# APT28 PixyNetLoader Campaign Update: PNG-steganography loader delivering Covenant Grunt against Ukrainian military logistics

> ExaTrack documents nine PixyNetLoader variants (2026-05-28 through 2026-10-13) attributed to APT28. The DLL loader extracts a payload (typically a Covenant Grunt backdoor) hidden in a companion PNG via LSB steganography, delivered through malicious XLS/DOC lures targeting Ukrainian military logistics.

- **Published:** 2026-10-24T22:06:26Z
- **Last reviewed:** 2026-10-24T22:06:26Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4418
- **ID:** TL-2026-4418
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** APT28 (Russia)
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21509

## Description

ExaTrack's October 2026 update reports that the APT28 phishing campaign using PixyNetLoader is still ongoing, targeting Ukrainian military logistics with malicious Office (XLS/DOC) documents since 2025. PixyNetLoader is a DLL loader that extracts a payload from a companion PNG file using LSB steganography. The payload is typically a Covenant Grunt implant (the .NET Covenant C2 framework) that communicates through the FILEN cloud storage API, so C2 traffic blends into legitimate cloud-service traffic.

ExaTrack tracked nine variants with compile/observation dates from 2026-05-28 to 2026-10-13. In the July 2026 variant (2026-07-20) the string encryption routine was modified and the password used for AES key derivation became encrypted, although the structure stayed similar to earlier builds. Through August the loaders persisted through a hijacked COM handler registered under HKCU\Software\Classes\CLSID\{30d49246-d217-465f-b00b-ac9ddd652eb7}\InProcServer32, a CLSID that normally points to the legitimate IDStore.dll. The loader also checks that it is running inside explorer.exe before executing.

In the September 2026 variant (2026-09-04) persistence changed to a Default Associations Profile Handler COM registration under HKCU\Software\Classes\CLSID\{0a556d98-cfee-4d84-82a7-00377f939198}. This handler is loaded by shell32.dll inside explorer.exe. The malicious DLL forwards legitimate exports to the real shell32.dll and validates that the host process is explorer.exe. The September build also removed the 'HIDE' magic number and its associated validation checks.

Staging paths stayed consistent across iterations. DLLs are dropped to paths mimicking Microsoft components (C:\ProgramData\Microsoft\DeviceSync\DNX\dnxstore.dll, ...\PowerShell\PSReadLine\PSReadLineCore.dll, ...\Internet Explorer\UserData\Low\db\uimanager.dll). PNG carriers are stored at ...\Microsoft\Network\Cache\icon.png and C:\ProgramData\Microsoft\DeviceSync\Edge\wallpaper.png. Defenders can hunt for user-level CLSID registry entries whose default value deviates from legitimate system DLLs, and for these staging paths. Earlier public reporting (Zscaler ThreatLabz, via The Hacker News, 2026-02-03) tied PixyNetLoader to Operation Neusploit and CVE-2026-21509. The ExaTrack October update does not state a CVE for the current lures.

Severity is analyst-assigned; no CVE or CVSS is stated in the source.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1546.015 Component Object Model Hijacking
- T1574.001 DLL
- T1027.003 Steganography
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1480 Execution Guardrails
- T1036.005 Match Legitimate Resource Name or Location
- T1071.001 Web Protocols
- T1102.002 Bidirectional Communication

## Sources

- [APT28 PixyNetLoader update (ExaTrack)](https://exatrack.com/publications/pixynetloader-campaign-update.html)
- [Malpedia library entry: APT28 PixyNetLoader update](https://malpedia.caad.fkie.fraunhofer.de/library/4e6ec102-be34-462c-b72e-6b2d506087ab/)
- [Malpedia library entry: Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026 (ExaTrack)](https://malpedia.caad.fkie.fraunhofer.de/library/8b4b80f0-e531-4c5b-b92e-7480eb64df3c)
- [SOC Prime: APT28 PixyNetLoader Evolution from 2024 to 2026](https://socprime.com/active-threats/apt28-pixynetloader-evolution-from-2024-to-2026/)
- [The Hacker News: APT28 Uses Microsoft Office CVE-2026-21509 (Operation Neusploit)](https://thehackernews.com/2026/02/apt28-uses-microsoft-office-cve-2026.html)
- [HivePro: Operation Neusploit - APT28 Weaponizes CVE-2026-21509](https://www.hivepro.com/threat-advisory/operation-neusploit-apt28-weaponizes-cve-2026-21509/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4418