# Pawn Storm (APT28) Deploys PRISMEX Malware Suite via CVE-2026-21509 and CVE-2026-21513 Zero-Days Targeting Ukrainian Defense Supply Chain

> Russia-aligned APT28 (Pawn Storm/Fancy Bear/UAC-0001) has deployed PRISMEX, a sophisticated multi-stage malware suite combining steganography, COM hijacking, and Filen.io cloud abuse for C2, targeting Ukrainian defense supply chain and NATO logistics across Central and Eastern Europe. The campaign exploits CVE-2026-21509 (Office OLE bypass, CVSS 7.8) and CVE-2026-21513 (MSHTML zero-day exploited 11 days before patch, CVSS 8.8), delivering MiniDoor email stealers, PixyNetLoader droppers, Covenant Grunt implants, and BEARDSHELL backdoors with espionage and potential sabotage capabilities.

- **Published:** 2026-03-25T12:00:00Z
- **Last reviewed:** 2026-08-13T11:32:33.417Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0285
- **ID:** TL-2026-0285
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** APT28 (Russia)
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21509, CVE-2026-21513

## Description

In a sustained espionage campaign active since at least September 2025, Russia's GRU-linked APT28 (also tracked as Pawn Storm, Fancy Bear, UAC-0001, and Forest Blizzard) has deployed a comprehensive malware toolkit collectively designated PRISMEX by Trend Micro, targeting Ukrainian defense supply chain entities, NATO logistics hubs, and government agencies across Central and Eastern Europe.

The campaign leverages two Microsoft vulnerabilities as initial access vectors. CVE-2026-21509 (CVSS 7.8) is a Microsoft Office OLE security feature bypass disclosed on January 26, 2026, which APT28 weaponized within 24 hours using spear-phishing RTF documents with geopolitically themed lures in English, Romanian, Slovak, and Ukrainian. The exploit bypasses OLE security restrictions, exposing unsafe COM controls to execution and triggering WebDAV requests to retrieve next-stage payloads from attacker-controlled servers. CVE-2026-21513 (CVSS 8.8) is an MSHTML Framework zero-day rooted in insufficient URL validation within ieframe.dll's hyperlink navigation logic, allowing attacker-controlled input to reach ShellExecuteExW for code execution outside the browser sandbox. A malicious sample was uploaded to VirusTotal on January 30, 2026 — 11 days before Microsoft's February 10 patch — confirming zero-day exploitation. The exploit uses specially crafted LNK files embedding HTML content with nested iframes to bypass Mark-of-the-Web (MotW) and Internet Explorer Enhanced Security Configuration.

The PRISMEX infection chain follows two primary execution variants. Variant 1 deploys MiniDoor, a lightweight 64-bit C++ DLL that implements Outlook email theft. MiniDoor injects a malicious VBA project into Outlook, monitoring MAPILogonComplete and Application_NewMailEx events to silently forward emails from Inbox, Junk, Drafts, and RSS folders to threat actor-controlled addresses (ahmeclaw2002@outlook.com and ahmeclaw@proton.me). It uses a hardcoded single-byte XOR key (0x3a) for initial decryption and a 58-byte rolling XOR key for VBA project decryption. MiniDoor modifies Outlook security registry settings to enable macro execution and weakens security controls. Variant 2 deploys PixyNetLoader, a previously undocumented dropper that writes EhStoreShell.dll (shellcode loader), SplashScreen.png (steganographic payload), and office.xml (scheduled task config) to disk. Persistence is achieved through COM object hijacking targeting CLSID {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}, spoofing the Enhanced Storage Shell Extension. A scheduled task named 'OneDriveHealth' triggers explorer.exe restart and loads the hijacked COM object. EhStoreShell.dll implements sandbox evasion by verifying Sleep() API timing (must exceed 2.9 seconds), then extracts shellcode from SplashScreen.png using LSB steganography — each pixel's RGBA channels store data in least significant bits, requiring 2 pixels per encoded byte. The extracted shellcode uses CLR hosting to load a Covenant Grunt .NET implant that communicates via the Filen.io cloud storage API as a C2Bridge, with XOR encoding using key 'EIZ4EG2K8R' and Base64 encoding.

Additional tooling includes BEARDSHELL, a PowerShell command execution backdoor using Icedrive cloud storage for C2 with 'opaque predicate' obfuscation, and SLIMAGENT, a keylogger and screenshotter with HTML output formatting evolved from the XAgent platform. SimpleLoader serves as a LNK/DLL component for downloading additional payloads using three distinct XOR encryption schemes.

The campaign has employed server-side geofencing, responding with malicious DLLs only when requests originate from targeted geographic regions with correct User-Agent headers. Analysis of compromised Filen.io infrastructure revealed victim accounts distributed across multiple compromised or attacker-created accounts. The campaign's C2 infrastructure has evolved through pCloud (2023), Koofr (2024-2025), and now Filen.io (July 2025-present), demonstrating operational flexibility in swapping cloud platforms.

Targeted entities include Ukrainian central executive authorities (60+ email addresses), defense supply chain organizations, NATO logistics hubs, maritime transport agencies, rail logistics operators, hydrometeorology services, emergency services, and humanitarian aid organizations across Ukraine, Poland, Romania, Slovenia, Turkey, Slovakia, Czech Republic, Greece, and the UAE. Attribution is HIGH confidence based on convergent analysis by Trend Micro, Zscaler ThreatLabz (Operation Neusploit), Trellix, Akamai, CERT-UA, and SOCPrime.

## MITRE ATT&CK

- T1566 Phishing
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1546 Event Triggered Execution
- T1053 Scheduled Task/Job
- T1137 Office Application Startup
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1553 Subvert Trust Controls
- T1685 Disable or Modify Tools
- T1055 Process Injection
- T1480 Execution Guardrails
- T1497 Virtualization/Sandbox Evasion
- T1556 Modify Authentication Process
- T1114 Email Collection
- T1071 Application Layer Protocol
- T1102 Web Service
- T1048 Exfiltration Over Alternative Protocol
- T1105 Ingress Tool Transfer

## Sources

- [Trend Micro: Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure](https://www.trendmicro.com/en_us/research/26/c/pawn-storm-targets-govt-infra.html)
- [Zscaler ThreatLabz: Operation Neusploit — APT28 Leverages CVE-2026-21509](https://www.zscaler.com/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit)
- [Trellix: APT28 Stealthy Multi-Stage Campaign Leveraging CVE-2026-21509 and Cloud C2](https://www.trellix.com/blogs/research/apt28-stealthy-campaign-leveraging-cve-2026-21509-cloud-c2/)
- [Akamai: Inside the Fix — Analysis of In-the-Wild Exploit of CVE-2026-21513](https://www.akamai.com/blog/security-research/inside-the-fix-cve-2026-21513-mshtml-exploit-analysis)
- [The Hacker News: APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday](https://thehackernews.com/2026/03/apt28-tied-to-cve-2026-21513-mshtml-0.html)
- [The Hacker News: APT28 Uses CVE-2026-21509 in Espionage-Focused Malware Attacks](https://thehackernews.com/2026/02/apt28-uses-microsoft-office-cve-2026.html)
- [The Hacker News: APT28 Uses BEARDSHELL and COVENANT Malware to Spy on Ukrainian Military](https://thehackernews.com/2026/03/apt28-uses-beardshell-and-covenant.html)
- [CERT-UA Advisory on UAC-0001/APT28 PRISMEX Campaign](https://cert.gov.ua/)
- [SOC Prime: UAC-0001 (APT28) Attack Detection — CVE-2026-21509 Exploitation](https://socprime.com/blog/detect-uac-0001-attacks-exploiting-cve-2026-21509/)
- [NVD: CVE-2026-21509](https://nvd.nist.gov/vuln/detail/CVE-2026-21509)
- [NVD: CVE-2026-21513](https://nvd.nist.gov/vuln/detail/CVE-2026-21513)
- [CISA Known Exploited Vulnerabilities: CVE-2026-21509](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [HivePro Threat Advisory: Operation Neusploit](https://hivepro.com/threat-advisory/operation-neusploit-apt28-weaponizes-cve-2026-21509/)
- [Security Affairs: APT28 Exploited MSHTML Zero-Day CVE-2026-21513 Before Patch](https://securityaffairs.com/188782/security/russia-linked-apt28-exploited-mshtml-zero-day-cve-2026-21513-before-patch.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0285