APT28 PixyNetLoader — Loader Evolution 2024–2026 (Operation Neusploit, CVE-2026-21509)
APT28 PixyNetLoader (TL-2026-0727), also tracked as Operation Neusploit, is a high-severity malware campaign scored CVSS 7.8, first published 2026-06-09. It is attributed to APT28 (Russia) with high confidence, affects Microsoft Microsoft Office, references 1 CVE (CVE-2026-21509), maps to 19 MITRE ATT&CK techniques (T1027, T1036, T1041), and is covered by 9 detection rules and 33 indicators of compromise.
Key facts for TL-2026-0727
- Threat ID
- TL-2026-0727
- Also known as
- Operation Neusploit, win.pixynet_loader, PixyNetLoader
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-09
- Last reviewed
- 2026-06-09
- Attribution
- APT28
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- government, defense, diplomatic, public sector
- Target regions
- Ukraine, Slovakia, Romania, Central Europe, Eastern Europe
- Detection rules
- 9
- Indicators of compromise
- 33
Malware and tooling in APT28 PixyNetLoader
Malware and tooling: MiniDoor, PixyNetLoader, Covenant
PixyNetLoader is a malware loader operated by the Russian nation-state actor APT28 (Fancy Bear), tracked by ExaTrack across ~90 samples in four code-similar sub-families from 2024 through 2026. In the January 2026 Operation Neusploit campaign it was delivered via RTF documents exploiting Microsoft Office CVE-2026-21509, using PNG LSB steganography to stage shellcode and ultimately a Covenant Grunt implant against Central/Eastern European targets.
How APT28 PixyNetLoader works
PixyNetLoader (Malpedia: win.pixynet_loader) is a Windows loader attributed to APT28 / Fancy Bear, a unit linked to Russia's GRU. ExaTrack's June 2026 report tracks its evolution from 2024 to 2026, clustering roughly 90 samples into four sub-families by code similarity and documenting the introduction of PNG least-significant-bit (LSB) steganography in the March–April 2026 builds.
In the January 2026 campaign that Zscaler ThreatLabz named Operation Neusploit, APT28 weaponized Microsoft Office RTF documents to exploit CVE-2026-21509. Microsoft shipped an out-of-band patch on 26 January 2026; in-the-wild exploitation was observed on 29 January 2026, and ThreatLabz disclosed the campaign on 2 February 2026. Spearphishing attachments with localized Romanian, Slovak, Ukrainian and English lures (e.g. Consultation_Topics_Ukraine, Courses.doc, BULLETEN_H.doc) triggered the exploit, which downloaded a dropper DLL from attacker infrastructure (freefoodaid[.]com). The C2 served the malicious DLL only to requests from targeted regions presenting the correct User-Agent, a server-side geofencing evasion.
The infection chain splits into two variants. Variant 1 delivers MiniDoor, an Outlook email-stealer that manipulates Outlook security registry keys, installs a VbaProject.OTM macro, hooks the MAPILogonComplete event, and forwards Inbox/Junk/Drafts/RssFeeds messages to hardcoded attacker addresses. Variant 2 deploys PixyNetLoader, which creates the mutex 'asagdugughi41', decrypts embedded payloads with a 0x47-byte rolling XOR key, and drops SplashScreen.png, EhStoreShell.dll, and office.xml. Persistence is established through COM hijacking of CLSID {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} pointing InProcServer32 at EhStoreShell.dll, plus a scheduled task 'OneDriveHealth' registered from office.xml. EhStoreShell.dll (mutex 'dvyubgbqfusdv32') resolves APIs via DJB2 hashing, verifies it runs inside explorer.exe, applies a Sleep-tampering sandbox check (>2.9s), then extracts shellcode from SplashScreen.png pixels via LSB steganography (first 4 bytes = little-endian payload size). The final payload is a Covenant Grunt implant that abuses the Filen cloud-storage API as a C2Bridge over HTTPS, XOR-encoding strings with key 'EIZ4EG2K8R' before Base64.
The operation is attributed to APT28 with high confidence based on tooling, TTP and infrastructure overlaps. Targeting focuses on government and defense-adjacent entities in Ukraine, Slovakia and Romania, consistent with APT28 espionage objectives.
MITRE ATT&CK techniques used in TL-2026-0727
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1480 Execution Guardrails; T1497 Virtualization/Sandbox Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053 Scheduled Task/Job; T1137 Office Application Startup; T1546 Event Triggered Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Execution
T1106 Native API; T1203 Exploitation for Client Execution; T1204 User Execution
defense-impairment
Collection
Initial Access
Affected products and versions in APT28 PixyNetLoader
- Microsoft — Microsoft Office
Vulnerable versions: Office 2016/16.0 RTF handling
Fixed in: Patched build per CVE-2026-21509 out-of-band update (2026-01-26) - Microsoft — Microsoft Outlook
Vulnerable versions: 16.0 (targeted by MiniDoor registry/macro abuse)
Fixed in: N/A — abuse of legitimate features, mitigate via policy
Remediation for APT28 PixyNetLoader
Patches
- Microsoft Office update addressing CVE-2026-21509 (out-of-band, 2026-01-26)
Immediate actions
- Apply the Microsoft out-of-band patch for CVE-2026-21509 (released 26 January 2026) to all Office installations
- Block and alert on the domains freefoodaid.com and wellnesscaremed.com at web/DNS/email perimeter
- Hunt for mutexes asagdugughi41, adjgfenkbe and dvyubgbqfusdv32 across the estate
- Hunt for the scheduled task 'OneDriveHealth' and CLSID {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} InProcServer32 hijack
Workarounds
- Open RTF/DOC attachments in Protected View or a sandbox
- Block macro-enabled Outlook items and audit VbaProject.OTM
- Apply geofencing-aware egress filtering and alert on anomalous User-Agent driven downloads
Longer-term hardening
- Deploy EDR with behavioral detection for COM hijacking, Office add-in (VbaProject.OTM) creation, and schtasks XML registration
- Restrict outbound access to consumer cloud-storage APIs (e.g. Filen) used for C2Bridge
- Enforce Office Protected View and disable legacy RTF/OLE object loading where feasible
- Monitor Outlook security registry keys (Level, LoadMacroProviderOnBoot, PONT_STRING) for tampering
CVEs associated with APT28 PixyNetLoader
Weaknesses (CWE) in APT28 PixyNetLoader
CWE-787, CWE-502
Timeline of APT28 PixyNetLoader
- Earliest PixyNetLoader samples observed; ExaTrack begins tracking the loader's evolution across four code-similar sub-families (~90 samples through 2026).
- Across 2024 PixyNetLoader diverges into distinct code sub-families; ExaTrack later groups roughly 90 collected samples into four major sub-families based on shared code similarities, charting the loader's iterative evolution.
- Sekoia highlights APT28's use of the Grunt Stager in a campaign tracked as Operation Phantom Net Voxel, an antecedent toolset later correlated with the PixyNetLoader/MiniDoor delivery chain.
- Microsoft releases an out-of-band patch for CVE-2026-21509, the Office RTF vulnerability APT28 weaponizes in Operation Neusploit.
- In-the-wild exploitation of CVE-2026-21509 via malicious RTF documents observed targeting Ukraine, Slovakia and Romania.
- Zscaler ThreatLabz publicly discloses Operation Neusploit, detailing the PixyNetLoader/MiniDoor/Covenant Grunt infection chain and attributing it to APT28 with high confidence.
- March–April 2026 PixyNetLoader builds introduce PNG LSB steganography (SplashScreen.png) to stage shellcode for EhStoreShell.dll.
- By end of April 2026 the PNG LSB steganography PixyNetLoader builds (e.g. SplashScreen.png) are fully characterized; ExaTrack publishes PNG payload-extraction scripts and a unifying YARA rule covering all four sub-families.
- ExaTrack publishes 'Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026'; the family is cataloged in Malpedia as win.pixynet_loader with a unified YARA rule and PNG payload extraction scripts.
Sources cited for APT28 PixyNetLoader
- Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026 (ExaTrack)
- Malpedia: win.pixynet_loader
- Operation Neusploit: APT28 Uses CVE-2026-21509 (Zscaler ThreatLabz)
- APT28 Uses Microsoft Office CVE-2026-21509 in Espionage-Focused Malware Attacks (The Hacker News)
- CVE-2026-21509: APT28 Exploits Microsoft Office Zero-day Vulnerability (Picus Security)
- APT28's Stealthy Multi-Stage Campaign Leveraging CVE-2026-21509 and Cloud C2 Infrastructure (Trellix)
- Operation Neusploit: APT28 Weaponizes CVE-2026-21509 (Hive Pro)
- Russia's APT28 Rapidly Weaponizes Newly Patched Office Vulnerability (SecurityWeek)
- Fancy Bear Leveraging CVE-2026-21509 in Operation Neusploit (PolySwarm)
- ExaTrack Blog — APT28 PixyNetLoader analysis
- Sekoia — Operation Phantom Net Voxel (APT28 Grunt Stager)
Threats related to APT28 PixyNetLoader
- Pawn Storm (APT28) Deploys PRISMEX Malware Suite via CVE-2026-21509 and CVE-2026-21513 Zero-Days Targeting Ukrainian Defense Supply Chain
- APT28 (Fancy Bear) BEARDSHELL Backdoor & COVENANT C2 Framework — Long-term Ukrainian Military Espionage Campaign (CVE-2026-21509)
- CVE-2026-21509 - Microsoft Office Security Feature Bypass (CISA KEV)
- APT28 Operation Neusploit: MS Office CVE-2026-21509 Espionage Campaign
- APT28 Router DNS Hijacking for Adversary-in-the-Middle Credential Theft
- APT28 Microsoft Office Security Feature Bypass (CVE-2026-21509) — CISA KEV, Targeting Ukraine & EU via COREPER-Themed Spear-Phishing
Detection coverage for TL-2026-0727
As of 2026-06-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0727 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0727
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.