Threat reportMalwareTL-2026-4418
APT28 PixyNetLoader Campaign Update: PNG-steganography loader delivering Covenant Grunt against Ukrainian military logistics
APT28 PixyNetLoader Campaign Update (TL-2026-4418), also tracked as PixyNetLoader campaign, is a high-severity malware campaign, first published 2026-10-24. It is attributed to APT28 (Russia) with high confidence, affects Microsoft Windows (explorer.exe / shell32.dll COM handler loading) and, references 1 CVE (CVE-2026-21509), maps to 11 MITRE ATT&CK techniques (T1027, T1027.003, T1036.005), and is covered by 9 detection rules and 21 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 11MITRE ATT&CK
- Actors
- 1APT28
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 21Indicators of compromise
Key facts for TL-2026-4418
- Threat ID
- TL-2026-4418
- Also known as
- PixyNetLoader campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- APT28
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- military, defense logistics, government administration
- Target regions
- ukraine
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in APT28 PixyNetLoader Campaign Update
Malware and tooling: Covenant Grunt, PixyNetLoader, Covenant
How APT28 PixyNetLoader Campaign Update works
ExaTrack documents nine PixyNetLoader variants (2026-05-28 through 2026-10-13) attributed to APT28. The DLL loader extracts a payload (typically a Covenant Grunt backdoor) hidden in a companion PNG via LSB steganography, delivered through malicious XLS/DOC lures targeting Ukrainian military logistics.
ExaTrack's October 2026 update reports that the APT28 phishing campaign using PixyNetLoader is still ongoing, targeting Ukrainian military logistics with malicious Office (XLS/DOC) documents since 2025. PixyNetLoader is a DLL loader that extracts a payload from a companion PNG file using LSB steganography. The payload is typically a Covenant Grunt implant (the .NET Covenant C2 framework) that communicates through the FILEN cloud storage API, so C2 traffic blends into legitimate cloud-service traffic.
ExaTrack tracked nine variants with compile/observation dates from 2026-05-28 to 2026-10-13. In the July 2026 variant (2026-07-20) the string encryption routine was modified and the password used for AES key derivation became encrypted, although the structure stayed similar to earlier builds. Through August the loaders persisted through a hijacked COM handler registered under HKCU\Software\Classes\CLSID\{30d49246-d217-465f-b00b-ac9ddd652eb7}\InProcServer32, a CLSID that normally points to the legitimate IDStore.dll. The loader also checks that it is running inside explorer.exe before executing.
In the September 2026 variant (2026-09-04) persistence changed to a Default Associations Profile Handler COM registration under HKCU\Software\Classes\CLSID\{0a556d98-cfee-4d84-82a7-00377f939198}. This handler is loaded by shell32.dll inside explorer.exe. The malicious DLL forwards legitimate exports to the real shell32.dll and validates that the host process is explorer.exe. The September build also removed the 'HIDE' magic number and its associated validation checks.
Staging paths stayed consistent across iterations. DLLs are dropped to paths mimicking Microsoft components (C:\ProgramData\Microsoft\DeviceSync\DNX\dnxstore.dll, ...\PowerShell\PSReadLine\PSReadLineCore.dll, ...\Internet Explorer\UserData\Low\db\uimanager.dll). PNG carriers are stored at ...\Microsoft\Network\Cache\icon.png and C:\ProgramData\Microsoft\DeviceSync\Edge\wallpaper.png. Defenders can hunt for user-level CLSID registry entries whose default value deviates from legitimate system DLLs, and for these staging paths. Earlier public reporting (Zscaler ThreatLabz, via The Hacker News, 2026-02-03) tied PixyNetLoader to Operation Neusploit and CVE-2026-21509. The ExaTrack October update does not state a CVE for the current lures.
Severity is analyst-assigned; no CVE or CVSS is stated in the source.
MITRE ATT&CK techniques used in TL-2026-4418
Defense Evasion
T1027 Obfuscated Files or Information; T1027.003 Steganography; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1480 Execution Guardrails; T1574.001 DLL
Command and Control
T1071.001 Web Protocols; T1102.002 Bidirectional Communication
Execution
Persistence
T1546.015 Component Object Model Hijacking
Initial Access
Affected products and versions in APT28 PixyNetLoader Campaign Update
- Microsoft — Windows (explorer.exe / shell32.dll COM handler loading) and Microsoft Office document handling
Remediation for APT28 PixyNetLoader Campaign Update
Immediate actions
- Hunt for user-level CLSID registry entries {30d49246-d217-465f-b00b-ac9ddd652eb7} and {0a556d98-cfee-4d84-82a7-00377f939198} under HKCU\Software\Classes\CLSID whose default/InProcServer32 value is not a legitimate system DLL
- Search endpoints for dnxstore.dll, PSReadLineCore.dll and uimanager.dll in the documented staging paths, and for icon.png / wallpaper.png in the documented companion locations
- Block or alert on the listed SHA256 hashes
- Alert on explorer.exe loading unsigned DLLs or making outbound connections to filen.io from non-sync-client hosts
Workarounds
- Use AppLocker or WDAC to block DLL loads from user-writable and ProgramData\Microsoft\DeviceSync paths
Longer-term hardening
- Restrict or monitor access to consumer cloud storage services (Filen) on sensitive networks
- Deploy EDR with registry and image-load telemetry for COM hijacking detection
- Block or sandbox XLS/DOC attachments from untrusted senders; apply Office attack surface reduction rules
CVEs associated with APT28 PixyNetLoader Campaign Update
Timeline of APT28 PixyNetLoader Campaign Update
- APT28 phishing campaign using PixyNetLoader begins targeting Ukrainian military logistics with malicious Office documents (source states 'since 2025'; exact date not given).
- Public reporting of APT28 Operation Neusploit ties PixyNetLoader (COM hijacking, PNG steganography, Covenant Grunt, Filen C2) to CVE-2026-21509 Office exploitation.
- Earliest variant in the ExaTrack update (SHA256 85a796d7...1d2e) observed.
- ExaTrack publishes 'Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026' (Malpedia entry).
- Variant 66b8f030...ab8c, the baseline of ExaTrack's previous analysis, observed.
- Variant 125abe1a...d6a modifies string encryption; the password used for AES key derivation is now encrypted.
- Variant 146d511c...e60a switches persistence from the COM handler (CLSID 30d49246...) to the Default Associations Profile Handler (CLSID 0a556d98...), validates host process is explorer.exe, and drops the 'HIDE' magic number.
- Most recent variant in the report (SHA256 765a1035...8993) observed.
- ExaTrack publishes the PixyNetLoader campaign update stating the campaign is still ongoing; Malpedia indexes it the same day.
Sources cited for APT28 PixyNetLoader Campaign Update
- APT28 PixyNetLoader update (ExaTrack)
- Malpedia library entry: APT28 PixyNetLoader update
- Malpedia library entry: Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026 (ExaTrack)
- SOC Prime: APT28 PixyNetLoader Evolution from 2024 to 2026
- The Hacker News: APT28 Uses Microsoft Office CVE-2026-21509 (Operation Neusploit)
- HivePro: Operation Neusploit - APT28 Weaponizes CVE-2026-21509
Detection coverage for TL-2026-4418
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4418 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.