steganographic payload), and office.xml (scheduled task config) to disk. Persistence is achieved through COM object hijacking targeting CLSID {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}, spoofing the Enhanced Storage Shell Extension. A scheduled task named 'OneDriveHealth' triggers explorer.exe restart and loads the hijacked COM object. EhStoreShell.dll implements sandbox evasion by verifying Sleep() API timing (must exceed 2.9 seconds), then extracts shellcode from SplashScreen.png using LSB steganography — each pixel's RGBA channels store data in least significant bits, requiring 2 pixels per encoded byte. The extracted shellcode uses CLR hosting to load a Covenant Grunt .NET implant that communicates via the Filen.io cloud storage API as a C2Bridge, with XOR encoding using key 'EIZ4EG2K8R' and Base64 encoding.
Additional tooling includes BEARDSHELL, a PowerShell command execution backdoor using Icedrive cloud storage for C2 with 'opaque predicate' obfuscation, and SLIMAGENT, a keylogger and screenshotter with HTML output formatting evolved from the XAgent platform. SimpleLoader serves as a LNK/DLL component for downloading additional payloads using three distinct XOR encryption schemes.
The campaign has employed server-side geofencing, responding with malicious DLLs only when requests originate from targeted geographic regions with correct User-Agent headers. Analysis of compromised Filen.io infrastructure revealed victim accounts distributed across multiple compromised or attacker-created accounts. The campaign's C2 infrastructure has evolved through pCloud (2023), Koofr (2024-2025), and now Filen.io (July 2025-present), demonstrating operational flexibility in swapping cloud platforms.
Targeted entities include Ukrainian central executive authorities (60+ email addresses), defense supply chain organizations, NATO logistics hubs, maritime transport agencies, rail logistics operators, hydrometeorology services, emergency services, and humanitarian aid organizations across Ukraine, Poland, Romania, Slovenia, Turkey, Slovakia, Czech Republic, Greece, and the UAE. Attribution is HIGH confidence based on convergent analysis by Trend Micro, Zscaler ThreatLabz (Operation Neusploit), Trellix, Akamai, CERT-UA, and SOCPrime.
MITRE ATT&CK techniques used in TL-2026-0285
defense-evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1480 Execution Guardrails; T1497 Virtualization/Sandbox Evasion
exfiltration
T1048 Exfiltration Over Alternative Protocol
execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1106 Native API; T1203 Exploitation for Client Execution; T1204 User Execution
command-and-control
T1071 Application Layer Protocol; T1102 Web Service
Command and Control
collection
persistence
T1137 Office Application Startup
privilege-escalation
T1546 Event Triggered Execution
defense-impairment
T1553 Subvert Trust Controls; T1685 Disable or Modify Tools
credential-access
T1556 Modify Authentication Process
initial-access
stealth
Affected products and versions in Pawn Storm (APT28) Deploys PRISMEX Malware Suite via
- Microsoft — Microsoft 365 Apps for Enterprise
Vulnerable versions: All versions prior to January 2026 update
Fixed in: January 2026 security update - Microsoft — Microsoft Office
Vulnerable versions: 2016 (x64/x86); 2019 (x64/x86); LTSC 2021 (x64/x86); LTSC 2024 (x64/x86)
Fixed in: With January 2026 security update - Microsoft — Windows (MSHTML Framework)
Vulnerable versions: Windows 10 1607/1809/21H2/22H2; Windows 11 23H2/24H2/25H2; Windows Server 2012/2012 R2/2016/2019/2022/2025
Fixed in: February 10, 2026 Patch Tuesday updates
Remediation for Pawn Storm (APT28) Deploys PRISMEX Malware Suite via
Patches
- CVE-2026-21509: Microsoft Office security update (January 26, 2026)
- CVE-2026-21513: Microsoft MSHTML Framework security update (February 10, 2026)
- Apply all Microsoft 365 Apps, Office 2016/2019/2021/2024 cumulative updates
- Apply Windows 10/11 and Windows Server 2012-2025 cumulative security updates
Immediate actions
- Apply Microsoft security updates for CVE-2026-21509 (January 2026) and CVE-2026-21513 (February 2026) across all Office and Windows systems
- Block IOC domains at perimeter: wellnesscaremed.com, wellnessmedcare.org, freefoodaid.com, longsauce.com
- Block IOC IPs at firewall: 159.253.120.2, 193.187.148.169, 23.227.202.14
- Hunt for EhStoreShell.dll, SplashScreen.png, and office.xml artifacts on endpoints
- Check for COM hijacking on CLSID {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}
- Monitor for OneDriveHealth scheduled task creation
- Block email forwarding to ahmeclaw2002@outlook.com and ahmeclaw@proton.me
Workarounds
- Disable RTF file opening in Microsoft Office via Group Policy
- Block WebDAV client connections from Office processes
- Restrict COM object registration modifications via application control policies
- Disable OLE/ActiveX in Office Trust Center settings
Longer-term hardening
- Deploy EDR with behavioral detection for COM hijacking and steganographic payload extraction
- Monitor Filen.io API traffic from endpoints as potential C2 channel
- Implement attack surface reduction rules to block OLE/ActiveX in Office documents
- Enable Protected View and Application Guard for Office documents from untrusted sources
- Monitor Outlook VBA project modifications and macro-related registry changes
- Implement network segmentation for defense supply chain and logistics systems
- Deploy YARA rules for PRISMEX malware family detection
CVEs associated with Pawn Storm (APT28) Deploys PRISMEX Malware Suite via
Weaknesses (CWE) in Pawn Storm (APT28) Deploys PRISMEX Malware Suite via
CWE-807, CWE-693
Timeline of Pawn Storm (APT28) Deploys PRISMEX Malware Suite via
- APT28 adopts Filen.io cloud storage as primary C2 channel for Covenant Grunt implants, replacing Koofr
- First PRISMEX campaign activity observed targeting Ukrainian and Central European government entities
- Campaign escalation observed with increased targeting of defense supply chain and NATO logistics hubs
- Microsoft publicly discloses and patches CVE-2026-21509 (Office OLE bypass, CVSS 7.8); CISA adds to KEV catalog same day
- APT28 creates weaponized RTF lure documents (BULLETEN_H.doc and others) exploiting CVE-2026-21509 within 24 hours of disclosure
- Zscaler ThreatLabz detects Operation Neusploit campaign delivering MiniDoor, PixyNetLoader, and Covenant Grunt via CVE-2026-21509
- CVE-2026-21513 MSHTML exploit artifact uploaded to VirusTotal (hash: aefd15e3...); linked to APT28 infrastructure wellnesscaremed.com — 11 days before Microsoft patch
- Trellix reports expanded APT28 campaign targeting European maritime and transport organizations with BEARDSHELL and SimpleLoader payloads
- Microsoft patches CVE-2026-21513 (MSHTML zero-day, CVSS 8.8) in February Patch Tuesday; CISA adds to KEV catalog with March 3 action deadline
- CERT-UA publishes advisory attributing campaign to UAC-0001 (APT28) with detailed IOCs and detection guidance
- Trend Micro publishes comprehensive analysis of Pawn Storm PRISMEX campaign, documenting full malware suite and wiper/sabotage capabilities
- As of 2026-05-29, this APT28/Pawn Storm PRISMEX campaign remains a live concern: both CVEs (21509, 21513) are patched and in CISA KEV, but the campaign infrastructure (Filen.io C2) shows no takedown and APT28 stays undisrupted, with fresh April 2026 reporting of 170+ Ukrainian prosecutor accounts hit. Unpatched systems remain exploitable.
Update history for TL-2026-0285
- 2026-08-13 — APT28 Exploits CVE-2026-21509 Microsoft Office Zero-Day in Operation Neusploit Targeting Ukrainian Government and Defense Objectives: What changed No escalation — severity, exploitability, and status are unchanged from the existing CRITICAL/ACTIVE record. The trigger report is an August 2026 NSFOCUS monthly roundup republishing the same January-February 2026 Operation Neu
Sources cited for Pawn Storm (APT28) Deploys PRISMEX Malware Suite via
- Trend Micro: Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure
- Zscaler ThreatLabz: Operation Neusploit — APT28 Leverages CVE-2026-21509
- Trellix: APT28 Stealthy Multi-Stage Campaign Leveraging CVE-2026-21509 and Cloud C2
- Akamai: Inside the Fix — Analysis of In-the-Wild Exploit of CVE-2026-21513
- The Hacker News: APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday
- The Hacker News: APT28 Uses CVE-2026-21509 in Espionage-Focused Malware Attacks
- The Hacker News: APT28 Uses BEARDSHELL and COVENANT Malware to Spy on Ukrainian Military
- CERT-UA Advisory on UAC-0001/APT28 PRISMEX Campaign
- SOC Prime: UAC-0001 (APT28) Attack Detection — CVE-2026-21509 Exploitation
- NVD: CVE-2026-21509
- NVD: CVE-2026-21513
- CISA Known Exploited Vulnerabilities: CVE-2026-21509
- CISA Known Exploited Vulnerabilities: CVE-2026-21513
- HivePro Threat Advisory: Operation Neusploit
- Security Affairs: APT28 Exploited MSHTML Zero-Day CVE-2026-21513 Before Patch
Threats related to Pawn Storm (APT28) Deploys PRISMEX Malware Suite via
- APT28 PixyNetLoader — Loader Evolution 2024–2026 (Operation Neusploit, CVE-2026-21509)
- APT28 (Fancy Bear) BEARDSHELL Backdoor & COVENANT C2 Framework — Long-term Ukrainian Military Espionage Campaign (CVE-2026-21509)
- APT28 Operation Neusploit: MS Office CVE-2026-21509 Espionage Campaign
- APT28 Router DNS Hijacking for Adversary-in-the-Middle Credential Theft
- CVE-2026-21509 - Microsoft Office Security Feature Bypass (CISA KEV)
- APT28 Microsoft Office Security Feature Bypass (CVE-2026-21509) — CISA KEV, Targeting Ukraine & EU via COREPER-Themed Spear-Phishing
Detection coverage for TL-2026-0285
As of 2026-08-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0285 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.