# APT28 PixyNetLoader — Loader Evolution 2024–2026 (Operation Neusploit, CVE-2026-21509)

> PixyNetLoader is a malware loader operated by the Russian nation-state actor APT28 (Fancy Bear), tracked by ExaTrack across ~90 samples in four code-similar sub-families from 2024 through 2026. In the January 2026 Operation Neusploit campaign it was delivered via RTF documents exploiting Microsoft Office CVE-2026-21509, using PNG LSB steganography to stage shellcode and ultimately a Covenant Grunt implant against Central/Eastern European targets.

- **Published:** 2026-06-09T00:00:00Z
- **Last reviewed:** 2026-06-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0727
- **ID:** TL-2026-0727
- **Severity:** HIGH (CVSS 7.8)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** APT28 (Russia)
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21509

## Description

PixyNetLoader (Malpedia: win.pixynet_loader) is a Windows loader attributed to APT28 / Fancy Bear, a unit linked to Russia's GRU. ExaTrack's June 2026 report tracks its evolution from 2024 to 2026, clustering roughly 90 samples into four sub-families by code similarity and documenting the introduction of PNG least-significant-bit (LSB) steganography in the March–April 2026 builds.

In the January 2026 campaign that Zscaler ThreatLabz named Operation Neusploit, APT28 weaponized Microsoft Office RTF documents to exploit CVE-2026-21509. Microsoft shipped an out-of-band patch on 26 January 2026; in-the-wild exploitation was observed on 29 January 2026, and ThreatLabz disclosed the campaign on 2 February 2026. Spearphishing attachments with localized Romanian, Slovak, Ukrainian and English lures (e.g. Consultation_Topics_Ukraine, Courses.doc, BULLETEN_H.doc) triggered the exploit, which downloaded a dropper DLL from attacker infrastructure (freefoodaid[.]com). The C2 served the malicious DLL only to requests from targeted regions presenting the correct User-Agent, a server-side geofencing evasion.

The infection chain splits into two variants. Variant 1 delivers MiniDoor, an Outlook email-stealer that manipulates Outlook security registry keys, installs a VbaProject.OTM macro, hooks the MAPILogonComplete event, and forwards Inbox/Junk/Drafts/RssFeeds messages to hardcoded attacker addresses. Variant 2 deploys PixyNetLoader, which creates the mutex 'asagdugughi41', decrypts embedded payloads with a 0x47-byte rolling XOR key, and drops SplashScreen.png, EhStoreShell.dll, and office.xml. Persistence is established through COM hijacking of CLSID {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} pointing InProcServer32 at EhStoreShell.dll, plus a scheduled task 'OneDriveHealth' registered from office.xml. EhStoreShell.dll (mutex 'dvyubgbqfusdv32') resolves APIs via DJB2 hashing, verifies it runs inside explorer.exe, applies a Sleep-tampering sandbox check (>2.9s), then extracts shellcode from SplashScreen.png pixels via LSB steganography (first 4 bytes = little-endian payload size). The final payload is a Covenant Grunt implant that abuses the Filen cloud-storage API as a C2Bridge over HTTPS, XOR-encoding strings with key 'EIZ4EG2K8R' before Base64.

The operation is attributed to APT28 with high confidence based on tooling, TTP and infrastructure overlaps. Targeting focuses on government and defense-adjacent entities in Ukraine, Slovakia and Romania, consistent with APT28 espionage objectives.

## MITRE ATT&CK

- T1566 Phishing
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1106 Native API
- T1053 Scheduled Task/Job
- T1546 Event Triggered Execution
- T1137 Office Application Startup
- T1140 Deobfuscate/Decode Files or Information
- T1480 Execution Guardrails
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1112 Modify Registry
- T1036 Masquerading
- T1114 Email Collection
- T1071 Application Layer Protocol
- T1102 Web Service
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026 (ExaTrack)](https://blog.exatrack.com/PixyNetLoader/)
- [Malpedia: win.pixynet_loader](https://malpedia.caad.fkie.fraunhofer.de/library/8b4b80f0-e531-4c5b-b92e-7480eb64df3c/)
- [Operation Neusploit: APT28 Uses CVE-2026-21509 (Zscaler ThreatLabz)](https://www.zscaler.com/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit)
- [APT28 Uses Microsoft Office CVE-2026-21509 in Espionage-Focused Malware Attacks (The Hacker News)](https://thehackernews.com/2026/02/apt28-uses-microsoft-office-cve-2026.html)
- [CVE-2026-21509: APT28 Exploits Microsoft Office Zero-day Vulnerability (Picus Security)](https://www.picussecurity.com/resource/blog/cve-2026-21509-apt28-exploits-microsoft-office-zero-day-vulnerability)
- [APT28's Stealthy Multi-Stage Campaign Leveraging CVE-2026-21509 and Cloud C2 Infrastructure (Trellix)](https://www.trellix.com/blogs/research/apt28-stealthy-campaign-leveraging-cve-2026-21509-cloud-c2/)
- [Operation Neusploit: APT28 Weaponizes CVE-2026-21509 (Hive Pro)](https://hivepro.com/threat-advisory/operation-neusploit-apt28-weaponizes-cve-2026-21509/)
- [Russia's APT28 Rapidly Weaponizes Newly Patched Office Vulnerability (SecurityWeek)](https://www.securityweek.com/russias-apt28-rapidly-weaponizes-newly-patched-office-vulnerability/)
- [Fancy Bear Leveraging CVE-2026-21509 in Operation Neusploit (PolySwarm)](https://blog.polyswarm.io/fancy-bear-leveraging-cve-2026-21509-in-operation-neusploit)
- [ExaTrack Blog — APT28 PixyNetLoader analysis](https://blog.exatrack.com/)
- [Sekoia — Operation Phantom Net Voxel (APT28 Grunt Stager)](https://blog.sekoia.io/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0727